@Override
    void setChannelIdPrivateKey(PrivateKey privateKey) {
        if (!getUseClientMode()) {
            throw new IllegalStateException("Not allowed in server mode");
        }

        synchronized (ssl) {
            if (isHandshakeStarted()) {
                throw new IllegalStateException("Could not change Channel ID private key "
                        + "after the initial handshake has begun.");
            }

            if (privateKey == null) {
                sslParameters.channelIdEnabled = false;
                channelIdPrivateKey = null;
                return;
            }

            sslParameters.channelIdEnabled = true;
            try {
                ECParameterSpec ecParams = null;
                if (privateKey instanceof ECKey) {
                    ecParams = ((ECKey) privateKey).getParams();
                }
                if (ecParams == null) {
                    // Assume this is a P-256 key, as specified in the contract of this method.
                    ecParams =
                            OpenSSLECGroupContext.getCurveByName("prime256v1").getECParameterSpec();
                }
                channelIdPrivateKey =
                        OpenSSLKey.fromECPrivateKeyForTLSStackOnly(privateKey, ecParams);
            } catch (InvalidKeyException e) {
                // Will have error in startHandshake
            }
        }
    }
Sets the {@link PrivateKey} to be used for TLS Channel ID by this client engine.

<p>This method needs to be invoked before the handshake starts.

@param privateKey private key (enables TLS Channel ID) or {@code null} for no key (disables
       TLS Channel ID). The private key must be an Elliptic Curve (EC) key based on the NIST
       P-256 curve (aka SECG secp256r1 or ANSI X9.62 prime256v1).

@throws IllegalStateException if this is a server engine or if the handshake has already
        started.
common/src/main/java/org/conscrypt/ConscryptEngine.java