diff --git a/index.js b/index.js
index 29913b1..34bb2b2 100644
--- a/index.js
+++ b/index.js
@@ -99,8 +99,13 @@ class HttpsProxyAgent extends https.Agent {
       request.removeAllListeners()
       socket.removeAllListeners()
       if (response.statusCode === 200) {
-        const secureSocket = super.createConnection({ ...options, socket })
-        callback(null, secureSocket)
+        try {
+          const secureSocket = super.createConnection({ ...options, socket })
+          callback(null, secureSocket)
+        } catch (err) {
+          socket.destroy()
+          callback(err, null)
+        }
       } else {
         socket.destroy()
         callback(new Error(`Bad response: ${response.statusCode}`), null)
diff --git a/test/https-https.test.js b/test/https-https.test.js
index 2e4356c..337f9d5 100644
--- a/test/https-https.test.js
+++ b/test/https-https.test.js
@@ -469,3 +469,36 @@ test('Proxy request options should not override internal default options for CON
   server.close()
   proxy.close()
 })
+
+test('Secure socket creation error should be properly managed', async t => {
+  const server = await createSecureServer()
+  const proxy = await createSecureProxy()
+  server.on('request', (req, res) => res.end('ok'))
+  try {
+    await request({
+      method: 'GET',
+      hostname: SERVER_HOSTNAME,
+      port: server.address().port,
+      path: '/',
+      agent: new HttpsProxyAgent({
+        keepAlive: true,
+        keepAliveMsecs: 1000,
+        maxSockets: 256,
+        maxFreeSockets: 256,
+        scheduling: 'lifo',
+        /**
+         * Enable SSL 2 ways and generate a 'createConnection' error with wrong key/cert pair
+         */
+        key: 'wrongkey',
+        cert: 'wrongca',
+        proxy: `https://${PROXY_HOSTNAME}:${proxy.address().port}`
+      })
+    })
+    t.fail('Should throw')
+  } catch (err) {
+    t.is(err.message, 'error:0909006C:PEM routines:get_name:no start line')
+  }
+
+  server.close()
+  proxy.close()
+})