diff --git a/core/src/main/java/tech/ydb/core/impl/pool/NettyChannelFactory.java b/core/src/main/java/tech/ydb/core/impl/pool/NettyChannelFactory.java
index 9ab2737ea..1c004b881 100644
--- a/core/src/main/java/tech/ydb/core/impl/pool/NettyChannelFactory.java
+++ b/core/src/main/java/tech/ydb/core/impl/pool/NettyChannelFactory.java
@@ -33,21 +33,19 @@ public class NettyChannelFactory implements ManagedChannelFactory {
 
     private final ClientInterceptor metadata;
 
-    private final boolean useTLS;
-    private final byte[] cert;
     private final boolean retryEnabled;
     private final boolean useDefaultGrpcResolver;
     private final Long grpcKeepAliveTimeMillis;
     private final List<Consumer<? super ManagedChannelBuilder<?>>> initializers;
+    private final SslContext sslCtx;
 
     private NettyChannelFactory(GrpcTransportBuilder builder) {
         this.metadata = YdbHeaders.createMetadataInterceptor(builder);
-        this.useTLS = builder.getUseTls();
-        this.cert = builder.getCert();
         this.retryEnabled = builder.isEnableRetry();
         this.useDefaultGrpcResolver = builder.useDefaultGrpcResolver();
         this.grpcKeepAliveTimeMillis = builder.getGrpcKeepAliveTimeMillis();
         this.initializers = builder.getChannelInitializers();
+        this.sslCtx = createSslContext(builder.getUseTls(), builder.getCert());
     }
 
     @SuppressWarnings("deprecation")
@@ -56,10 +54,10 @@ public ManagedChannel newManagedChannel(String host, int port, String sslHostOve
         NettyChannelBuilder channelBuilder = NettyChannelBuilder
                 .forAddress(host, port);
 
-        if (useTLS) {
+        if (sslCtx != null) {
             channelBuilder
                     .negotiationType(NegotiationType.TLS)
-                    .sslContext(createSslContext());
+                    .sslContext(sslCtx);
             if (sslHostOverride != null) {
                 channelBuilder.overrideAuthority(sslHostOverride);
             }
@@ -104,11 +102,15 @@ protected void configure(NettyChannelBuilder channelBuilder) {
 
     }
 
-    private SslContext createSslContext() {
+    private static SslContext createSslContext(boolean useTLS, byte[] customCert) {
+        if (!useTLS) {
+            return null;
+        }
+
         try {
             SslContextBuilder sslContextBuilder = GrpcSslContexts.forClient();
-            if (cert != null) {
-                sslContextBuilder.trustManager(new ByteArrayInputStream(cert));
+            if (customCert != null) {
+                sslContextBuilder.trustManager(new ByteArrayInputStream(customCert));
             } else {
                 sslContextBuilder.trustManager(new YandexTrustManagerFactory(""));
             }
diff --git a/core/src/main/java/tech/ydb/core/impl/pool/ShadedNettyChannelFactory.java b/core/src/main/java/tech/ydb/core/impl/pool/ShadedNettyChannelFactory.java
index 9da822fce..091d6ebb4 100644
--- a/core/src/main/java/tech/ydb/core/impl/pool/ShadedNettyChannelFactory.java
+++ b/core/src/main/java/tech/ydb/core/impl/pool/ShadedNettyChannelFactory.java
@@ -33,21 +33,19 @@ public class ShadedNettyChannelFactory implements ManagedChannelFactory {
 
     private final ClientInterceptor metadata;
 
-    private final boolean useTLS;
-    private final byte[] cert;
     private final boolean retryEnabled;
     private final boolean useDefaultGrpcResolver;
     private final Long grpcKeepAliveTimeMillis;
     private final List<Consumer<? super ManagedChannelBuilder<?>>> initializers;
+    private final SslContext sslCtx;
 
     private ShadedNettyChannelFactory(GrpcTransportBuilder builder) {
         this.metadata = YdbHeaders.createMetadataInterceptor(builder);
-        this.useTLS = builder.getUseTls();
-        this.cert = builder.getCert();
         this.retryEnabled = builder.isEnableRetry();
         this.useDefaultGrpcResolver = builder.useDefaultGrpcResolver();
         this.grpcKeepAliveTimeMillis = builder.getGrpcKeepAliveTimeMillis();
         this.initializers = builder.getChannelInitializers();
+        this.sslCtx = createSslContext(builder.getUseTls(), builder.getCert());
     }
 
