diff --git a/quic/core/http/quic_server_session_base.cc b/quic/core/http/quic_server_session_base.cc
index ac7d0a2..68d4c12 100644
--- a/quic/core/http/quic_server_session_base.cc
+++ b/quic/core/http/quic_server_session_base.cc
@@ -36,8 +36,8 @@
 QuicServerSessionBase::~QuicServerSessionBase() {}
 
 void QuicServerSessionBase::Initialize() {
-  crypto_stream_.reset(
-      CreateQuicCryptoServerStream(crypto_config_, compressed_certs_cache_));
+  crypto_stream_ =
+      CreateQuicCryptoServerStream(crypto_config_, compressed_certs_cache_);
   QuicSpdySession::Initialize();
 }
 
diff --git a/quic/core/http/quic_server_session_base.h b/quic/core/http/quic_server_session_base.h
index 672bb0c..f2c7ab3 100644
--- a/quic/core/http/quic_server_session_base.h
+++ b/quic/core/http/quic_server_session_base.h
@@ -86,7 +86,8 @@
   // possibly closing the connection, and returns false.
   bool ShouldCreateIncomingStream(QuicStreamId id) override;
 
-  virtual QuicCryptoServerStreamBase* CreateQuicCryptoServerStream(
+  virtual std::unique_ptr<QuicCryptoServerStreamBase>
+  CreateQuicCryptoServerStream(
       const QuicCryptoServerConfig* crypto_config,
       QuicCompressedCertsCache* compressed_certs_cache) = 0;
 
diff --git a/quic/core/http/quic_server_session_base_test.cc b/quic/core/http/quic_server_session_base_test.cc
index c13709e..0018bbe 100644
--- a/quic/core/http/quic_server_session_base_test.cc
+++ b/quic/core/http/quic_server_session_base_test.cc
@@ -103,11 +103,11 @@
     return stream;
   }
 
-  QuicCryptoServerStreamBase* CreateQuicCryptoServerStream(
+  std::unique_ptr<QuicCryptoServerStreamBase> CreateQuicCryptoServerStream(
       const QuicCryptoServerConfig* crypto_config,
       QuicCompressedCertsCache* compressed_certs_cache) override {
-    return new QuicCryptoServerStream(crypto_config, compressed_certs_cache,
-                                      this, stream_helper());
+    return CreateCryptoServerStream(crypto_config, compressed_certs_cache, this,
+                                    stream_helper());
   }
 
  private:
diff --git a/quic/core/quic_crypto_server_stream.cc b/quic/core/quic_crypto_server_stream.cc
index 09aa0c5..9b2a021 100644
--- a/quic/core/quic_crypto_server_stream.cc
+++ b/quic/core/quic_crypto_server_stream.cc
@@ -27,6 +27,15 @@
 QuicCryptoServerStreamBase::QuicCryptoServerStreamBase(QuicSession* session)
     : QuicCryptoStream(session) {}
 
+std::unique_ptr<QuicCryptoServerStream> CreateCryptoServerStream(
+    const QuicCryptoServerConfig* crypto_config,
+    QuicCompressedCertsCache* compressed_certs_cache,
+    QuicSession* session,
+    QuicCryptoServerStream::Helper* helper) {
+  return std::unique_ptr<QuicCryptoServerStream>(new QuicCryptoServerStream(
+      crypto_config, compressed_certs_cache, session, helper));
+}
+
 QuicCryptoServerStream::QuicCryptoServerStream(
     const QuicCryptoServerConfig* crypto_config,
     QuicCompressedCertsCache* compressed_certs_cache,
diff --git a/quic/core/quic_crypto_server_stream.h b/quic/core/quic_crypto_server_stream.h
index 1b74474..890ee56 100644
--- a/quic/core/quic_crypto_server_stream.h
+++ b/quic/core/quic_crypto_server_stream.h
@@ -140,13 +140,6 @@
                                       std::string* error_details) const = 0;
   };
 
-  // |crypto_config| must outlive the stream.
-  // |session| must outlive the stream.
-  // |helper| must outlive the stream.
-  QuicCryptoServerStream(const QuicCryptoServerConfig* crypto_config,
-                         QuicCompressedCertsCache* compressed_certs_cache,
-                         QuicSession* session,
-                         Helper* helper);
   QuicCryptoServerStream(const QuicCryptoServerStream&) = delete;
   QuicCryptoServerStream& operator=(const QuicCryptoServerStream&) = delete;
 
