diff --git a/proxygen/lib/http/HTTPConnector.cpp b/proxygen/lib/http/HTTPConnector.cpp
index b08050b6bb..277864bd35 100644
--- a/proxygen/lib/http/HTTPConnector.cpp
+++ b/proxygen/lib/http/HTTPConnector.cpp
@@ -73,7 +73,7 @@ void HTTPConnector::connect(EventBase* eventBase,
 
 void HTTPConnector::connectSSL(EventBase* eventBase,
                                const folly::SocketAddress& connectAddr,
-                               const shared_ptr<SSLContext>& context,
+                               const shared_ptr<const SSLContext>& context,
                                std::shared_ptr<folly::ssl::SSLSession> session,
                                std::chrono::milliseconds timeoutMs,
                                const SocketOptionMap& socketOptions,
diff --git a/proxygen/lib/http/HTTPConnector.h b/proxygen/lib/http/HTTPConnector.h
index bc2c65855f..2c11420db7 100644
--- a/proxygen/lib/http/HTTPConnector.h
+++ b/proxygen/lib/http/HTTPConnector.h
@@ -126,7 +126,7 @@ class HTTPConnector : protected folly::AsyncSocket::ConnectCallback {
   void connectSSL(
       folly::EventBase* eventBase,
       const folly::SocketAddress& connectAddr,
-      const std::shared_ptr<folly::SSLContext>& ctx,
+      const std::shared_ptr<const folly::SSLContext>& ctx,
       std::shared_ptr<folly::ssl::SSLSession> session = nullptr,
       std::chrono::milliseconds timeoutMs = std::chrono::milliseconds(0),
       const folly::SocketOptionMap& socketOptions = folly::emptySocketOptionMap,
diff --git a/proxygen/lib/http/session/HQDownstreamSession.cpp b/proxygen/lib/http/session/HQDownstreamSession.cpp
index 0ba3706a3f..9f52aed8c7 100644
--- a/proxygen/lib/http/session/HQDownstreamSession.cpp
+++ b/proxygen/lib/http/session/HQDownstreamSession.cpp
@@ -61,13 +61,14 @@ bool HQDownstreamSession::isDetachable(bool) const {
   return false;
 }
 
-void HQDownstreamSession::attachThreadLocals(folly::EventBase*,
-                                             folly::SSLContextPtr,
-                                             const WheelTimerInstance&,
-                                             HTTPSessionStats*,
-                                             FilterIteratorFn,
-                                             HeaderCodec::Stats*,
-                                             HTTPSessionController*) {
+void HQDownstreamSession::attachThreadLocals(
+    folly::EventBase*,
+    std::shared_ptr<const folly::SSLContext>,
+    const WheelTimerInstance&,
+    HTTPSessionStats*,
+    FilterIteratorFn,
+    HeaderCodec::Stats*,
+    HTTPSessionController*) {
   LOG(FATAL) << __func__ << " is an upstream interface";
 }
 
diff --git a/proxygen/lib/http/session/HQDownstreamSession.h b/proxygen/lib/http/session/HQDownstreamSession.h
index 2af3446ada..b39b2cfc7b 100644
--- a/proxygen/lib/http/session/HQDownstreamSession.h
+++ b/proxygen/lib/http/session/HQDownstreamSession.h
@@ -44,7 +44,7 @@ class HQDownstreamSession : public HQSession {
   bool isDetachable(bool) const override;
 
   void attachThreadLocals(folly::EventBase*,
-                          folly::SSLContextPtr,
+                          std::shared_ptr<const folly::SSLContext>,
                           const WheelTimerInstance&,
                           HTTPSessionStats*,
                           FilterIteratorFn,
diff --git a/proxygen/lib/http/session/HQUpstreamSession.cpp b/proxygen/lib/http/session/HQUpstreamSession.cpp
index c3c4b24650..61275d9d25 100644
--- a/proxygen/lib/http/session/HQUpstreamSession.cpp
+++ b/proxygen/lib/http/session/HQUpstreamSession.cpp
@@ -117,13 +117,14 @@ bool HQUpstreamSession::isDetachable(bool checkSocket) const {
   return getNumOutgoingStreams() == 0 && getNumIncomingStreams() == 0;
 }
 
-void HQUpstreamSession::attachThreadLocals(folly::EventBase* eventBase,
-                                           folly::SSLContextPtr,
-                                           const WheelTimerInstance& timeout,
-                                           HTTPSessionStats* stats,
-                                           FilterIteratorFn fn,
-                                           HeaderCodec::Stats* headerCodecStats,
-                                           HTTPSessionController* controller) {
+void HQUpstreamSession::attachThreadLocals(
+    folly::EventBase* eventBase,
+    std::shared_ptr<const folly::SSLContext>,
+    const WheelTimerInstance& timeout,
+    HTTPSessionStats* stats,
+    FilterIteratorFn fn,
+    HeaderCodec::Stats* headerCodecStats,
+    HTTPSessionController* controller) {
   // TODO: deal with control streams in h2q
   VLOG(4) << __func__ << " sess=" << *this;
   txnEgressQueue_.attachThreadLocals(timeout);
diff --git a/proxygen/lib/http/session/HQUpstreamSession.h b/proxygen/lib/http/session/HQUpstreamSession.h
index 8805e189d1..233fb11016 100644
--- a/proxygen/lib/http/session/HQUpstreamSession.h
+++ b/proxygen/lib/http/session/HQUpstreamSession.h
@@ -73,7 +73,7 @@ class HQUpstreamSession : public HQSession {
   bool isDetachable(bool checkSocket) const override;
 
