}

    fun build(): HandshakeCertificates {
      val immutableInsecureHosts = insecureHosts.toImmutableList()

      val heldCertificate = heldCertificate
      if (heldCertificate != null && heldCertificate.keyPair.private.format == null) {
        throw KeyStoreException("unable to support unencodable private key")
      }

      val keyManager = newKeyManager(null, heldCertificate, *(intermediates ?: emptyArray()))

    val privateKey =
      keyFactory.generatePrivate(
        PKCS8EncodedKeySpec(privateKeyBytes.toByteArray()),
      )
    val heldCertificate =
      HeldCertificate
        .Builder()
        .keyPair(publicKey, privateKey)
        .commonName("cash.app")
        .validityInterval(0L, 1000L)
        .rsa2048()
        .build()
    assertThat(
      """
      |-----BEGIN CERTIFICATE-----