private byte[] addGssMicAvsToTargetInfo( final byte[] originalTargetInfo,
            final Certificate peerServerCertificate ) throws NTLMEngineException
        {
            final byte[] newTargetInfo = new byte[originalTargetInfo.length + 8 + 20];
            final int appendLength = originalTargetInfo.length - 4; // last tag is MSV_AV_EOL, do not copy that
            System.arraycopy( originalTargetInfo, 0, newTargetInfo, 0, appendLength );
            writeUShort( newTargetInfo, MSV_AV_FLAGS, appendLength );
            writeUShort( newTargetInfo, 4, appendLength + 2 );
            writeULong( newTargetInfo, MSV_AV_FLAGS_MIC, appendLength + 4 );
            writeUShort( newTargetInfo, MSV_AV_CHANNEL_BINDINGS, appendLength + 8 );
            writeUShort( newTargetInfo, 16, appendLength + 10 );

            final byte[] channelBindingsHash;
            try
            {
                final byte[] certBytes = peerServerCertificate.getEncoded();
                final MessageDigest sha256 = MessageDigest.getInstance( "SHA-256" );
                final byte[] certHashBytes = sha256.digest( certBytes );
                final byte[] channelBindingStruct = new byte[16 + 4 + MAGIC_TLS_SERVER_ENDPOINT.length
                    + certHashBytes.length];
                writeULong( channelBindingStruct, 0x00000035, 16 );
                System.arraycopy( MAGIC_TLS_SERVER_ENDPOINT, 0, channelBindingStruct, 20,
                    MAGIC_TLS_SERVER_ENDPOINT.length );
                System.arraycopy( certHashBytes, 0, channelBindingStruct, 20 + MAGIC_TLS_SERVER_ENDPOINT.length,
                    certHashBytes.length );
                final MessageDigest md5 = getMD5();
                channelBindingsHash = md5.digest( channelBindingStruct );
            }
            catch (final CertificateEncodingException | NoSuchAlgorithmException e )
            {
                throw new NTLMEngineException( e.getMessage(), e );
            }

            System.arraycopy( channelBindingsHash, 0, newTargetInfo, appendLength + 12, 16 );
            return newTargetInfo;
         }
Add GSS channel binding hash and MIC flag to the targetInfo.
Looks like this is needed if we want to use exported session key for GSS wrapping.
httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/NTLMEngineImpl.java