std::string maybeSet(absl::StatusOr<std::string> to_set, absl::Status error) {

  if (to_set.status().ok()) {

    return std::move(to_set.value());

  }

  error = to_set.status();

  return "";

}

                                         Api::Api& api, absl::Status& creation_status) {

  auto staple_or_error = Config::DataSource::read(source, true, api);

  if (!staple_or_error.ok()) {

  const std::string& staple = staple_or_error.value();

  if (source.specifier_case() ==

      envoy::config::core::v3::DataSource::SpecifierCase::kInlineString) {

    creation_status =

        absl::InvalidArgumentError("OCSP staple cannot be provided via inline_string");

    return {};

  }

  return {staple.begin(), staple.end()};

}

    const std::string& certificate_name) {

  absl::Status creation_status = absl::OkStatus();

  TlsCertificateConfigImpl ret(config, factory_context, api, creation_status, certificate_name);

  RETURN_IF_NOT_OK(creation_status);

  return ret;

}

    : certificate_chain_(maybeSet(Config::DataSource::read(config.certificate_chain(), true, api),

                                  creation_status)),

          Config::DataSource::getPath(config.certificate_chain())

              .value_or(certificate_chain_.empty() ? EMPTY_STRING : INLINE_STRING)),

      certificate_name_(certificate_name),

          maybeSet(Config::DataSource::read(config.private_key(), true, api), creation_status)),

      private_key_path_(Config::DataSource::getPath(config.private_key())

                            .value_or(private_key_.empty() ? EMPTY_STRING : INLINE_STRING)),

      pkcs12_(maybeSet(Config::DataSource::read(config.pkcs12(), true, api), creation_status)),

      pkcs12_path_(Config::DataSource::getPath(config.pkcs12())

                       .value_or(pkcs12_.empty() ? EMPTY_STRING : INLINE_STRING)),

      password_(maybeSet(Config::DataSource::read(config.password(), true, api), creation_status)),

      password_path_(Config::DataSource::getPath(config.password())

                         .value_or(password_.empty() ? EMPTY_STRING : INLINE_STRING)),

      ocsp_staple_(maybeReadOcspStaple(config.ocsp_staple(), api, creation_status)),

      ocsp_staple_path_(Config::DataSource::getPath(config.ocsp_staple())

                            .value_or(ocsp_staple_.empty() ? EMPTY_STRING : INLINE_STRING)),

      private_key_method_(nullptr) {

  RETURN_ONLY_IF_NOT_OK_REF(creation_status);

  if (config.has_pkcs12()) {

    if (config.has_private_key()) {

      creation_status = absl::InvalidArgumentError(

          fmt::format("Certificate configuration can't have both pkcs12 and private_key"));

    }

    if (config.has_certificate_chain()) {

      creation_status = absl::InvalidArgumentError(

          fmt::format("Certificate configuration can't have both pkcs12 and certificate_chain"));

    }

    if (config.has_private_key_provider()) {

      creation_status = absl::InvalidArgumentError(

          fmt::format("Certificate configuration can't have both pkcs12 and private_key_provider"));

    }

  } else {

    if (config.has_private_key_provider()) {

      private_key_method_ =

          factory_context.serverFactoryContext()

              .sslContextManager()

              .privateKeyMethodManager()

              .createPrivateKeyMethodProvider(config.private_key_provider(), factory_context);

      if (private_key_method_ == nullptr ||

          (!private_key_method_->isAvailable() && !config.private_key_provider().fallback())) {

        creation_status =

            absl::InvalidArgumentError(fmt::format("Failed to load private key provider: {}",

                                                   config.private_key_provider().provider_name()));

        return;

      }

      if (!private_key_method_->isAvailable()) {

        private_key_method_ = nullptr;

      }

    }

    if (certificate_chain_.empty()) {

      creation_status = absl::InvalidArgumentError(

          fmt::format("Failed to load incomplete certificate from {}: certificate chain not set",

                      certificate_chain_path_));

    }

    if (private_key_.empty() && private_key_method_ == nullptr) {

      creation_status = absl::InvalidArgumentError(

          fmt::format("Failed to load incomplete private key from path: {}", private_key_path_));

    }

  }

}