diff --git a/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java b/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java
index 08518f87ac..43b5766500 100644
--- a/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java
+++ b/java/org/apache/tomcat/util/net/AbstractJsseEndpoint.java
@@ -229,6 +229,9 @@ public abstract class AbstractJsseEndpoint<S,U> extends AbstractEndpoint<S,U> {
 
 
     protected abstract NetworkChannel getServerSocket();
+    protected S createChannel(SocketBufferHandler buffer) {
+        return null;
+    };
 
 
     @Override
diff --git a/java/org/apache/tomcat/util/net/Nio2Endpoint.java b/java/org/apache/tomcat/util/net/Nio2Endpoint.java
index 49ee411016..74361dea8e 100644
--- a/java/org/apache/tomcat/util/net/Nio2Endpoint.java
+++ b/java/org/apache/tomcat/util/net/Nio2Endpoint.java
@@ -316,11 +316,7 @@ public class Nio2Endpoint extends AbstractJsseEndpoint<Nio2Channel,AsynchronousS
                         socketProperties.getAppReadBufSize(),
                         socketProperties.getAppWriteBufSize(),
                         socketProperties.getDirectBuffer());
-                if (isSSLEnabled()) {
-                    channel = new SecureNio2Channel(bufhandler, this);
-                } else {
-                    channel = new Nio2Channel(bufhandler);
-                }
+                channel = createChannel(bufhandler);
             }
             Nio2SocketWrapper newWrapper = new Nio2SocketWrapper(channel, this);
             channel.reset(socket, newWrapper);
@@ -403,6 +399,13 @@ public class Nio2Endpoint extends AbstractJsseEndpoint<Nio2Channel,AsynchronousS
         return new SocketProcessor(socketWrapper, event);
     }
 
+    @Override
+    protected Nio2Channel createChannel(SocketBufferHandler buffer) {
+        if (isSSLEnabled()) {
+            return new SecureNio2Channel(buffer, this);
+        }
+        return new Nio2Channel(buffer);
+    }
 
     protected class Nio2Acceptor extends Acceptor<AsynchronousSocketChannel>
         implements CompletionHandler<AsynchronousSocketChannel, Void> {
diff --git a/java/org/apache/tomcat/util/net/NioEndpoint.java b/java/org/apache/tomcat/util/net/NioEndpoint.java
index 3c7c8e68a0..e50fa657aa 100644
--- a/java/org/apache/tomcat/util/net/NioEndpoint.java
+++ b/java/org/apache/tomcat/util/net/NioEndpoint.java
@@ -483,11 +483,7 @@ public class NioEndpoint extends AbstractJsseEndpoint<NioChannel,SocketChannel>
                         socketProperties.getAppReadBufSize(),
                         socketProperties.getAppWriteBufSize(),
                         socketProperties.getDirectBuffer());
-                if (isSSLEnabled()) {
-                    channel = new SecureNioChannel(bufhandler, this);
-                } else {
-                    channel = new NioChannel(bufhandler);
-                }
+                channel = createChannel(bufhandler);
             }
             NioSocketWrapper newWrapper = new NioSocketWrapper(channel, this);
             channel.reset(socket, newWrapper);
@@ -573,6 +569,14 @@ public class NioEndpoint extends AbstractJsseEndpoint<NioChannel,SocketChannel>
         return new SocketProcessor(socketWrapper, event);
     }
 
+    @Override
+    protected NioChannel createChannel(SocketBufferHandler buffer) {
+        if (isSSLEnabled()) {
+            return new SecureNioChannel(buffer, this);
+        }
+        return new NioChannel(buffer);
+    }
+
     // ----------------------------------------------------- Poller Inner Classes
 
     /**
diff --git a/java/org/apache/tomcat/util/net/SecureNio2Channel.java b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
index f0e4bb7636..e4dd25ae2a 100644
--- a/java/org/apache/tomcat/util/net/SecureNio2Channel.java
+++ b/java/org/apache/tomcat/util/net/SecureNio2Channel.java
@@ -93,6 +93,11 @@ public class SecureNio2Channel extends Nio2Channel  {
         handshakeWriteCompletionHandler = new HandshakeWriteCompletionHandler();
     }
 
+    protected void createSSLEngine(String hostName, List<Cipher> clientRequestedCiphers, List<String> clientRequestedApplicationProtocols) {
+        sslEngine = endpoint.createSSLEngine(hostName, clientRequestedCiphers,
+                clientRequestedApplicationProtocols);
+    }
+
 
     private class HandshakeReadCompletionHandler
             implements CompletionHandler<Integer, SocketWrapperBase<Nio2Channel>> {
@@ -374,7 +379,7 @@ public class SecureNio2Channel extends Nio2Channel  {
      * present and, if it is, what host name has been requested. Based on the
      * provided host name, configure the SSLEngine for this connection.
      */
-    private int processSNI() throws IOException {
+    protected int processSNI() throws IOException {
         // If there is no data to process, trigger a read immediately. This is
         // an optimisation for the typical case so we don't create an
         // SNIExtractor only to discover there is no data to process
@@ -436,7 +441,7 @@ public class SecureNio2Channel extends Nio2Channel  {
             log.debug(sm.getString("channel.nio.ssl.sniHostName", sc, hostName));
         }
 
-        sslEngine = endpoint.createSSLEngine(hostName, clientRequestedCiphers,
+        createSSLEngine(hostName, clientRequestedCiphers,
                 clientRequestedApplicationProtocols);
 
         // Populate additional TLS attributes obtained from the handshake that
diff --git a/java/org/apache/tomcat/util/net/SecureNioChannel.java b/java/org/apache/tomcat/util/net/SecureNioChannel.java
index 6e08db9d91..5a55344436 100644
--- a/java/org/apache/tomcat/util/net/SecureNioChannel.java
+++ b/java/org/apache/tomcat/util/net/SecureNioChannel.java
@@ -249,7 +249,7 @@ public class SecureNioChannel extends NioChannel {
      *
      * @throws IOException If an I/O error occurs during the SNI processing
      */
-    private int processSNI() throws IOException {
+    protected int processSNI() throws IOException {
         // Read some data into the network input buffer so we can peek at it.
         int bytesRead = sc.read(netInBuffer);
         if (bytesRead == -1) {
@@ -305,7 +305,7 @@ public class SecureNioChannel extends NioChannel {
             log.debug(sm.getString("channel.nio.ssl.sniHostName", sc, hostName));
         }
 
-        sslEngine = endpoint.createSSLEngine(hostName, clientRequestedCiphers,
+        createSSLEngine(hostName, clientRequestedCiphers,
                 clientRequestedApplicationProtocols);
 
         // Populate additional TLS attributes obtained from the handshake that
@@ -897,6 +897,11 @@ public class SecureNioChannel extends NioChannel {
     }
 
 
+    protected void createSSLEngine(String hostName, List<Cipher> clientRequestedCiphers, List<String> clientRequestedApplicationProtocols) {
+        sslEngine = endpoint.createSSLEngine(hostName, clientRequestedCiphers,
+                clientRequestedApplicationProtocols);
+    }
+
     private enum OverflowState {
         NONE,
         PROCESSING,