@@ -183,6 +176,16 @@
       const ParsedQuicVersion& version) override;
 
  protected:
+  friend std::unique_ptr<QuicCryptoServerStream> CreateCryptoServerStream(
+      const QuicCryptoServerConfig* crypto_config,
+      QuicCompressedCertsCache* compressed_certs_cache,
+      QuicSession* session,
+      Helper* helper);
+
+  QuicCryptoServerStream(const QuicCryptoServerConfig* crypto_config,
+                         QuicCompressedCertsCache* compressed_certs_cache,
+                         QuicSession* session,
+                         Helper* helper);
   // Provided so that subclasses can provide their own handshaker.
   // set_handshaker can only be called if this QuicCryptoServerStream's
   // handshaker hasn't been set yet. If set_handshaker is called outside of
@@ -212,6 +215,16 @@
   Helper* helper_;
 };
 
+// Creates an appropriate QuicCryptoServerStream for the provided parameters,
+// including the version used by |session|. |crypto_config|, |session|, and
+// |helper| must all outlive the stream. The caller takes ownership of the
+// returned object.
+std::unique_ptr<QuicCryptoServerStream> CreateCryptoServerStream(
+    const QuicCryptoServerConfig* crypto_config,
+    QuicCompressedCertsCache* compressed_certs_cache,
+    QuicSession* session,
+    QuicCryptoServerStream::Helper* helper);
+
 }  // namespace quic
 
 #endif  // QUICHE_QUIC_CORE_QUIC_CRYPTO_SERVER_STREAM_H_
diff --git a/quic/core/quic_dispatcher_test.cc b/quic/core/quic_dispatcher_test.cc
index 6d83adf..dc0b4a7 100644
--- a/quic/core/quic_dispatcher_test.cc
+++ b/quic/core/quic_dispatcher_test.cc
@@ -82,11 +82,11 @@
   MOCK_METHOD0(CreateOutgoingBidirectionalStream, QuicSpdyStream*());
   MOCK_METHOD0(CreateOutgoingUnidirectionalStream, QuicSpdyStream*());
 
-  QuicCryptoServerStreamBase* CreateQuicCryptoServerStream(
+  std::unique_ptr<QuicCryptoServerStreamBase> CreateQuicCryptoServerStream(
       const QuicCryptoServerConfig* crypto_config,
       QuicCompressedCertsCache* compressed_certs_cache) override {
-    return new QuicCryptoServerStream(crypto_config, compressed_certs_cache,
-                                      this, stream_helper());
+    return CreateCryptoServerStream(crypto_config, compressed_certs_cache, this,
+                                    stream_helper());
   }
 
   void SetCryptoStream(QuicCryptoServerStream* crypto_stream) {
diff --git a/quic/qbone/qbone_server_session.cc b/quic/qbone/qbone_server_session.cc
index 6c5697b..53511ad 100644
--- a/quic/qbone/qbone_server_session.cc
+++ b/quic/qbone/qbone_server_session.cc
@@ -50,9 +50,9 @@
 QboneServerSession::~QboneServerSession() {}
 
 std::unique_ptr<QuicCryptoStream> QboneServerSession::CreateCryptoStream() {
-  return std::make_unique<QuicCryptoServerStream>(quic_crypto_server_config_,
-                                                  compressed_certs_cache_, this,
-                                                  &stream_helper_);
+  return CreateCryptoServerStream(quic_crypto_server_config_,
+                                  compressed_certs_cache_, this,
+                                  &stream_helper_);
 }
 
 void QboneServerSession::Initialize() {
diff --git a/quic/quartc/quartc_session.cc b/quic/quartc/quartc_session.cc
index 4186f64..abdb4e6 100644
--- a/quic/quartc/quartc_session.cc
+++ b/quic/quartc/quartc_session.cc
@@ -471,7 +471,7 @@
 }
 
 void QuartcServerSession::StartCryptoHandshake() {
-  crypto_stream_ = std::make_unique<QuicCryptoServerStream>(
+  crypto_stream_ = CreateCryptoServerStream(
       server_crypto_config_, compressed_certs_cache_, this, stream_helper_);
   Initialize();
 }
diff --git a/quic/quic_transport/quic_transport_server_session.cc b/quic/quic_transport/quic_transport_server_session.cc
index 21ffa2b..45465cf 100644
--- a/quic/quic_transport/quic_transport_server_session.cc
+++ b/quic/quic_transport/quic_transport_server_session.cc
@@ -55,7 +55,7 @@
 
   static QuicTransportServerCryptoHelper* helper =
       new QuicTransportServerCryptoHelper();
-  crypto_stream_ = std::make_unique<QuicCryptoServerStream>(
+  crypto_stream_ = CreateCryptoServerStream(
       crypto_config, compressed_certs_cache, this, helper);
 }
 
diff --git a/quic/test_tools/quic_test_server.cc b/quic/test_tools/quic_test_server.cc
index 15bcae0..147d85e 100644
--- a/quic/test_tools/quic_test_server.cc
+++ b/quic/test_tools/quic_test_server.cc
@@ -55,7 +55,7 @@
     return QuicSimpleServerSession::CreateIncomingStream(id);
   }
 
