Class TlsServerCertificateOptions
- Namespace
- MailFathom.Infrastructure.Certificates
- Assembly
- MailFathom.Infrastructure.dll
Configures where the TLS identity MailFathom presents to a client comes from.
public sealed class TlsServerCertificateOptions- Inheritance
-
TlsServerCertificateOptions
- Inherited Members
Remarks
Two provisioning shapes exist because both occur: a certificate authority hands an operator a PEM chain beside a separate PEM key, and a platform or an export tool hands them one PKCS#12 bundle holding both. Exactly one of the two is configured; supplying both leaves which material states the identity undecidable, so it is rejected rather than resolved by a precedence rule nobody would remember.
Every part binds to ConfiguredSecret, including the certificate chain, which is public material. The block is the reference mechanism rather than a claim about secrecy: binding the chain to it is what lets an operator point at a file, a systemd credential, or an environment variable with the same grammar the private key uses, and what makes ConfiguredSecretDiscovery prove at startup that each part is reachable. The consequence that matters is the one the default interpretation mode enforces: under ReferenceOnly a private key or a bundle password written straight into configuration fails startup instead of being used.
Properties
- Bundle
Gets or sets the PKCS#12/PFX bundle holding the leaf, its private key, and any intermediates, whose nested password block opens it when it is protected.
- CertificateChain
Gets or sets the PEM certificate material, whose first certificate is the leaf and whose remaining certificates are the chain presented after it.
- IsConfigured
Gets whether any material is configured at all.
- PrivateKey
Gets or sets the PEM private key belonging to the leaf, whose nested password block decrypts it when it is encrypted.
Methods
- FindConfigurationErrors(string)
Finds everything an operator must fix before this material can be loaded.