Module tls 

TLS certificate loading and hot-reload support (RFC 020).

Two TLS setup modes

Mode	When used	Cert changes
with_single_cert	startup (static)	require restart
ReloadableCertResolver	startup with hot-reload	soft reload via reload_certs

Outcome C (RFC 020)

• TlsCertFile / TlsKeyFile changes are SoftReload (no listener rebind).
• TlsEnabled toggle is still HardRestart (changes the listener type).
• In-progress TLS handshakes that started before a reload complete with the old cert; new handshakes use the new cert atomically.

Structs

ReloadableCertResolver

A ResolvesServerCert implementation that supports atomic in-place certificate rotation without restarting the listener (RFC 020).

TlsReloadError

Error returned when ReloadableCertResolver::reload_from_paths fails.

Functions

build_server_config_reloadable

Build a ServerConfig backed by a ReloadableCertResolver.

build_server_config_static

Build a static (non-reloadable) ServerConfig for the common case.

load_certs

Load TLS/SSL certificates (leaf + any intermediates) from a PEM file.

load_private_key

Load a TLS/SSL private key from a PEM file.