-  QuicCryptoServerStreamBase* CreateQuicCryptoServerStream(
+  std::unique_ptr<QuicCryptoServerStreamBase> CreateQuicCryptoServerStream(
       const QuicCryptoServerConfig* crypto_config,
       QuicCompressedCertsCache* compressed_certs_cache) override {
     if (crypto_stream_factory_) {
diff --git a/quic/test_tools/quic_test_server.h b/quic/test_tools/quic_test_server.h
index bbde27b..34f2ba8 100644
--- a/quic/test_tools/quic_test_server.h
+++ b/quic/test_tools/quic_test_server.h
@@ -54,7 +54,7 @@
     virtual ~CryptoStreamFactory() {}
 
     // Returns a new QuicCryptoServerStreamBase owned by the caller
-    virtual QuicCryptoServerStreamBase* CreateCryptoStream(
+    virtual std::unique_ptr<QuicCryptoServerStreamBase> CreateCryptoStream(
         const QuicCryptoServerConfig* crypto_config,
         QuicServerSessionBase* session) = 0;
   };
diff --git a/quic/test_tools/quic_test_utils.cc b/quic/test_tools/quic_test_utils.cc
index dca7697..ca89a55 100644
--- a/quic/test_tools/quic_test_utils.cc
+++ b/quic/test_tools/quic_test_utils.cc
@@ -661,12 +661,12 @@
   DeleteConnection();
 }
 
-QuicCryptoServerStreamBase*
+std::unique_ptr<QuicCryptoServerStreamBase>
 TestQuicSpdyServerSession::CreateQuicCryptoServerStream(
     const QuicCryptoServerConfig* crypto_config,
     QuicCompressedCertsCache* compressed_certs_cache) {
-  return new QuicCryptoServerStream(crypto_config, compressed_certs_cache, this,
-                                    &helper_);
+  return CreateCryptoServerStream(crypto_config, compressed_certs_cache, this,
+                                  &helper_);
 }
 
 void TestQuicSpdyServerSession::OnCryptoHandshakeEvent(
diff --git a/quic/test_tools/quic_test_utils.h b/quic/test_tools/quic_test_utils.h
index c9197f3..faa505d 100644
--- a/quic/test_tools/quic_test_utils.h
+++ b/quic/test_tools/quic_test_utils.h
@@ -804,7 +804,7 @@
   MOCK_CONST_METHOD1(SelectAlpn,
                      std::vector<quiche::QuicheStringPiece>::const_iterator(
                          const std::vector<quiche::QuicheStringPiece>&));
-  QuicCryptoServerStreamBase* CreateQuicCryptoServerStream(
+  std::unique_ptr<QuicCryptoServerStreamBase> CreateQuicCryptoServerStream(
       const QuicCryptoServerConfig* crypto_config,
       QuicCompressedCertsCache* compressed_certs_cache) override;
 
diff --git a/quic/tools/quic_simple_server_session.cc b/quic/tools/quic_simple_server_session.cc
index aa13a5b..b17bc78 100644
--- a/quic/tools/quic_simple_server_session.cc
+++ b/quic/tools/quic_simple_server_session.cc
@@ -42,12 +42,12 @@
   DeleteConnection();
 }
 
-QuicCryptoServerStreamBase*
+std::unique_ptr<QuicCryptoServerStreamBase>
 QuicSimpleServerSession::CreateQuicCryptoServerStream(
     const QuicCryptoServerConfig* crypto_config,
     QuicCompressedCertsCache* compressed_certs_cache) {
-  return new QuicCryptoServerStream(crypto_config, compressed_certs_cache, this,
-                                    stream_helper());
+  return CreateCryptoServerStream(crypto_config, compressed_certs_cache, this,
+                                  stream_helper());
 }
 
 void QuicSimpleServerSession::OnStreamFrame(const QuicStreamFrame& frame) {
diff --git a/quic/tools/quic_simple_server_session.h b/quic/tools/quic_simple_server_session.h
index d485e7c..a63ae3e 100644
--- a/quic/tools/quic_simple_server_session.h
+++ b/quic/tools/quic_simple_server_session.h
@@ -94,7 +94,7 @@
       const QuicRstStreamFrame& frame) override;
 
   // QuicServerSessionBaseMethod:
-  QuicCryptoServerStreamBase* CreateQuicCryptoServerStream(
+  std::unique_ptr<QuicCryptoServerStreamBase> CreateQuicCryptoServerStream(
       const QuicCryptoServerConfig* crypto_config,
       QuicCompressedCertsCache* compressed_certs_cache) override;