private void initSSL(ChannelPipeline p, NettyServerRpcConnection conn, boolean supportPlaintext)
    throws X509Exception, IOException {
    SslContext nettySslContext = getSslContext();

    /*
     * our HostnameVerifier gets the host name from SSLEngine, so we have to construct the engine
     * properly by passing the remote address
     */

    if (supportPlaintext) {
      SocketAddress remoteAddress = p.channel().remoteAddress();
      OptionalSslHandler optionalSslHandler;

      if (remoteAddress instanceof InetSocketAddress) {
        InetSocketAddress remoteInetAddress = (InetSocketAddress) remoteAddress;
        optionalSslHandler = new OptionalSslHandlerWithHostPort(nettySslContext,
          remoteInetAddress.getHostString(), remoteInetAddress.getPort());
      } else {
        optionalSslHandler = new OptionalSslHandler(nettySslContext);
      }

      p.addLast("ssl", optionalSslHandler);
      LOG.debug("Dual mode SSL handler added for channel: {}", p.channel());
    } else {
      SocketAddress remoteAddress = p.channel().remoteAddress();
      SslHandler sslHandler;

      if (remoteAddress instanceof InetSocketAddress) {
        InetSocketAddress remoteInetAddress = (InetSocketAddress) remoteAddress;
        sslHandler = nettySslContext.newHandler(p.channel().alloc(),
          remoteInetAddress.getHostString(), remoteInetAddress.getPort());
      } else {
        sslHandler = nettySslContext.newHandler(p.channel().alloc());
      }

      sslHandler.setWrapDataSize(
        conf.getInt(HBASE_SERVER_NETTY_TLS_WRAP_SIZE, DEFAULT_HBASE_SERVER_NETTY_TLS_WRAP_SIZE));

      sslHandler.handshakeFuture()
        .addListener(future -> sslHandshakeCompleteHandler(conn, sslHandler, remoteAddress));

      p.addLast("ssl", sslHandler);
      LOG.debug("SSL handler added for channel: {}", p.channel());
    }
  }
Fatal watermark for pending outbound bytes of a single netty channel. If the number of pending
outbound bytes exceeds this threshold, the connection will be forcibly closed so that memory
can be reclaimed. The client will have to re-establish a new connection and retry any in-flight
requests.
<p>
Note: must be higher than the high watermark, otherwise it's ignored.
hbase-server/src/main/java/org/apache/hadoop/hbase/ipc/NettyRpcServer.java