@hyde-zhang Add a test or two around this in tls_test.go

Use go test -v -timeout=15s -count=1 -run TLSTestSuite as a shortcut to only execute tls tests

@ackleymi Thanks for looking into this.

Since the acceptor and initiator uses the same loadTLSConfig function, updated the patch a bit such that:

• TLS config will be created if:

  • As long as the settings has either pk or certificate entry set (might be incomplete)
  • Or no key pair setting at all but skip (SSL) client certs is allowed

  ---

  • The client certificates of TLS config will only be loaded if key and certificate both valid, but TLS config can still be loaded.
  • Initiator will be able to use TLS without its own pk and certs
  • Acceptor will skip client certs verification during hand shake if SocketUseSSL = Y i.e. when initiator is not providing any thing to verify
  • Acceptor can potentially start without setting its own pk and certs but this will be checked by crypto/tls. Again maybe initiator and acceptor shouldn't be using the same loadTLSConfig function.

• I found the SocketUseSSL config name a bit confusing as it is really just allowSkipClientCerts.

@ackleymi Updated previous comments. Found it was a bit confusing. Sorry about that.

Hey @ackleymi, any chance we can get this merged so that when initiator needs to use a custom CA file it can set SocketUseSSL=Y and only supply SocketCAFile (i.e. without setting SocketPrivateKeyFile and SocketCertificateFile)

@ackleymi thanks