Conscrypt has made some uncommon implementation choices which it's useful to be aware of.
The supported cipher suites in TLS 1.3 are always enabled. Attempts to disable them by omitting them from calls to setEnabledCipherSuites() are ignored.
Conscrypt's hostname verification (enabled by setEndpointIdentificationAlgorithm("HTTPS")) defers entirely to the hostname verifier. The default HostnameVerifier on OpenJDK always fails, so a HostnameVerifier or ConscryptHostnameVerifier must be set to use hostname verification on OpenJDK. On Android, the default HostnameVerifier performs RFC 2818 hostname validation, so it will work out of the box.
Conscrypt's AEAD ciphers do not support incremental processing (i.e. they will always return null from calls to update()). Input is only processed on a call to doFinal(). This ensures that the caller cannot work with output data before the authenticator has been processed, but it also means that the input data must be buffered completely for each operation. This may necessitate splitting larger inputs into chunks; see the BoringSSL docs for a discussion of important factors in doing so safely.
Conscrypt's OAEP ciphers (eg, RSA/ECB/OAEPWithSHA-256AndMGF1Padding) use the named digest for both the main digest and the MGF1 digest. This differs from the behavior of some other providers, including the ones bundled with OpenJDK, which always use SHA-1 for the MGF1 digest. For maximum compatibility, you should use RSA/ECB/OAEPPadding and initialize it with an OAEPParameterSpec.