private void assertInvalid(X509Certificate[] chain, X509TrustManager tm) {
        try {
            tm.checkClientTrusted(chain, "RSA");
            fail();
        } catch (CertificateException expected) {
            // Expected.
        }
        try {
            tm.checkServerTrusted(chain, "RSA");
            fail();
        } catch (CertificateException expected) {
            // Expected.
        }
    }
Ensure that our non-standard behavior of learning to trust new
intermediate CAs does not regress. http://b/3404902
common/src/test/java/org/conscrypt/TrustManagerImplTest.java