diff --git a/CHANGES.txt b/CHANGES.txt
index cdb2d1dc01..cc82deafaf 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -86,6 +86,7 @@
  * Restore resumable hints delivery (CASSANDRA-11960)
  * Properly report LWT contention (CASSANDRA-12626)
 Merged from 3.0:
+ * Fix potential socket leak (CASSANDRA-12329)
  * Fix ViewTest.testCompaction (CASSANDRA-12789)
  * Improve avg aggregate functions (CASSANDRA-12417)
  * Preserve quoted reserved keyword column names in MV creation (CASSANDRA-11803)
diff --git a/src/java/org/apache/cassandra/security/SSLFactory.java b/src/java/org/apache/cassandra/security/SSLFactory.java
index 2e59b06f64..7216e2c7b3 100644
--- a/src/java/org/apache/cassandra/security/SSLFactory.java
+++ b/src/java/org/apache/cassandra/security/SSLFactory.java
@@ -60,11 +60,18 @@ public final class SSLFactory
     {
         SSLContext ctx = createSSLContext(options, true);
         SSLServerSocket serverSocket = (SSLServerSocket)ctx.getServerSocketFactory().createServerSocket();
-        serverSocket.setReuseAddress(true);
-        prepareSocket(serverSocket, options);
-        serverSocket.bind(new InetSocketAddress(address, port), 500);
-
-        return serverSocket;
+        try
+        {
+            serverSocket.setReuseAddress(true);
+            prepareSocket(serverSocket, options);
+            serverSocket.bind(new InetSocketAddress(address, port), 500);
+            return serverSocket;
+        }
+        catch (IllegalArgumentException | SecurityException | IOException e)
+        {
+            serverSocket.close();
+            throw e;
+        }
     }
 
     /** Create a socket and connect */
@@ -72,8 +79,16 @@ public final class SSLFactory
     {
         SSLContext ctx = createSSLContext(options, true);
         SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket(address, port, localAddress, localPort);
-        prepareSocket(socket, options);
-        return socket;
+        try
+        {
+            prepareSocket(socket, options);
+            return socket;
+        }
+        catch (IllegalArgumentException e)
+        {
+            socket.close();
+            throw e;
+        }
     }
 
     /** Create a socket and connect, using any local address */
@@ -81,8 +96,16 @@ public final class SSLFactory
     {
         SSLContext ctx = createSSLContext(options, true);
         SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket(address, port);
-        prepareSocket(socket, options);
-        return socket;
+        try
+        {
+            prepareSocket(socket, options);
+            return socket;
+        }
+        catch (IllegalArgumentException e)
+        {
+            socket.close();
+            throw e;
+        }
     }
 
     /** Just create a socket */
@@ -90,8 +113,16 @@ public final class SSLFactory
     {
         SSLContext ctx = createSSLContext(options, true);
         SSLSocket socket = (SSLSocket) ctx.getSocketFactory().createSocket();
-        prepareSocket(socket, options);
-        return socket;
+        try
+        {
+            prepareSocket(socket, options);
+            return socket;
+        }
+        catch (IllegalArgumentException e)
+        {
+            socket.close();
+            throw e;
+        }
     }
 
     /** Sets relevant socket options specified in encryption settings */