src/java.net.http/share/classes/jdk/internal/net/http/AsyncSSLTunnelConnection.java

@@ -27,10 +27,12 @@
 
 import java.net.InetSocketAddress;
 import java.nio.channels.SocketChannel;
 import java.util.concurrent.CompletableFuture;
 import java.net.http.HttpHeaders;
+import java.util.function.Function;
+import jdk.internal.net.http.common.MinimalFuture;
 import jdk.internal.net.http.common.SSLTube;
 import jdk.internal.net.http.common.Utils;
 
 /**
  * An SSL tunnel built on a Plain (CONNECT) TCP tunnel.

@@ -51,17 +53,17 @@
         this.plainConnection = new PlainTunnelingConnection(addr, proxy, client, proxyHeaders);
         this.writePublisher = new PlainHttpPublisher();
     }
 
     @Override
-    public CompletableFuture<Void> connectAsync() {
+    public CompletableFuture<Void> connectAsync(Exchange<?> exchange) {
         if (debug.on()) debug.log("Connecting plain tunnel connection");
         // This will connect the PlainHttpConnection flow, so that
         // its HttpSubscriber and HttpPublisher are subscribed to the
         // SocketTube
         return plainConnection
-                .connectAsync()
+                .connectAsync(exchange)
                 .thenApply( unused -> {
                     if (debug.on()) debug.log("creating SSLTube");
                     // create the SSLTube wrapping the SocketTube, with the given engine
                     flow = new SSLTube(engine,
                                        client().theExecutor(),

@@ -69,10 +71,25 @@
                                        plainConnection.getConnectionFlow());
                     return null;} );
     }
 
     @Override
+    public CompletableFuture<Void> finishConnect() {
+        // The actual ALPN value, which may be the empty string, is not
+        // interesting at this point, only that the handshake has completed.
+        return getALPN()
+                .handle((String unused, Throwable ex) -> {
+                    if (ex == null) {
+                        return plainConnection.finishConnect();
+                    } else {
+                        plainConnection.close();
+                        return MinimalFuture.<Void>failedFuture(ex);
+                    } })
+                .thenCompose(Function.identity());
+    }
+
+    @Override
     boolean isTunnel() { return true; }
 
     @Override
     boolean connected() {
         return plainConnection.connected(); // && sslDelegate.connected();

@@ -85,15 +102,10 @@
     public String toString() {
         return "AsyncSSLTunnelConnection: " + super.toString();
     }
 
     @Override
-    PlainTunnelingConnection plainConnection() {
-        return plainConnection;
-    }
-
-    @Override
     ConnectionPool.CacheKey cacheKey() {
         return ConnectionPool.cacheKey(address, plainConnection.proxyAddr);
     }
 
     @Override