code: CipherSuiteList getActiveCipherSuites() {
          if (activeCipherSuites == null) {
              if (activeProtocols == null) {
                  activeProtocols = getActiveProtocols();
              }
  
              ArrayList<CipherSuite> suites = new ArrayList<>();
              if (!(activeProtocols.collection().isEmpty()) &&
                      activeProtocols.min.v != ProtocolVersion.NONE.v) {
                  for (CipherSuite suite : enabledCipherSuites.collection()) {
                      if (suite.obsoleted > activeProtocols.min.v &&
                              suite.supported <= activeProtocols.max.v) {
                          if (algorithmConstraints.permits(
                                  EnumSet.of(CryptoPrimitive.KEY_AGREEMENT),
                                  suite.name, null)) {
                              suites.add(suite);
                          }
                      } else if (debug != null && Debug.isOn("verbose")) {
                          if (suite.obsoleted <= activeProtocols.min.v) {
                              System.out.println(
                                  "Ignoring obsoleted cipher suite: " + suite);
                          } else {
                              System.out.println(
                                  "Ignoring unsupported cipher suite: " + suite);
                          }
                      }
                  }
              }
              activeCipherSuites = new CipherSuiteList(suites);
          }
  
          return activeCipherSuites;
      }
docs: Get the active cipher suites.
  
  In TLS 1.1, many weak or vulnerable cipher suites were obsoleted,
  such as TLS_RSA_EXPORT_WITH_RC4_40_MD5. The implementation MUST NOT
  negotiate these cipher suites in TLS 1.1 or later mode.
  
  Therefore, when the active protocols only include TLS 1.1 or later,
  the client cannot request to negotiate those obsoleted cipher
  suites.  That is, the obsoleted suites should not be included in the
  client hello. So we need to create a subset of the enabled cipher
  suites, the active cipher suites, which does not contain obsoleted
  cipher suites of the minimum active protocol.
  
  Return empty list instead of null if no active cipher suites.