absl::Status& creation_status) {

  switch (config.session_ticket_keys_type_case()) {

  case envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext::

      SessionTicketKeysTypeCase::kSessionTicketKeys:

    return factory_context.serverFactoryContext()

        .secretManager()

        .createInlineTlsSessionTicketKeysProvider(config.session_ticket_keys());

  case envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext::

      SessionTicketKeysTypeCase::kSessionTicketKeysSdsSecretConfig: {

    const auto& sds_secret_config = config.session_ticket_keys_sds_secret_config();

    if (sds_secret_config.has_sds_config()) {

      return factory_context.serverFactoryContext()

          .secretManager()

          .findOrCreateTlsSessionTicketKeysContextProvider(

              sds_secret_config.sds_config(), sds_secret_config.name(),

              factory_context.serverFactoryContext(), factory_context.initManager());

    } else {

      auto secret_provider =

          factory_context.serverFactoryContext()

              .secretManager()

              .findStaticTlsSessionTicketKeysContextProvider(sds_secret_config.name());

      if (secret_provider) {

        return secret_provider;

      }

    }

  }

  case envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext::

      SessionTicketKeysTypeCase::kDisableStatelessSessionResumption:

  case envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext::

      SessionTicketKeysTypeCase::SESSION_TICKET_KEYS_TYPE_NOT_SET:

    return nullptr;

  }

}

    const envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext& config) {

  if (config.session_ticket_keys_type_case() ==

      envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext::

          SessionTicketKeysTypeCase::kDisableStatelessSessionResumption) {

    return config.disable_stateless_session_resumption();

  } else {

    return false;

  }

}

    const std::vector<std::string>& server_names, bool for_quic) {

  absl::Status creation_status = absl::OkStatus();

  std::unique_ptr<ServerContextConfigImpl> ret = absl::WrapUnique(new ServerContextConfigImpl(

      config, secret_provider_context, creation_status, server_names, for_quic));

  RETURN_IF_NOT_OK(creation_status);

  return ret;

}

    : ContextConfigImpl(

          config.common_tls_context(), false /* auto_sni_san_match */, DEFAULT_MIN_VERSION,

          DEFAULT_MAX_VERSION, FIPS_mode() ? DEFAULT_CIPHER_SUITES_FIPS : DEFAULT_CIPHER_SUITES,

          FIPS_mode() ? DEFAULT_CURVES_FIPS : DEFAULT_CURVES, factory_context, creation_status),

      server_names_(server_names), require_client_certificate_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(

      ocsp_staple_policy_(ocspStaplePolicyFromProto(config.ocsp_staple_policy())),

          getTlsSessionTicketKeysConfigProvider(factory_context, config, creation_status)),

      disable_stateless_session_resumption_(getStatelessSessionResumptionDisabled(config)),

      disable_stateful_session_resumption_(config.disable_stateful_session_resumption()),

          PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, full_scan_certs_on_sni_mismatch, false)),

      prefer_client_ciphers_(config.prefer_client_ciphers()) {

  SET_AND_RETURN_IF_NOT_OK(creation_status, creation_status);

  if (session_ticket_keys_provider_ != nullptr) {

    stk_validation_callback_handle_ = session_ticket_keys_provider_->addValidationCallback(

        [this](const envoy::extensions::transport_sockets::tls::v3::TlsSessionTicketKeys& keys) {

    if (session_ticket_keys_provider_->secret() != nullptr) {

      auto keys_or_error = getSessionTicketKeys(*session_ticket_keys_provider_->secret());

      SET_AND_RETURN_IF_NOT_OK(keys_or_error.status(), creation_status);

      session_ticket_keys_ = *keys_or_error;

    }

  }

  if (!capabilities().provides_certificates) {

    if ((config.common_tls_context().tls_certificates().size() +

         config.common_tls_context().tls_certificate_sds_secret_configs().size()) == 0 &&

        !config.common_tls_context().has_custom_tls_certificate_selector()) {

      creation_status = absl::InvalidArgumentError("No TLS certificates found for server context");

    } else if (!config.common_tls_context().tls_certificates().empty() &&

               !config.common_tls_context().tls_certificate_sds_secret_configs().empty()) {

      creation_status = absl::InvalidArgumentError(

          "SDS and non-SDS TLS certificates may not be mixed in server contexts");

      return;

    }

  }

  if (config.has_session_timeout()) {

    session_timeout_ =

        std::chrono::seconds(DurationUtil::durationToSeconds(config.session_timeout()));

  }

  if (!config.has_require_client_certificate() &&

      config.common_tls_context().validation_context_type_case() !=

          envoy::extensions::transport_sockets::tls::v3::CommonTlsContext::

