diff --git a/platform/src/tcp_stream.cpp b/platform/src/tcp_stream.cpp
index e683f89..ba824c1 100644
--- a/platform/src/tcp_stream.cpp
+++ b/platform/src/tcp_stream.cpp
@@ -530,15 +530,15 @@ static void __stream_bev_writecb(struct bufferevent * bev, void * arg)
 	if (__bev_dir(_stream, bev) == CONN_DIR_UPSTREAM)
 	{
 		ref_this_conn = &_stream->conn_upstream;
+		ref_this_ssl_stream = &_stream->ssl_upstream;
 		ref_peer_conn = &_stream->conn_downstream;
-		ref_this_ssl_stream = &_stream->ssl_downstream;
 	}
 
 	if (__bev_dir(_stream, bev) == CONN_DIR_DOWNSTREAM)
 	{
 		ref_this_conn = &_stream->conn_downstream;
-		ref_peer_conn = &_stream->conn_upstream;
 		ref_this_ssl_stream = &_stream->ssl_downstream;
+		ref_peer_conn = &_stream->conn_upstream;
 	}
 
 	struct evbuffer * __output_buffer = bufferevent_get_output(bev);
@@ -719,8 +719,14 @@ void ssl_downstream_create_on_success(future_result_t * result, void * user)
 
 void ssl_downstream_create_on_fail(enum e_future_error err, const char * what, void * user)
 {
-	fprintf(stderr, "---- downstream create fail !!!\n");
-	return;
+	struct tfe_stream_private * _stream = (struct tfe_stream_private *)user;
+	assert(_stream != NULL && _stream->session_type == STREAM_PROTO_SSL);
+
+	TFE_STREAM_LOG_ERROR(_stream, "Failed to create SSL downstream, close the connection : %s. ", what);
+
+	/* There is nothing we can do because upstream has been handshake,
+	 * Close the stream */
+	tfe_stream_destory(_stream);
 }
 
 void ssl_upstream_create_on_success(future_result_t * result, void * user)
@@ -736,6 +742,9 @@ void ssl_upstream_create_on_success(future_result_t * result, void * user)
 	_stream->conn_upstream = __conn_private_create_by_bev(_stream, bev);
 	_stream->ssl_upstream = upstream;
 
+	assert(_stream->conn_upstream != NULL);
+	assert(_stream->ssl_upstream != NULL);
+
 	future_destroy(_stream->future_upstream_create);
 	_stream->future_upstream_create = NULL;
 	_stream->defer_fd_upstream = 0;
@@ -750,8 +759,21 @@ void ssl_upstream_create_on_success(future_result_t * result, void * user)
 
 void ssl_upstream_create_on_fail(enum e_future_error err, const char * what, void * user)
 {
-	fprintf(stderr, "---- upstream create fail !!!\n");
-	return;
+	struct tfe_stream_private * _stream = (struct tfe_stream_private *)user;
+	assert(_stream != NULL && _stream->session_type == STREAM_PROTO_SSL);
+
+	TFE_STREAM_LOG_ERROR(_stream, "Failed to create SSL upstream, pass-through the connection : %s. ", what);
+
+	_stream->conn_downstream = __conn_private_create_by_fd(_stream, _stream->defer_fd_downstream);
+	_stream->conn_upstream = __conn_private_create_by_fd(_stream, _stream->defer_fd_downstream);
+
+	assert(_stream->conn_downstream != NULL);
+	assert(_stream->conn_upstream != NULL);
+
+	_stream->defer_fd_downstream = 0;
+	_stream->defer_fd_upstream = 0;
+	__conn_private_enable(_stream->conn_downstream);
+	__conn_private_enable(_stream->conn_upstream);
 }
 
 struct tfe_stream * tfe_stream_create(struct tfe_proxy * pxy, struct tfe_thread_ctx * thread_ctx)
@@ -985,8 +1007,7 @@ int tfe_stream_init_by_fds(struct tfe_stream * stream, evutil_socket_t fd_downst
 	if (unlikely(_stream->head.addr == NULL))
 	{
 		TFE_LOG_ERROR(_stream->stream_logger, "Failed to create address from fd %d, %d, terminate fds.",
-			fd_downstream, fd_upstream);
-		goto __errout;
+			fd_downstream, fd_upstream); goto __errout;
 	}
 
 	_stream->str_stream_addr = tfe_stream_addr_to_str(_stream->head.addr);