Handle TLS session upgrade failures
diff --git a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/nio/DefaultAsyncClientConnectionOperator.java b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/nio/DefaultAsyncClientConnectionOperator.java
index 1d2a8e9..6d89f2a 100644
--- a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/nio/DefaultAsyncClientConnectionOperator.java
+++ b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/nio/DefaultAsyncClientConnectionOperator.java
@@ -90,13 +90,18 @@
                     public void completed(final IOSession session) {
                         final DefaultManagedAsyncClientConnection connection = new DefaultManagedAsyncClientConnection(session);
                         if (tlsStrategy != null) {
-                            tlsStrategy.upgrade(
-                                    connection,
-                                    host,
-                                    session.getLocalAddress(),
-                                    session.getRemoteAddress(),
-                                    attachment,
-                                    connectTimeout);
+                            try {
+                                tlsStrategy.upgrade(
+                                        connection,
+                                        host,
+                                        session.getLocalAddress(),
+                                        session.getRemoteAddress(),
+                                        attachment,
+                                        connectTimeout);
+                            } catch (final Exception ex) {
+                                future.failed(ex);
+                                return;
+                            }
                         }
                         future.completed(connection);
                     }