> Isn't that a particularly important case to support: using SSL but without encryption / authentication?
As far as I can tell, SSL_NULL_WITH_NULL_NULL is only used during handshaking (and maybe renegotiation?). I didn't expect an SSL session to be select that cipher suite via negotiation.

> Also IMO the protocol should be reliable to always provide the message when the handshake is finished.
I agree. I originally had this in a more general `SSLSessionInfo` class outside of `SslTlsSupport` and I was guarding against folks calling `SSLSessionInfo.fromSession` with a session that hasn't been established. Perhaps it is better to just document that calling `fromSession` with a session that hasn't completed handshaking will result in an exception. WDYT?