derWriter.write(
      name = "test",
      tagClass = DerHeader.TAG_CLASS_UNIVERSAL,
      tag = 16L,
    ) {
      derWriter.write(
        name = "test",
        tagClass = DerHeader.TAG_CLASS_UNIVERSAL,
        tag = 21L,
      ) {
        derWriter.writeOctetString("Smith".encodeUtf8())
      }

      derWriter.write(
        name = "test",

 * verification).
 */
private val VERIFY_AS_IP_ADDRESS = "([0-9a-fA-F]*:[0-9a-fA-F:.]*)|([\\d.]+)".toRegex()

/** Returns true if this string is not a host name and might be an IP address. */
fun String.canParseAsIpAddress(): Boolean = VERIFY_AS_IP_ADDRESS.matches(this)

/**
 * Returns true if the length is not valid for DNS (empty or greater than 253 characters), or if any

 * * `Response.body().charStream().close()`
 * * `Response.body().byteStream().close()`
 * * `Response.body().bytes()`
 * * `Response.body().string()`
 *
 * There is no benefit to invoking multiple `close()` methods for the same response body.
 *
 * For synchronous calls, the easiest way to make sure a response body is closed is with a `try`
 * block. With this structure the compiler inserts an implicit `finally` clause that calls

  }

  /**
   * A timestamp like "191216030210Z" or "20191215190210-0800" for 2019-12-15T19:02:10-08:00. This
   * is the same as [UTC_TIME] with the exception of the 4-digit year.
   */
  val GENERALIZED_TIME =
    BasicDerAdapter(
      name = "GENERALIZED TIME",
      tagClass = DerHeader.TAG_CLASS_UNIVERSAL,
      tag = 24L,
      codec =
        object : BasicDerAdapter.Codec<Long> {

    //  ["℡.com", "K.com"]
    // to contain exactly (and in same order):
    //  ["���.com", "���.com"]
    platform.assumeNotBouncyCastle()

    // $ cat ./cert.cnf
    // [req]
    // distinguished_name=distinguished_name
    // req_extensions=req_extensions
    // x509_extensions=x509_extensions
    // [distinguished_name]
    // [req_extensions]
    // [x509_extensions]

          responseBuilder
        }
        statusLine.code in (102 until 200) -> {
          // Processing and Early Hints will mean a second headers are coming.
          // Treat others the same for now
          state = STATE_READ_RESPONSE_HEADERS
          responseBuilder
        }
        else -> {
          state = STATE_OPEN_RESPONSE_BODY
          responseBuilder
        }
      }

        this.handshake = handshake
      }

    /**
     * Sets the header named [name] to [value]. If this request already has any headers
     * with that name, they are all replaced.
     */
    open fun header(
      name: String,
      value: String,
    ) = commonHeader(name, value)

    /**
     * Adds a header with [name] to [value]. Prefer this method for multiply-valued
     * headers like "Set-Cookie".

    assertFailsWith<IllegalArgumentException> {
      builder.add("example.com", "sha1/DmxUShsZuNiqPQsX2Oi9uv2sCnw*")
    }
  }

  /** Multiple certificates generated from the same keypair have the same pin.  */
  @Test
  fun sameKeypairSamePin() {
    val heldCertificateA2 =
      HeldCertificate.Builder()
        .keyPair(certA1.keyPair)
        .serialNumber(101L)
        .build()

/** Returns true if we should void putting this this header in an exception or toString(). */
internal fun isSensitiveHeader(name: String): Boolean {
  return name.equals("Authorization", ignoreCase = true) ||
    name.equals("Cookie", ignoreCase = true) ||
    name.equals("Proxy-Authorization", ignoreCase = true) ||
    name.equals("Set-Cookie", ignoreCase = true)
}

internal fun Char.parseHexDigit(): Int =
  when (this) {

    private val sourcePipe: Pipe,
    private val sinkPipe: Pipe,
  ) : RealWebSocket.Streams(client, sourcePipe.source.buffer(), sinkPipe.sink.buffer()) {
    private val name = if (client) "client" else "server"
    val listener = WebSocketRecorder(name)
    var webSocket: RealWebSocket? = null
    var closed = false
    var canceled = false

    fun initWebSocket(
      random: Random?,