internal async Task <Stream> CreateStream(WebConnectionTunnel tunnel, CancellationToken cancellationToken)
        {
#if SECURITY_DEP
            var socket = networkStream.InternalSocket;
            WebConnection.Debug($"MONO TLS STREAM CREATE STREAM: {socket.ID}");
            sslStream = provider.CreateSslStream(networkStream, false, settings);

            try {
                var host = request.Host;
                if (!string.IsNullOrEmpty(host))
                {
                    var pos = host.IndexOf(':');
                    if (pos > 0)
                    {
                        host = host.Substring(0, pos);
                    }
                }

                await sslStream.AuthenticateAsClientAsync(
                    host, request.ClientCertificates,
                    (SslProtocols)ServicePointManager.SecurityProtocol,
                    ServicePointManager.CheckCertificateRevocationList).ConfigureAwait(false);

                status = WebExceptionStatus.Success;
            } catch (Exception ex) {
                WebConnection.Debug($"MONO TLS STREAM ERROR: {socket.ID} {socket.CleanedUp} {ex.Message}");
                if (socket.CleanedUp)
                {
                    status = WebExceptionStatus.RequestCanceled;
                }
                else
                {
                    status = WebExceptionStatus.SecureChannelFailure;
                }
                throw;
            } finally {
                WebConnection.Debug($"MONO TLS STREAM CREATE STREAM DONE: {socket.ID} {socket.CleanedUp}");
                if (CertificateValidationFailed)
                {
                    status = WebExceptionStatus.TrustFailure;
                }

                if (status == WebExceptionStatus.Success)
                {
                    request.ServicePoint.UpdateClientCertificate(sslStream.InternalLocalCertificate);
                }
                else
                {
                    request.ServicePoint.UpdateClientCertificate(null);
                    sslStream.Dispose();
                    sslStream = null;
                }
            }

            try {
                if (tunnel?.Data != null)
                {
                    await sslStream.WriteAsync(tunnel.Data, 0, tunnel.Data.Length, cancellationToken).ConfigureAwait(false);
                }
            } catch {
                status    = WebExceptionStatus.SendFailure;
                sslStream = null;
                throw;
            }

            return(sslStream.AuthenticatedStream);
#else
            throw new PlatformNotSupportedException(EXCEPTION_MESSAGE);
#endif
        }