diff --git a/engine/orchestration/src/com/cloud/agent/manager/ClusteredAgentManagerImpl.java b/engine/orchestration/src/com/cloud/agent/manager/ClusteredAgentManagerImpl.java
index 2417f4de8f2..d218cf4580b 100644
--- a/engine/orchestration/src/com/cloud/agent/manager/ClusteredAgentManagerImpl.java
+++ b/engine/orchestration/src/com/cloud/agent/manager/ClusteredAgentManagerImpl.java
@@ -498,8 +498,9 @@ public class ClusteredAgentManagerImpl extends AgentManagerImpl implements Clust
                 } catch (UnknownHostException e) {
                     throw new CloudRuntimeException("Unable to resolve " + ip);
                 }
+                SocketChannel ch1;
                 try {
-                    SocketChannel ch1 = SocketChannel.open(new InetSocketAddress(addr, Port.value()));
+                    ch1 = SocketChannel.open(new InetSocketAddress(addr, Port.value()));
                     ch1.configureBlocking(true); // make sure we are working at blocking mode
                     ch1.socket().setKeepAlive(true);
                     ch1.socket().setSoTimeout(60 * 1000);
@@ -512,6 +513,7 @@ public class ClusteredAgentManagerImpl extends AgentManagerImpl implements Clust
                         Link.doHandshake(ch1, sslEngine, true);
                         s_logger.info("SSL: Handshake done");
                     } catch (Exception e) {
+                        ch1.close();
                         throw new IOException("SSL: Fail to init SSL! " + e);
                     }
                     if (s_logger.isDebugEnabled()) {
@@ -521,6 +523,11 @@ public class ClusteredAgentManagerImpl extends AgentManagerImpl implements Clust
                     _sslEngines.put(peerName, sslEngine);
                     return ch1;
                 } catch (IOException e) {
+                    try {
+                        ch1.close();
+                    } catch (IOException ex) {
+                        s_logger.error("failed to close failed peer socket: " + ex);
+                    }
                     s_logger.warn("Unable to connect to peer management server: " + peerName + ", ip: " + ip + " due to " + e.getMessage(), e);
                     return null;
                 }