public CloseableHttpClient build() {
 //省略部分代碼
 HttpClientConnectionManager connManagerCopy = this.connManager;
 //如果指定了連接池管理器則使用指定的，否則新建一個默認的
 if (connManagerCopy == null) {
  LayeredConnectionSocketFactory sslSocketFactoryCopy = this.sslSocketFactory;
  if (sslSocketFactoryCopy == null) {
  //如果開啟了使用環境變量，https版本與密碼控件從環境變量中讀取
  final String[] supportedProtocols = systemProperties ? split(
   System.getProperty("https.protocols")) : null;
  final String[] supportedCipherSuites = systemProperties ? split(
   System.getProperty("https.cipherSuites")) : null;
  //如果沒有指定，使用默認的域名驗證器，會根據ssl會話中服務端返回的證書來驗證與域名是否匹配
  HostnameVerifier hostnameVerifierCopy = this.hostnameVerifier;
  if (hostnameVerifierCopy == null) {
   hostnameVerifierCopy = new DefaultHostnameVerifier(publicSuffixMatcherCopy);
  }
  //如果制定了SslContext則生成定制的SSL連接工廠，否則使用默認的連接工廠
  if (sslContext != null) {
   sslSocketFactoryCopy = new SSLConnectionSocketFactory(
    sslContext, supportedProtocols, supportedCipherSuites, hostnameVerifierCopy);
  } else {
   if (systemProperties) {
   sslSocketFactoryCopy = new SSLConnectionSocketFactory(
    (SSLSocketFactory) SSLSocketFactory.getDefault(),
    supportedProtocols, supportedCipherSuites, hostnameVerifierCopy);
   } else {
   sslSocketFactoryCopy = new SSLConnectionSocketFactory(
    SSLContexts.createDefault(),
    hostnameVerifierCopy);
   }
  }
  }
  //將Ssl連接工廠注冊到連接池管理器中，當需要產生Https連接的時候，會根據上面的SSL連接工廠生產SSL連接
  @SuppressWarnings("resource")
  final PoolingHttpClientConnectionManager poolingmgr = new PoolingHttpClientConnectionManager(
   RegistryBuilder.<ConnectionSocketFactory>create()
   .register("http", PlainConnectionSocketFactory.getSocketFactory())
   .register("https", sslSocketFactoryCopy)
   .build(),
   null,
   null,
   dnsResolver,
   connTimeToLive,
   connTimeToLiveTimeUnit != null ? connTimeToLiveTimeUnit : TimeUnit.MILLISECONDS);
  //省略部分代碼
 }
}

public void connect(
   final ManagedHttpClientConnection conn,
   final HttpHost host,
   final InetSocketAddress localAddress,
   final int connectTimeout,
   final SocketConfig socketConfig,
   final HttpContext context) throws IOException {
  //之前在HttpClientBuilder中register了http與https不同的連接池實現，這里lookup獲得Https的實現，即SSLConnectionSocketFactory 
  final Lookup<ConnectionSocketFactory> registry = getSocketFactoryRegistry(context);
  final ConnectionSocketFactory sf = registry.lookup(host.getSchemeName());
  if (sf == null) {
   throw new UnsupportedSchemeException(host.getSchemeName() +
     " protocol is not supported");
  }
  //如果是ip形式的地址可以直接使用，否則使用dns解析器解析得到域名對應的ip
  final InetAddress[] addresses = host.getAddress() != null ?
    new InetAddress[] { host.getAddress() } : this.dnsResolver.resolve(host.getHostName());
  final int port = this.schemePortResolver.resolve(host);
  //一個域名可能對應多個Ip,按照順序嘗試連接
  for (int i = 0; i < addresses.length; i++) {
   final InetAddress address = addresses[i];
   final boolean last = i == addresses.length - 1;
   //這里只是生成一個socket，還并沒有連接
   Socket sock = sf.createSocket(context);
   //設置一些tcp層的參數
   sock.setSoTimeout(socketConfig.getSoTimeout());
   sock.setReuseAddress(socketConfig.isSoReuseAddress());
   sock.setTcpNoDelay(socketConfig.isTcpNoDelay());
   sock.setKeepAlive(socketConfig.isSoKeepAlive());
   if (socketConfig.getRcvBufSize() > 0) {
    sock.setReceiveBufferSize(socketConfig.getRcvBufSize());
   }
   if (socketConfig.getSndBufSize() > 0) {
    sock.setSendBufferSize(socketConfig.getSndBufSize());
   }

