1 files changed, 14 insertions, 28 deletions

diff --git a/internal/net/server.go b/internal/net/server.go
index 345122e..d212dbf 100644
--- a/internal/net/server.go
+++ b/internal/net/server.go
@@ -199,20 +199,9 @@ func NewServer(cfg *config.Config) (*Server, error) {
 	}
 
 	if cfg.TelnetTLS.Enabled {
-		var cert tls.Certificate
-		if cfg.TelnetTLS.CertFile == "" || cfg.TelnetTLS.KeyFile == "" {
-			var err error
-			cert, err = generateSelfSignedCert()
-			if err != nil {
-				return nil, fmt.Errorf("telnet_tls self-signed cert: %w", err)
-			}
-			log.Printf("telnet_tls: using self-signed certificate (no cert_file/key_file configured)")
-		} else {
-			var err error
-			cert, err = tls.LoadX509KeyPair(cfg.TelnetTLS.CertFile, cfg.TelnetTLS.KeyFile)
-			if err != nil {
-				return nil, fmt.Errorf("telnet_tls cert: %w", err)
-			}
+		cert, err := loadOrGenerateCert(cfg, "telnet_tls")
+		if err != nil {
+			return nil, fmt.Errorf("telnet_tls cert: %w", err)
 		}
 		tlsCfg := &tls.Config{
 			Certificates: []tls.Certificate{cert},
@@ -234,20 +223,9 @@ func NewServer(cfg *config.Config) (*Server, error) {
 	}
 
 	if cfg.HTTPS.Enabled {
-		var cert tls.Certificate
-		if cfg.HTTPS.CertFile == "" || cfg.HTTPS.KeyFile == "" {
-			var err error
-			cert, err = generateSelfSignedCert()
-			if err != nil {
-				return nil, fmt.Errorf("https self-signed cert: %w", err)
-			}
-			log.Printf("https: using self-signed certificate (no cert_file/key_file configured)")
-		} else {
-			var err error
-			cert, err = tls.LoadX509KeyPair(cfg.HTTPS.CertFile, cfg.HTTPS.KeyFile)
-			if err != nil {
-				return nil, fmt.Errorf("https cert: %w", err)
-			}
+		cert, err := loadOrGenerateCert(cfg, "https")
+		if err != nil {
+			return nil, fmt.Errorf("https cert: %w", err)
 		}
 		s.httpsTLSConfig = &tls.Config{
 			Certificates: []tls.Certificate{cert},
@@ -262,6 +240,14 @@ func NewServer(cfg *config.Config) (*Server, error) {
 	return s, nil
 }
 
+func loadOrGenerateCert(cfg *config.Config, service string) (tls.Certificate, error) {
+	if cfg.TLS.CertFile != "" && cfg.TLS.KeyFile != "" {
+		return tls.LoadX509KeyPair(cfg.TLS.CertFile, cfg.TLS.KeyFile)
+	}
+	log.Printf("%s: using self-signed certificate (no shared tls cert configured)", service)
+	return generateSelfSignedCert()
+}
+
 func generateSelfSignedCert() (tls.Certificate, error) {
 	key, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {