Use socket.getInetAddress(), socket.getPort()

Here is a snippet of code that I use in an intercepting proxy. It
receives a CONNECT request, responds to acknowledge that the request
will be successful, then upgrades the connection to SSL itself, rather
than forwarding it to the upstream server. This is essentially what you
have described.

    private Socket negotiateSSL(Socket sock) throws Exception {
        KeyStore ks = null;
        KeyManagerFactory kmf = null;
        SSLContext sslcontext = null;
    // This loads the key material, and initialises the
    // SSLSocketFactory
        try {
            ks = KeyStore.getInstance("PKCS12");
            ks.load(
        this.getClass().getResourceAsStream(keystore),
        keystorepass);
            kmf = KeyManagerFactory.getInstance("SunX509");
            kmf.init(ks, keypassword);
            sslcontext = SSLContext.getInstance("SSLv3");
            sslcontext.init(kmf.getKeyManagers(), null, null);
        } catch (Exception e) {
            _logger.severe("Exception accessing keystore: " + e);
            throw e;
        }
        SSLSocketFactory factory = sslcontext.getSocketFactory();
        SSLSocket sslsock;

        try {
            sslsock=(SSLSocket)factory.createSocket(
        sock,
        sock.getInetAddress().getHostName(),
        sock.getPort(),
        true);
            sslsock.setUseClientMode(false);

            _logger.fine("Finished negotiating SSL - algorithm is " +
        sslsock.getSession().getCipherSuite());

            return sslsock;
        } catch (Exception e) {
            _logger.severe("Error layering SSL over the socket");
            throw e;
        }
    }

Hope this helps.

Rogan