private void maybeProcessHandshakeFailure(SSLException sslException, boolean flush, IOException ioException) throws IOException {
        if (sslException instanceof SSLHandshakeException || sslException instanceof SSLProtocolException ||
                sslException instanceof SSLPeerUnverifiedException || sslException instanceof SSLKeyException ||
                sslException.getMessage().contains("Unrecognized SSL message") ||
                sslException.getMessage().contains("Received fatal alert: "))
            handshakeFailure(sslException, flush);
        else if (ioException == null)
            throw sslException;
        else {
            log.debug("SSLException while unwrapping data after IOException, original IOException will be propagated", sslException);
            throw ioException;
        }
    }
SSL exceptions are propagated as authentication failures so that clients can avoid
retries and report the failure. If `flush` is true, exceptions are propagated after
any pending outgoing bytes are flushed to ensure that the peer is notified of the failure.
clients/src/main/java/org/apache/kafka/common/network/SslTransportLayer.java