: ca_cert_(ca_cert),

      ca_cert_path_(Config::DataSource::getPath(config.trusted_ca())

                        .value_or(ca_cert_.empty() ? EMPTY_STRING : INLINE_STRING)),

      ca_cert_name_(ca_cert_name), certificate_revocation_list_(certificate_revocation_list),

          Config::DataSource::getPath(config.crl())

              .value_or(certificate_revocation_list_.empty() ? EMPTY_STRING : INLINE_STRING)),

      subject_alt_name_matchers_(getSubjectAltNameMatchers(config)),

      verify_certificate_hash_list_(config.verify_certificate_hash().begin(),

                                    config.verify_certificate_hash().end()),

      verify_certificate_spki_list_(config.verify_certificate_spki().begin(),

                                    config.verify_certificate_spki().end()),

      allow_expired_certificate_(config.allow_expired_certificate()),

      trust_chain_verification_(config.trust_chain_verification()),

          config.has_custom_validator_config()

              ? absl::make_optional<envoy::config::core::v3::TypedExtensionConfig>(

                    config.custom_validator_config())

              : absl::nullopt),

      api_(api), only_verify_leaf_cert_crl_(config.only_verify_leaf_cert_crl()),

      max_verify_depth_(config.has_max_verify_depth()

                            ? absl::optional<uint32_t>(config.max_verify_depth().value())

                            : absl::nullopt),

      auto_sni_san_match_(auto_sni_san_match) {}

    bool auto_sni_san_match, Api::Api& api, const std::string& name) {

  bool allow_empty_trusted_ca = !context.has_trusted_ca();

  if (!Runtime::runtimeFeatureEnabled("envoy.reloadable_features.reject_empty_trusted_ca_file")) {

    allow_empty_trusted_ca = true;

  }

  auto ca_or_error = Config::DataSource::read(context.trusted_ca(), allow_empty_trusted_ca, api);

  RETURN_IF_NOT_OK_REF(ca_or_error.status());

  auto list_or_error = Config::DataSource::read(context.crl(), true, api);

  RETURN_IF_NOT_OK_REF(list_or_error.status());

  auto config = std::unique_ptr<CertificateValidationContextConfigImpl>(

      new CertificateValidationContextConfigImpl(*ca_or_error, *list_or_error, context,

                                                 auto_sni_san_match, api, name));

  absl::Status status = config->initialize();

  if (status.ok()) {

    return config;

  }

  return status;

}

absl::Status CertificateValidationContextConfigImpl::initialize() {

  if (ca_cert_.empty() && custom_validator_config_ == absl::nullopt) {

    if (!certificate_revocation_list_.empty()) {

      return absl::InvalidArgumentError(fmt::format("Failed to load CRL from {} without trusted CA",

                                                    certificateRevocationListPath()));

    }

    if (!subject_alt_name_matchers_.empty()) {

      return absl::InvalidArgumentError("SAN-based verification of peer certificates without "

                                        "trusted CA is insecure and not allowed");

    }

    if (allow_expired_certificate_) {

      return absl::InvalidArgumentError(

          "Certificate validity period is always ignored without trusted CA");

    }

  }

  return absl::OkStatus();

}

    const envoy::extensions::transport_sockets::tls::v3::CertificateValidationContext& config) {

  std::vector<envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher>

      subject_alt_name_matchers(config.match_typed_subject_alt_names().begin(),

                                config.match_typed_subject_alt_names().end());

  if (!subject_alt_name_matchers.empty()) {

    if (!config.match_subject_alt_names().empty()) {

      ENVOY_LOG_MISC(warn,

                     "Ignoring match_subject_alt_names as match_typed_subject_alt_names is also "

                     "specified, and the former is deprecated.");

    }

    return subject_alt_name_matchers;

  }

  for (const envoy::type::matcher::v3::StringMatcher& matcher : config.match_subject_alt_names()) {

    static constexpr std::array<

        envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::SanType, 4>

        san_types{envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::DNS,

                  envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::URI,

                  envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::EMAIL,

                  envoy::extensions::transport_sockets::tls::v3::SubjectAltNameMatcher::IP_ADDRESS};

    for (const auto san_type : san_types) {

      subject_alt_name_matchers.emplace_back();

      subject_alt_name_matchers.back().set_san_type(san_type);

      *subject_alt_name_matchers.back().mutable_matcher() = matcher;

    }

  }

  return subject_alt_name_matchers;

}