@Override
    @SneakyThrows
    public TlsPSKExternal getExternalPSK(Vector clientPskIdentities) {
        byte[] clientPskIdentity = ((PskIdentity) clientPskIdentities.get(0)).getIdentity();
        byte[] psk;
        try {
            this.ctx
                    .channel()
                    .attr(TlsPskHandler.CLIENT_PSK_IDENTITY_ATTRIBUTE_KEY)
                    .set(new ClientPSKIdentityInfo(List.copyOf(Bytes.asList(clientPskIdentity))));
            psk = externalTlsPskProvider.provide(
                    clientPskIdentity,
                    this.context.getSecurityParametersHandshake().getClientRandom());
        } catch (PskCreationFailureException e) {
            throw switch (e.getTlsAlertMessage()) {
                case unknown_psk_identity -> new TlsFatalAlert(
                        AlertDescription.unknown_psk_identity, "Unknown or null client PSk identity");
                case decrypt_error -> new TlsFatalAlert(
                        AlertDescription.decrypt_error, "Invalid or expired client PSk identity");
            };
        }
        TlsSecret pskTlsSecret = getCrypto().createSecret(psk);
        int prfAlgorithm = getPRFAlgorithm13(getSelectedCipherSuite());
        return new BasicTlsPSKExternal(clientPskIdentity, pskTlsSecret, prfAlgorithm);
    }
TODO: Ask BC folks to see if getExternalPSK can throw a checked exception
https://github.com/bcgit/bc-java/issues/1673
We are using SneakyThrows here because getExternalPSK is an override and we cant have throws in the method signature
and we dont want to catch and wrap in RuntimeException.
SneakyThrows allows up to compile and it will throw the exception at runtime.
zuul-core/src/main/java/com/netflix/zuul/netty/server/psk/ZuulPskServer.java