         // Given
         let publicKeys = [TestPublicKeys.rootCA]
         let policies: [String: ServerTrustPolicy] = [
-            host: .pinPublicKeys(publicKeys: publicKeys, validateCertificateChain: false, validateHost: true)
-        ]
-
-        let manager = SessionManager(
-            configuration: configuration,
-            serverTrustPolicyManager: ServerTrustPolicyManager(policies: policies)
-        )
-
-        weak var expectation = self.expectation(description: "\(urlString)")
-        var error: Error?
-
-        // When
-        manager.request(urlString)
-            .response { resp in
-                error = resp.error
-                expectation?.fulfill()
+            expiredHost: .pinPublicKeys(publicKeys: publicKeys, validateCertificateChain: false, validateHost: true)
+        ]
+
+        let manager = SessionManager(
+            configuration: configuration,
+            serverTrustPolicyManager: ServerTrustPolicyManager(policies: policies)
+        )
+
+        let expectation = self.expectation(description: "\(expiredURLString)")
+        var error: Error?
+
+        // When
+        manager.request(expiredURLString)
+            .response { resp in
+                error = resp.error
+                expectation.fulfill()
             }
 
         waitForExpectations(timeout: timeout, handler: nil)

// MARK: -

class TLSEvaluationExpiredLeafCertificateTestCase: BaseTestCase {
    let urlString = "https://expired.badssl.com/"
    let host = "expired.badssl.com"
    var configuration: URLSessionConfiguration!

    // MARK: Setup and Teardown

    override func setUp() {
        super.setUp()
        configuration = URLSessionConfiguration.ephemeral
    }

    // MARK: Default Behavior Tests

    func testThatExpiredCertificateRequestFailsWithNoServerTrustPolicy() {
        // Given
        weak var expectation = self.expectation(description: "\(urlString)")
        let manager = SessionManager(configuration: configuration)
        var error: Error?

        // When
        manager.request(urlString)
            .response { resp in
                error = resp.error
                expectation?.fulfill()
            }

        waitForExpectations(timeout: timeout, handler: nil)

        }
    }

    func testThatRevokedCertificateRequestFailsWithNoServerTrustPolicy() {
        // Given
        let expectation = self.expectation(description: "\(revokedURLString)")
        let manager = SessionManager(configuration: configuration)

        var error: Error?

        // When
        manager.request(revokedURLString)
            .response { resp in
                error = resp.error
                expectation.fulfill()
            }

        waitForExpectations(timeout: timeout, handler: nil)

        // Then
        if #available(iOS 10.1, macOS 10.12, tvOS 10.1, *) {
            // Apple appears to have started revocation tests as part of default evaluation in 10.1
            XCTAssertNotNil(error)
        } else {
            XCTAssertNil(error)
        }
    }

    // MARK: Server Trust Policy - Perform Default Tests

    func testThatExpiredCertificateRequestFailsWithDefaultServerTrustPolicy() {
        // Given
        let policies = [expiredHost: ServerTrustPolicy.performDefaultEvaluation(validateHost: true)]
        let manager = SessionManager(
            configuration: configuration,
            serverTrustPolicyManager: ServerTrustPolicyManager(policies: policies)
        )

        let expectation = self.expectation(description: "\(expiredURLString)")
        var error: Error?

        // When
        manager.request(expiredURLString)
            .response { resp in
                error = resp.error
                expectation.fulfill()
            }

        waitForExpectations(timeout: timeout, handler: nil)
