diff --git a/handler/src/main/java/io/netty/handler/ssl/ApplicationProtocolNegotiationHandler.java b/handler/src/main/java/io/netty/handler/ssl/ApplicationProtocolNegotiationHandler.java
index 48a632706d..7810d5aa4a 100644
--- a/handler/src/main/java/io/netty/handler/ssl/ApplicationProtocolNegotiationHandler.java
+++ b/handler/src/main/java/io/netty/handler/ssl/ApplicationProtocolNegotiationHandler.java
@@ -99,8 +99,7 @@ public abstract class ApplicationProtocolNegotiationHandler extends ChannelInbou
                 String protocol = sslHandler.applicationProtocol();
                 configurePipeline(ctx, protocol != null? protocol : fallbackProtocol);
             } else {
-                logger.warn("{} TLS handshake failed:", ctx.channel(), handshakeEvent.cause());
-                ctx.close();
+                handshakeFailure(ctx, handshakeEvent.cause());
             }
         }
 
@@ -117,6 +116,14 @@ public abstract class ApplicationProtocolNegotiationHandler extends ChannelInbou
      */
     protected abstract void configurePipeline(ChannelHandlerContext ctx, String protocol) throws Exception;
 
+    /**
+     * Invoked on failed initial SSL/TLS handshake.
+     */
+    protected void handshakeFailure(ChannelHandlerContext ctx, Throwable cause) throws Exception {
+        logger.warn("{} TLS handshake failed:", ctx.channel(), cause);
+        ctx.close();
+    }
+
     @Override
     public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) throws Exception {
         logger.warn("{} Failed to select the application-level protocol:", ctx.channel(), cause);