.hostnameVerifier(RecordingHostnameVerifier())
        .connectionSpecs(
          // Attempt RESTRICTED_TLS then fall back to MODERN_TLS.
          listOf(
            ConnectionSpec.RESTRICTED_TLS,
            ConnectionSpec.MODERN_TLS,
          ),
        ).sslSocketFactory(
          suppressTlsFallbackClientSocketFactory(),
          handshakeCertificates.trustManager,
        ).build()

import okhttp3.internal.toImmutableList

/**
 * A record of a TLS handshake. For HTTPS clients, the client is *local* and the remote server is
 * its *peer*.
 *
 * This value object describes a completed handshake. Use [ConnectionSpec] to set policy for new
 * handshakes.
 */
class Handshake internal constructor(
  /**
   * Returns the TLS version used for this connection. This value wasn't tracked prior to OkHttp

 *     [RealConnection.isEligible] for details.
 *
 *  3. Attempt plans from prior connect attempts for this call. These occur as either follow-ups to
 *     failed connect attempts (such as trying the next [ConnectionSpec]), or as attempts that lost
 *     a race in fast follow-up.
 *
 *  4. If there's no existing connection, make a list of routes (which may require blocking DNS

   noCache, noStore, noTransform, onlyIfCached, sMaxAgeSeconds
 * **Challenge**: authParams, charset, realm, scheme
 * **CipherSuite**: javaName
 * **ConnectionSpec**: cipherSuites, supportsTlsExtensions, tlsVersions
 * **Cookie**: domain, expiresAt, hostOnly, httpOnly, name, path, persistent, value
 * **Dispatcher**: executorService
 * **FormBody**: size

        .newBuilder()
        .hostnameVerifier(
          RecordingHostnameVerifier(),
        ) // Attempt RESTRICTED_TLS then fall back to MODERN_TLS.
        .connectionSpecs(Arrays.asList(ConnectionSpec.RESTRICTED_TLS, ConnectionSpec.MODERN_TLS))
        .sslSocketFactory(
          suppressTlsFallbackClientSocketFactory(),
          handshakeCertificates.trustManager,
        ).build()