createClientSslTransportSocketFactory(Ssl::ContextManager& context_manager, Api::Api& api) {

  std::string yaml_plain = R"EOF(

  common_tls_context:

    validation_context:

      trusted_ca:

        filename: "{{ test_rundir }}/test/config/integration/certs/cacert.pem"

)EOF";

  envoy::extensions::transport_sockets::tls::v3::UpstreamTlsContext tls_context;

  TestUtility::loadFromYaml(TestEnvironment::substitute(yaml_plain), tls_context);

  NiceMock<Server::Configuration::MockTransportSocketFactoryContext> mock_factory_ctx;

  ON_CALL(mock_factory_ctx.server_context_, api()).WillByDefault(testing::ReturnRef(api));

  auto cfg_or_error = Extensions::TransportSockets::Tls::ClientContextConfigImpl::create(

      tls_context, mock_factory_ctx);

  THROW_IF_NOT_OK(cfg_or_error.status());

  auto cfg = std::move(cfg_or_error.value());

  static auto* client_stats_store = new Stats::TestIsolatedStoreImpl();

  auto factory_or_error = Extensions::TransportSockets::Tls::ClientSslSocketFactory::create(

      std::move(cfg), context_manager, *client_stats_store->rootScope());

  THROW_IF_NOT_OK(factory_or_error.status());

  return std::move(factory_or_error.value());

}