   void attachThreadLocals(folly::EventBase*,
-                          folly::SSLContextPtr,
+                          std::shared_ptr<const folly::SSLContext>,
                           const WheelTimerInstance&,
                           HTTPSessionStats*,
                           FilterIteratorFn,
diff --git a/proxygen/lib/http/session/HTTPDownstreamSession.h b/proxygen/lib/http/session/HTTPDownstreamSession.h
index 50a87d0dd4..f016aed46b 100644
--- a/proxygen/lib/http/session/HTTPDownstreamSession.h
+++ b/proxygen/lib/http/session/HTTPDownstreamSession.h
@@ -99,7 +99,7 @@ class HTTPDownstreamSession final : public HTTPSession {
   }
 
   void attachThreadLocals(folly::EventBase*,
-                          folly::SSLContextPtr,
+                          std::shared_ptr<const folly::SSLContext>,
                           const WheelTimerInstance&,
                           HTTPSessionStats*,
                           FilterIteratorFn,
diff --git a/proxygen/lib/http/session/HTTPSessionBase.h b/proxygen/lib/http/session/HTTPSessionBase.h
index 0bd944a086..3ba3f3e48f 100644
--- a/proxygen/lib/http/session/HTTPSessionBase.h
+++ b/proxygen/lib/http/session/HTTPSessionBase.h
@@ -473,13 +473,14 @@ class HTTPSessionBase : public wangle::ManagedConnection {
 
   virtual bool isDetachable(bool checkSocket) const = 0;
 
-  virtual void attachThreadLocals(folly::EventBase* eventBase,
-                                  folly::SSLContextPtr sslContext,
-                                  const WheelTimerInstance& wheelTimer,
-                                  HTTPSessionStats* stats,
-                                  FilterIteratorFn fn,
-                                  HeaderCodec::Stats* headerCodecStats,
-                                  HTTPSessionController* controller) = 0;
+  virtual void attachThreadLocals(
+      folly::EventBase* eventBase,
+      std::shared_ptr<const folly::SSLContext> sslContext,
+      const WheelTimerInstance& wheelTimer,
+      HTTPSessionStats* stats,
+      FilterIteratorFn fn,
+      HeaderCodec::Stats* headerCodecStats,
+      HTTPSessionController* controller) = 0;
 
   virtual void detachThreadLocals(bool detachSSLContext = false) = 0;
 
diff --git a/proxygen/lib/http/session/HTTPUpstreamSession.cpp b/proxygen/lib/http/session/HTTPUpstreamSession.cpp
index 273f2dd36a..a509fd6275 100644
--- a/proxygen/lib/http/session/HTTPUpstreamSession.cpp
+++ b/proxygen/lib/http/session/HTTPUpstreamSession.cpp
@@ -172,7 +172,7 @@ bool HTTPUpstreamSession::onNativeProtocolUpgrade(
 
 void HTTPUpstreamSession::attachThreadLocals(
     folly::EventBase* eventBase,
-    folly::SSLContextPtr sslContext,
+    std::shared_ptr<const folly::SSLContext> sslContext,
     const WheelTimerInstance& wheelTimer,
     HTTPSessionStats* stats,
     FilterIteratorFn fn,
@@ -198,7 +198,7 @@ void HTTPUpstreamSession::attachThreadLocals(
 }
 
 void HTTPUpstreamSession::maybeAttachSSLContext(
-    folly::SSLContextPtr sslContext) const {
+    std::shared_ptr<const folly::SSLContext> sslContext) const {
 #ifndef NO_ASYNCSSLSOCKET
   auto sslSocket = sock_->getUnderlyingTransport<folly::AsyncSSLSocket>();
   if (sslSocket && sslContext) {
diff --git a/proxygen/lib/http/session/HTTPUpstreamSession.h b/proxygen/lib/http/session/HTTPUpstreamSession.h
index 3f485894b0..abba1baca4 100644
--- a/proxygen/lib/http/session/HTTPUpstreamSession.h
+++ b/proxygen/lib/http/session/HTTPUpstreamSession.h
@@ -87,7 +87,7 @@ class HTTPUpstreamSession : public HTTPSession {
   using FilterIteratorFn = std::function<void(HTTPCodecFilter*)>;
 
   void attachThreadLocals(folly::EventBase* eventBase,
-                          folly::SSLContextPtr sslContext,
+                          std::shared_ptr<const folly::SSLContext> sslContext,
                           const WheelTimerInstance& wheelTimer,
                           HTTPSessionStats* stats,
                           FilterIteratorFn fn,
@@ -167,7 +167,8 @@ class HTTPUpstreamSession : public HTTPSession {
                                const std::string& protocolString,
                                HTTPMessage& msg) override;
 
-  void maybeAttachSSLContext(folly::SSLContextPtr sslContext) const;
+  void maybeAttachSSLContext(
+      std::shared_ptr<const folly::SSLContext> sslContext) const;
   void maybeDetachSSLContext() const;
 
   uint8_t maxVirtualPriorityLevel_{0};
diff --git a/proxygen/lib/http/session/test/HQSessionMocks.h b/proxygen/lib/http/session/test/HQSessionMocks.h
index b6731fd8ff..eb400a232f 100644
--- a/proxygen/lib/http/session/test/HQSessionMocks.h
+++ b/proxygen/lib/http/session/test/HQSessionMocks.h
@@ -250,7 +250,7 @@ class MockHQSession : public HQSession {
   }
 
   void attachThreadLocals(folly::EventBase*,
-                          folly::SSLContextPtr,
+                          std::shared_ptr<const folly::SSLContext>,
                           const WheelTimerInstance&,
                           HTTPSessionStats*,
                           FilterIteratorFn,