     @SuppressWarnings("deprecation")
@@ -56,10 +54,10 @@ public ManagedChannel newManagedChannel(String host, int port, String sslHostOve
         NettyChannelBuilder channelBuilder = NettyChannelBuilder
                 .forAddress(host, port);
 
-        if (useTLS) {
+        if (sslCtx != null) {
             channelBuilder
                     .negotiationType(NegotiationType.TLS)
-                    .sslContext(createSslContext());
+                    .sslContext(sslCtx);
             if (sslHostOverride != null) {
                 channelBuilder.overrideAuthority(sslHostOverride);
             }
@@ -104,11 +102,15 @@ protected void configure(NettyChannelBuilder channelBuilder) {
 
     }
 
-    private SslContext createSslContext() {
+    private static SslContext createSslContext(boolean useTLS, byte[] customCert) {
+        if (!useTLS) {
+            return null;
+        }
+
         try {
             SslContextBuilder sslContextBuilder = GrpcSslContexts.forClient();
-            if (cert != null) {
-                sslContextBuilder.trustManager(new ByteArrayInputStream(cert));
+            if (customCert != null) {
+                sslContextBuilder.trustManager(new ByteArrayInputStream(customCert));
             } else {
                 sslContextBuilder.trustManager(new YandexTrustManagerFactory(""));
             }
diff --git a/core/src/test/java/tech/ydb/core/impl/pool/DefaultChannelFactoryTest.java b/core/src/test/java/tech/ydb/core/impl/pool/DefaultChannelFactoryTest.java
index efb100316..322549ec7 100644
--- a/core/src/test/java/tech/ydb/core/impl/pool/DefaultChannelFactoryTest.java
+++ b/core/src/test/java/tech/ydb/core/impl/pool/DefaultChannelFactoryTest.java
@@ -244,10 +244,8 @@ public void invalidSslCert() {
         GrpcTransportBuilder builder = GrpcTransport.forHost(MOCKED_HOST, MOCKED_PORT, "/Root")
                 .withSecureConnection(cert);
 
-        ManagedChannelFactory factory = ChannelFactoryLoader.load().buildFactory(builder);
-
         RuntimeException ex = Assert.assertThrows(RuntimeException.class,
-                () -> factory.newManagedChannel(MOCKED_HOST, MOCKED_PORT, null));
+                () -> ChannelFactoryLoader.load().buildFactory(builder));
 
         Assert.assertEquals("cannot create ssl context", ex.getMessage());
         Assert.assertNotNull(ex.getCause());
diff --git a/core/src/test/java/tech/ydb/core/impl/pool/NettyChannelFactoryTest.java b/core/src/test/java/tech/ydb/core/impl/pool/NettyChannelFactoryTest.java
index 1edf8e2e5..885ad35dd 100644
--- a/core/src/test/java/tech/ydb/core/impl/pool/NettyChannelFactoryTest.java
+++ b/core/src/test/java/tech/ydb/core/impl/pool/NettyChannelFactoryTest.java
@@ -243,10 +243,8 @@ public void invalidSslCert() {
         GrpcTransportBuilder builder = GrpcTransport.forHost(MOCKED_HOST, MOCKED_PORT, "/Root")
                 .withSecureConnection(cert);
 
-        ManagedChannelFactory factory = ChannelFactoryLoader.load().buildFactory(builder);
-
         RuntimeException ex = Assert.assertThrows(RuntimeException.class,
-                () -> factory.newManagedChannel(MOCKED_HOST, MOCKED_PORT, null));
+                () -> ChannelFactoryLoader.load().buildFactory(builder));
 
         Assert.assertEquals("cannot create ssl context", ex.getMessage());
         Assert.assertNotNull(ex.getCause());