@Override
  public ByteBufferSharing unwrap(ByteBuffer wrappedBuffer) throws IOException {
    try (final ByteBufferSharing inputSharing = inputBufferVendor.open()) {

      ByteBuffer peerAppData = inputSharing.getBuffer();

      // note that we do not clear peerAppData as it may hold a partial
      // message. TcpConduit, for instance, uses message chunking to
      // transmit large payloads and we may have read a partial chunk
      // during the previous unwrap

      peerAppData.limit(peerAppData.capacity());
      boolean stopDecryption = false;
      while (wrappedBuffer.hasRemaining() && !stopDecryption) {
        SSLEngineResult unwrapResult = engine.unwrap(wrappedBuffer, peerAppData);
        switch (unwrapResult.getStatus()) {
          case BUFFER_OVERFLOW:
            // buffer overflow expand and try again - double the available decryption space
            int newCapacity =
                (peerAppData.capacity() - peerAppData.position()) * 2 + peerAppData.position();
            newCapacity = Math.max(newCapacity, peerAppData.capacity() / 2 * 3);
            peerAppData = inputSharing.expandWriteBufferIfNeeded(newCapacity);
            peerAppData.limit(peerAppData.capacity());
            break;
          case BUFFER_UNDERFLOW:
            // partial data - need to read more. When this happens the SSLEngine will not have
            // changed the buffer position
            wrappedBuffer.compact();
            return inputBufferVendor.open();
          case OK:
            break;
          default:
            // if there is data in the decrypted buffer return it. Otherwise signal that we're
            // having trouble
            if (peerAppData.position() <= 0) {
              throw new SSLException("Error decrypting data: " + unwrapResult);
            }
            stopDecryption = true;
            break;
        }
      }
      wrappedBuffer.clear();
      return inputBufferVendor.open();
    }
  }
This will throw an SSLHandshakeException if the handshake doesn't terminate in a FINISHED
state. It may throw other IOExceptions caused by I/O operations
geode-core/src/main/java/org/apache/geode/internal/net/NioSslEngine.java