              ValidationContextTypeCase::VALIDATION_CONTEXT_TYPE_NOT_SET) {

    ENVOY_LOG_MISC(

        warn,

        "Using deprecated insecure default of not requiring client cert when a validation context "

        "is configured. This default will be changed in a future version. Please explicitly "

        "configure a value for require_client_certificate.");

    factory_context.serverFactoryContext().runtime().countDeprecatedFeatureUse();

  }

  if (config.common_tls_context().has_custom_tls_certificate_selector()) {

    const auto& provider_config = config.common_tls_context().custom_tls_certificate_selector();

    Ssl::TlsCertificateSelectorConfigFactory& provider_factory =

        Config::Utility::getAndCheckFactory<Ssl::TlsCertificateSelectorConfigFactory>(

            provider_config);

    ProtobufTypes::MessagePtr message = Config::Utility::translateAnyToFactoryConfig(

        provider_config.typed_config(), factory_context.messageValidationVisitor(),

        provider_factory);

    auto selector_factory = provider_factory.createTlsCertificateSelectorFactory(

        *message, factory_context, *this, for_quic);

    SET_AND_RETURN_IF_NOT_OK(selector_factory.status(), creation_status);

    tls_certificate_selector_factory_ = *std::move(selector_factory);

  } else {

    auto factory =

        TlsCertificateSelectorConfigFactoryImpl::getDefaultTlsCertificateSelectorConfigFactory();

    const Protobuf::Any any;

    auto selector_factory =

        factory->createTlsCertificateSelectorFactory(any, factory_context, *this, for_quic);

    SET_AND_RETURN_IF_NOT_OK(selector_factory.status(), creation_status);

    tls_certificate_selector_factory_ = *std::move(selector_factory);

  }

}

void ServerContextConfigImpl::setSecretUpdateCallback(std::function<absl::Status()> callback) {

  auto callback_with_notify = [this, callback] {

    RETURN_IF_NOT_OK(callback());

    return tls_certificate_selector_factory_->onConfigUpdate();

  };

  ContextConfigImpl::setSecretUpdateCallback(callback_with_notify);

  if (session_ticket_keys_provider_) {

    stk_update_callback_handle_ =

        session_ticket_keys_provider_->addUpdateCallback([this, callback_with_notify]() {

  }

}

    const envoy::extensions::transport_sockets::tls::v3::TlsSessionTicketKeys& keys) {

  std::vector<Ssl::ServerContextConfig::SessionTicketKey> result;

  for (const auto& datasource : keys.keys()) {

    auto datasource_or_error = Config::DataSource::read(datasource, false, api_);

    RETURN_IF_NOT_OK(datasource_or_error.status());

    auto key_or_error = getSessionTicketKey(std::move(*datasource_or_error));

    RETURN_IF_NOT_OK(key_or_error.status());

    result.emplace_back(std::move(*key_or_error));

  }

  return result;

}

ServerContextConfigImpl::getSessionTicketKey(const std::string& key_data) {

  static_assert(sizeof(SessionTicketKey) == 80, "Input is expected to be this size");

  if (key_data.size() != sizeof(SessionTicketKey)) {

    return absl::InvalidArgumentError(fmt::format("Incorrect TLS session ticket key length. "

                                                  "Length {}, expected length {}.",

                                                  key_data.size(), sizeof(SessionTicketKey)));

  }

  SessionTicketKey dst_key;

  std::copy_n(key_data.begin(), dst_key.name_.size(), dst_key.name_.begin());

  size_t pos = dst_key.name_.size();

  std::copy_n(key_data.begin() + pos, dst_key.hmac_key_.size(), dst_key.hmac_key_.begin());

  pos += dst_key.hmac_key_.size();

  std::copy_n(key_data.begin() + pos, dst_key.aes_key_.size(), dst_key.aes_key_.begin());

  pos += dst_key.aes_key_.size();

  ASSERT(key_data.begin() + pos == key_data.end());

  return dst_key;

}

        policy) {

  switch (policy) {

  case envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext::LENIENT_STAPLING:

    return Ssl::ServerContextConfig::OcspStaplePolicy::LenientStapling;

  case envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext::STRICT_STAPLING:

    return Ssl::ServerContextConfig::OcspStaplePolicy::StrictStapling;

  case envoy::extensions::transport_sockets::tls::v3::DownstreamTlsContext::MUST_STAPLE:

    return Ssl::ServerContextConfig::OcspStaplePolicy::MustStaple;

  }

Ssl::TlsCertificateSelectorFactory& ServerContextConfigImpl::tlsCertificateSelectorFactory() const {

  if (!tls_certificate_selector_factory_) {

  return *tls_certificate_selector_factory_;

}