.certificateAuthority(0)
        .commonName("compromised intermediate")
        .signedBy(pinnedRoot)
        .build()
    val attackerIntermediate =
      HeldCertificate
        .Builder()
        .keyPair(attackerCa.keyPair) // Share keys between compromised CA and intermediate!
        .serialNumber(4L)
        .certificateAuthority(0) // More intermediates than permitted by signer!
        .commonName("attacker intermediate")

    assertThrows(IllegalArgumentException.class, () -> intermediate.indexes(1, -1, 3));
  }

  public void testScale_indexes_varargs_tooHigh() {
    Quantiles.Scale intermediate = Quantiles.scale(10);
    assertThrows(IllegalArgumentException.class, () -> intermediate.indexes(1, 11, 3));
  }

  public void testScale_indexes_collection_negative() {

    assertThrows(IllegalArgumentException.class, () -> intermediate.indexes(1, -1, 3));
  }

  public void testScale_indexes_varargs_tooHigh() {
    Quantiles.Scale intermediate = Quantiles.scale(10);
    assertThrows(IllegalArgumentException.class, () -> intermediate.indexes(1, 11, 3));
  }

  public void testScale_indexes_collection_negative() {

    }

    /**
     * Mark this referral as intermediate (requires further resolution)
     */
    public void intermediate() {
        this.intermediate = true;
    }

    /**
     * @return the intermediate
     */
    @Override
    public boolean isIntermediate() {
        return this.intermediate;
    }

    @Override
    public String toString() {

        .Builder()
        .certificateAuthority(1)
        .build()
    val intermediate =
      HeldCertificate
        .Builder()
        .certificateAuthority(0)
        .signedBy(root)
        .build()
    val certificate =
      HeldCertificate
        .Builder()
        .signedBy(intermediate)
        .build()
    val handshakeCertificates =
      HandshakeCertificates

     *
     * The chain should include all intermediate certificates but does not need the root certificate
     * that we expect to be known by the remote peer. The peer already has that certificate so
     * transmitting it is unnecessary.
     */
    fun heldCertificate(
      heldCertificate: HeldCertificate,
      vararg intermediates: X509Certificate,
    ) = apply {

 *
 * In this example the HTTP client already knows and trusts the last certificate, "Entrust Root
 * Certification Authority - G2". That certificate is used to verify the signature of the
 * intermediate certificate, "Entrust Certification Authority - L1M". The intermediate certificate
 * is used to verify the signature of the "www.squareup.com" certificate.
 *
 * This roles are reversed for client authentication. In that case the client has a private key and

        GsaConfigException exception = new GsaConfigException("Top level GSA error", intermediateCause);

        assertNotNull(exception);
        assertEquals("Top level GSA error", exception.getMessage());

        // Check first level cause
        assertNotNull(exception.getCause());
        assertEquals("Intermediate problem", exception.getCause().getMessage());

    void testExceptionChaining() {
        // Given
        Exception rootCause = new IllegalStateException("Root error");
        RuntimeCIFSException intermediateCause = new RuntimeCIFSException("Intermediate", rootCause);

        // When
        RuntimeCIFSException finalException = new RuntimeCIFSException("Final error", intermediateCause);

        // Then

        Exception intermediateCause = new IllegalStateException("Intermediate cause", rootCause);
        ScriptEngineException exception = new ScriptEngineException("Top level error", intermediateCause);

        assertEquals("Top level error", exception.getMessage());
        assertEquals(intermediateCause, exception.getCause());
        assertEquals("Intermediate cause", exception.getCause().getMessage());