- Generate self-signed certificates on startup using rcgen
- Configure rustls with aws_lc_rs crypto provider
- Filter key exchange groups to X25519-only for mode=x25519
- Print CA certificate for client trust configuration
- TLS 1.3 protocol enforced
- CaCertificate: self-signed CA that can sign server certificates
- ServerCertificate: DER-encoded cert chain and private key
- generate_test_certs(): convenience helper for local testing
- Uses rcgen 0.14 for X.509 certificate generation