public SSLConnection(CM_Stream chanmon)
	{
		cm = chanmon;
		com.grey.naf.SSLConfig sslcfg = cm.getSSLConfig();
		int peerport = (cm.iochan instanceof  java.nio.channels.SocketChannel ?
				((java.nio.channels.SocketChannel)cm.iochan).socket().getPort()
				: 0);
		engine = sslcfg.isClient ?
				sslcfg.ctx.createSSLEngine(sslcfg.peerCertName, peerport)
				: sslcfg.ctx.createSSLEngine();
		javax.net.ssl.SSLSession sess = engine.getSession();
		int netbufsiz = (BUFSIZ_SSL == 0 ? sess.getPacketBufferSize() : BUFSIZ_SSL);
		int appbufsiz = (BUFSIZ_APP == 0 ? sess.getApplicationBufferSize() : BUFSIZ_APP);
		sslprotoXmtBuf = com.grey.base.utils.NIOBuffers.create(netbufsiz, com.grey.naf.BufferSpec.directniobufs);
		sslprotoRcvBuf = com.grey.base.utils.NIOBuffers.create(netbufsiz, com.grey.naf.BufferSpec.directniobufs);
		appdataRcvBuf = com.grey.base.utils.NIOBuffers.create(appbufsiz, com.grey.naf.BufferSpec.directniobufs);
		dummyShakeBuf = com.grey.base.utils.NIOBuffers.create(1, false); //could possibly be static?
		engine.setUseClientMode(sslcfg.isClient); //must call this in both modes - even if getUseClientMode() already seems correct

		if (!sslcfg.isClient) {
			if (sslcfg.clientAuth == 1) {
				engine.setWantClientAuth(true);
			} else if (sslcfg.clientAuth == 2) {
				engine.setNeedClientAuth(true);
			}
		}
		lastExpireTime = sess.getCreationTime();
		logpfx = "SSL-"+(sslcfg.isClient ? "Client" : "Server")+": ";
	}