Constant MAX_PEM_FILE_BYTES 

pub const MAX_PEM_FILE_BYTES: u64 = _; // 1_048_576u64

Maximum size of a PEM file accepted by tls mtls import.

Unlike the other caps here, this one guards an operator-supplied path rather than a file the CLI wrote itself. tls mtls import read it with an unbounded fs::read, so pointing the flag at a large file — by typo or by a script composing paths — pulled the whole thing into memory before anything validated it. A full certificate chain with a private key is a few kilobytes; 1 MiB is generous by three orders of magnitude and still bounded.