Following up on yesterday's Foundation meeting, here is a little bit of code from JLDAP's implementation to do StartTLS with JSSE: http://www.openldap.org/devel/cvsweb.cgi/~checkout~/com/novell/ldap/LDAPJSSEStartTLSFactory.java?rev=1.2&cvsroot=JLDAP&hideattic=1&sortbydate=0 JSSE's javax.net.ssl.SSLSocketFactory.createSocket() accepts an already-connected socket over which to start TLS. (http://java.sun.com/j2se/1.4/docs/api/javax/net/ssl/SSLSocketFactory.html) -Mike