   final int linger = socketConfig.getSoLinger();
   if (linger >= 0) {
    sock.setSoLinger(true, linger);
   }
   conn.bind(sock);

   final InetSocketAddress remoteAddress = new InetSocketAddress(address, port);
   if (this.log.isDebugEnabled()) {
    this.log.debug("Connecting to " + remoteAddress);
   }
   try {
    //通過SSLConnectionSocketFactory建立連接并綁定到conn上
    sock = sf.connectSocket(
      connectTimeout, sock, host, remoteAddress, localAddress, context);
    conn.bind(sock);
    if (this.log.isDebugEnabled()) {
     this.log.debug("Connection established " + conn);
    }
    return;
   } 
   //省略一些代碼
  }
 }

@Override
 public Socket connectSocket(
   final int connectTimeout,
   final Socket socket,
   final HttpHost host,
   final InetSocketAddress remoteAddress,
   final InetSocketAddress localAddress,
   final HttpContext context) throws IOException {
  Args.notNull(host, "HTTP host");
  Args.notNull(remoteAddress, "Remote address");
  final Socket sock = socket != null ? socket : createSocket(context);
  if (localAddress != null) {
   sock.bind(localAddress);
  }
  try {
   if (connectTimeout > 0 && sock.getSoTimeout() == 0) {
    sock.setSoTimeout(connectTimeout);
   }
   if (this.log.isDebugEnabled()) {
    this.log.debug("Connecting socket to " + remoteAddress + " with timeout " + connectTimeout);
   }
   //建立連接
   sock.connect(remoteAddress, connectTimeout);
  } catch (final IOException ex) {
   try {
    sock.close();
   } catch (final IOException ignore) {
   }
   throw ex;
  }
  // 如果當前是SslSocket則進行SSL握手與域名校驗
  if (sock instanceof SSLSocket) {
   final SSLSocket sslsock = (SSLSocket) sock;
   this.log.debug("Starting handshake");
   sslsock.startHandshake();
   verifyHostname(sslsock, host.getHostName());
   return sock;
  } else {
   //如果不是SslSocket則將其包裝為SslSocket
   return createLayeredSocket(sock, host.getHostName(), remoteAddress.getPort(), context);
  }
 }

 @Override
 public Socket createLayeredSocket(
   final Socket socket,
   final String target,
   final int port,
   final HttpContext context) throws IOException {
   //將普通socket包裝為SslSocket,socketfactory是根據HttpClientBuilder中的SSLContext生成的，其中包含密鑰信息
  final SSLSocket sslsock = (SSLSocket) this.socketfactory.createSocket(
    socket,
    target,
    port,
    true);
  //如果制定了SSL層協議版本與加密算法，則使用指定的，否則使用默認的
  if (supportedProtocols != null) {
   sslsock.setEnabledProtocols(supportedProtocols);
  } else {
   // If supported protocols are not explicitly set, remove all SSL protocol versions
   final String[] allProtocols = sslsock.getEnabledProtocols();
   final List<String> enabledProtocols = new ArrayList<String>(allProtocols.length);
   for (final String protocol: allProtocols) {
    if (!protocol.startsWith("SSL")) {
     enabledProtocols.add(protocol);
    }
   }
   if (!enabledProtocols.isEmpty()) {
    sslsock.setEnabledProtocols(enabledProtocols.toArray(new String[enabledProtocols.size()]));
   }
  }
  if (supportedCipherSuites != null) {
   sslsock.setEnabledCipherSuites(supportedCipherSuites);
  }

  if (this.log.isDebugEnabled()) {
   this.log.debug("Enabled protocols: " + Arrays.asList(sslsock.getEnabledProtocols()));
   this.log.debug("Enabled cipher suites:" + Arrays.asList(sslsock.getEnabledCipherSuites()));
  }

  prepareSocket(sslsock);
  this.log.debug("Starting handshake");
  //Ssl連接握手
  sslsock.startHandshake();
  //握手成功后校驗返回的證書與域名是否一致
  verifyHostname(sslsock, target);
  return sslsock;
 }