Function server_tls_config 

pub fn server_tls_config(
    cert_path: &Path,
    key_path: &Path,
    client_ca_cert_path: Option<&Path>,
) -> Result<ServerConfig>

Build a rustls ServerConfig from PEM certificate and key files.

The certificate is served through a ReloadingCertifiedKey, so a rotated cert/key on disk (in-place rewrite or an atomic symlink swap) is picked up automatically on the next handshake without restarting the process. The initial load is validated eagerly: an invalid cert/key path fails here rather than starting a server that cannot serve TLS.

When client_ca_cert_path is Some, the server requires clients to present a certificate signed by that CA (mutual TLS); an unauthenticated client is rejected at the handshake. When None, client certificates are not requested.