@Override
  public HttpURLConnection connect(
      final URI uri,
      final String method,
      final byte[] entity,
      final Map<String, List<String>> headers)
      throws HeliosException {
    final Endpoint endpoint = endpointIterator.next();

    // convert the URI whose hostname portion is a domain name into a URI where the host is an IP
    // as we expect there to be several different IP addresses besides a common domain name
    final URI ipUri;
    try {
      ipUri = toIpUri(endpoint, uri);
    } catch (URISyntaxException e) {
      throw new HeliosException(e);
    }

    try {
      log.debug("connecting to {}", ipUri);

      if (clientCertificatePath.isPresent()) {
        // prioritize using the certificate file if set
        return connectWithCertificateFile(ipUri, method, entity, headers);
      } else if (agentProxy.isPresent() && !identities.isEmpty()) {
        // ssh-agent based authentication
        return connectWithIdentities(identities, ipUri, method, entity, headers);
      } else {
        // no authentication
        return doConnect(ipUri, method, entity, headers);
      }

    } catch (ConnectException | SocketTimeoutException | UnknownHostException e) {
      // UnknownHostException happens if we can't resolve hostname into IP address.
      // UnknownHostException's getMessage method returns just the hostname which is a
      // useless message, so log the exception class name to provide more info.
      log.debug(e.toString());
      throw new HeliosException("Unable to connect to master", e);
    } catch (IOException e) {
      throw new HeliosException(e);
    }
  }