* as a single request/response exchange.
 *
 * ## Modern TLS
 *
 * There are trade-offs when selecting which options to include when negotiating a secure connection
 * to a remote host. Newer TLS options are quite useful:
 *
 *  * Server Name Indication (SNI) enables one IP address to negotiate secure connections for
 *    multiple domain names.
 *

        @CsvSource({ "'smb://user:password@server/share', 'smb://user:******@server/share'",
                "'smb://domain\\user:secret@host/path', 'smb://domain\\user:******@host/path'",
                "'smb2://admin:admin123@192.168.1.1/folder', 'smb2://admin:******@192.168.1.1/folder'",
                "'smbs://test:p@******@****.***/share', 'smbs://test:******@example.com/share'" })

			Value: cfg.ConnectionString,
		},
		config.KV{
			Key:   target.PostgresTable,
			Value: cfg.Table,
		},
		config.KV{
			Key:   target.PostgresHost,
			Value: cfg.Host.String(),
		},
		config.KV{
			Key:   target.PostgresPort,
			Value: cfg.Port,
		},
		config.KV{
			Key:   target.PostgresUsername,
			Value: cfg.Username,
		},
		config.KV{

    OkHttpClientTestRule().apply {
      recordFrames = true
      // recordSslDebug = true
    }

  // https://tools.ietf.org/html/rfc6066#page-6 specifies a FQDN is required.
  val hostname = "local.host"
  private val handshakeCertificates =
    run {
      // Generate a self-signed cert for the server to serve and the client to trust.
      val heldCertificate =
        HeldCertificate
          .Builder()

	}
	opts := &minio.Options{
		Creds:     creds,
		Secure:    u.Scheme == "https",
		Transport: globalRemoteTargetTransport,
		Region:    conf.Region,
	}
	client, err := minio.New(u.Host, opts)
	if err != nil {
		return nil, err
	}
	client.SetAppInfo(fmt.Sprintf("s3-tier-%s", tier), ReleaseTag)

	core := &minio.Core{Client: client}
	return &warmBackendS3{
		client:       client,

```
export MINIO_IDENTITY_TLS_ENABLE=on
```

## Example

MinIO exposes a custom S3 STS API endpoint as `Action=AssumeRoleWithCertificate`. A client has to send an HTTP `POST` request to `https://<host>:<port>?Action=AssumeRoleWithCertificate&Version=2011-06-15`. Since the authentication and authorization happens via X.509 certificates the client has to send the request over **TLS** and has to provide
a client certificate.

     *
     * @param dc the domain controller address
     * @return the NTLM challenge bytes
     * @throws SmbException if an SMB error occurs
     * @throws UnknownHostException if the host cannot be resolved
     */
    public static byte[] getChallenge(final UniAddress dc) throws SmbException, UnknownHostException {
        return getChallenge(dc, 0);
    }

    /**

   * all subscribers in the order they are posted.
   *
   * <p>When all subscribers are dispatched to using a <i>direct</i> executor (which dispatches on
   * the same thread that posts the event), this yields a breadth-first dispatch order on each
   * thread. That is, all subscribers to a single event A will be called before any subscribers to

        return (DfsReferralDataImpl) base.combine(mockData);
    }

    @Nested
    @DisplayName("Interface Method Contract Tests")
    class InterfaceMethodTests {

        @Test
        @DisplayName("Should fixup host with FQDN")
        void testFixupHost() {
            String fqdn = "server.example.com";

            // Test with mock
            doNothing().when(mockReferralData).fixupHost(fqdn);

                    new ContentNotFoundException(urlQueue.getParentUrl(), url));
        }
    }

    /**
     * Stores a child URL in the crawling queue with duplicate host handling.
     * This method applies duplicate host conversion before storing the URL.
     *
     * @param childUrl the child URL to store
     * @param parentUrl the parent URL that referenced this child URL