@Test public void subjectAltUsesLocalDomainAndIp() throws Exception {
        // cat cert.cnf
        // [req]
        // distinguished_name=distinguished_name
        // req_extensions=req_extensions
        // x509_extensions=x509_extensions
        // [distinguished_name]
        // [req_extensions]
        // [x509_extensions]
        // subjectAltName=DNS:localhost.localdomain,DNS:localhost,IP:127.0.0.1
        //
        // $ openssl req -x509 -nodes -days 36500 -subj '/CN=localhost' -config ./cert.cnf \
        //     -newkey rsa:512 -out cert.pem
        X509Certificate certificate = certificate(""
                + "-----BEGIN CERTIFICATE-----\n"
                + "MIIBWDCCAQKgAwIBAgIJANS1EtICX2AZMA0GCSqGSIb3DQEBBQUAMBQxEjAQBgNV\n"
                + "BAMTCWxvY2FsaG9zdDAgFw0xMjAxMDIxOTA4NThaGA8yMTExMTIwOTE5MDg1OFow\n"
                + "FDESMBAGA1UEAxMJbG9jYWxob3N0MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAPpt\n"
                + "atK8r4/hf4hSIs0os/BSlQLbRBaK9AfBReM4QdAklcQqe6CHsStKfI8pp0zs7Ptg\n"
                + "PmMdpbttL0O7mUboBC8CAwEAAaM1MDMwMQYDVR0RBCowKIIVbG9jYWxob3N0Lmxv\n"
                + "Y2FsZG9tYWlugglsb2NhbGhvc3SHBH8AAAEwDQYJKoZIhvcNAQEFBQADQQD0ntfL\n"
                + "DCzOCv9Ma6Lv5o5jcYWVxvBSTsnt22hsJpWD1K7iY9lbkLwl0ivn73pG2evsAn9G\n"
                + "X8YKH52fnHsCrhSD\n"
                + "-----END CERTIFICATE-----");

        assertEquals(new X500Principal("CN=localhost"), certificate.getSubjectX500Principal());
        FakeSSLSession session = new FakeSSLSession(certificate);

        X509Certificate[] certs = {};

        assertTrue(verifier.verify(certs, "localhost", session));
        assertTrue(verifier.verify(certs, "localhost.localdomain", session));
        assertFalse(verifier.verify(certs, "local.host", session));

        assertTrue(verifier.verify(certs, "127.0.0.1", session));
        assertFalse(verifier.verify(certs, "127.0.0.2", session));
    }
Ignored due to incompatibilities between Android and Java on how non-ASCII
subject alt names are parsed. Android fails to parse these, which means we
fall back to the CN. The RI does parse them, so the CN is unused.
common/src/test/java/org/conscrypt/HostnameVerifierTest.java