pub fn server_tls(
key_prefix: &str,
cert: Option<&Path>,
key: Option<&Path>,
client_ca: Option<&Path>,
) -> Result<Option<ServerTls>, String>Expand description
Loads a server certificate and key from cert/key paths, if both are
set. Both unset leaves TLS off; exactly one set is a configuration error.
client_ca set requires and verifies a client certificate from that CA
on every connection — mutual TLS — and requires cert/key to also be
set, since verifying a client makes no sense on a listener that is not
itself terminating TLS. client_ca unset leaves the listener taking
any client, certificate or not, same as before mutual TLS existed.
key_prefix names the pair in error messages, e.g. "owp.tls" for
owp.tls_cert / owp.tls_key / owp.tls_client_ca.
§Errors
Returns a message naming the offending key if only one of cert/key
is set, if client_ca is set without both cert and key, if any file
cannot be read, or if the certificate/key/CA bundle do not parse or do
not match each other.