@Nullable
    private SslContext sslContext(VirtualHostBuilder template, TlsEngineType tlsEngineType) {
        if (portBased) {
            return null;
        }
        SslContext sslContext = null;
        boolean releaseSslContextOnFailure = false;
        try {
            assert template.tlsAllowUnsafeCiphers != null;
            final boolean tlsAllowUnsafeCiphers =
                    this.tlsAllowUnsafeCiphers != null ?
                    this.tlsAllowUnsafeCiphers : template.tlsAllowUnsafeCiphers;

            // Whether the `SslContext` came (or was created) from this `VirtualHost`'s properties.
            boolean sslContextFromThis = false;

            // Build a new SslContext or use a user-specified one for backward compatibility.
            if (sslContextBuilderSupplier != null) {
                sslContext = buildSslContext(sslContextBuilderSupplier, tlsEngineType, tlsAllowUnsafeCiphers,
                                             tlsCustomizer);
                sslContextFromThis = true;
                releaseSslContextOnFailure = true;
            } else if (template.sslContextBuilderSupplier != null) {
                sslContext = buildSslContext(template.sslContextBuilderSupplier, tlsEngineType,
                                             tlsAllowUnsafeCiphers, template.tlsCustomizer);
                releaseSslContextOnFailure = true;
            }

            // Generate a self-signed certificate if necessary.
            if (sslContext == null) {
                final boolean tlsSelfSigned;
                final Consumer<SslContextBuilder> tlsCustomizer;
                if (this.tlsSelfSigned != null) {
                    tlsSelfSigned = this.tlsSelfSigned;
                    tlsCustomizer = this.tlsCustomizer;
                    sslContextFromThis = true;
                } else {
                    assert template.tlsSelfSigned != null;
                    tlsSelfSigned = template.tlsSelfSigned;
                    tlsCustomizer = template.tlsCustomizer;
                }

                if (tlsSelfSigned) {
                    final SelfSignedCertificate ssc;
                    try {
                        ssc = selfSignedCertificate();
                    } catch (Exception e) {
                        throw new RuntimeException("failed to create a self signed certificate", e);
                    }

                    sslContext = buildSslContext(() -> SslContextBuilder.forServer(ssc.certificate(),
                                                                                   ssc.privateKey()),
                                                 tlsEngineType,
                                                 tlsAllowUnsafeCiphers,
                                                 tlsCustomizer);
                    releaseSslContextOnFailure = true;
                }
            }

            // Reject if a user called `tlsCustomizer()` without `tls()` or `tlsSelfSigned()`.
            checkState(sslContextFromThis || tlsCustomizer == null,
                       "Cannot call tlsCustomizer() without tls() or tlsSelfSigned()");

            // Validate the built `SslContext`.
            if (sslContext != null) {
                validateSslContext(sslContext, tlsEngineType);
                checkState(sslContext.isServer(), "sslContextBuilder built a client SSL context.");
            }
            releaseSslContextOnFailure = false;
        } finally {
            if (releaseSslContextOnFailure) {
                ReferenceCountUtil.release(sslContext);
            }
        }
        return sslContext;
    }
Returns a newly-created {@link VirtualHost} based on the properties of this builder and the services
added to this builder.
core/src/main/java/com/linecorp/armeria/server/VirtualHostBuilder.java