home: refactor tls

internal/dnsforward/config.go

@@ -22,6 +22,7 @@ import (
 	"github.com/AdguardTeam/golibs/stringutil"
 	"github.com/AdguardTeam/golibs/timeutil"
 	"github.com/ameshkov/dnscrypt/v2"
+	"golang.org/x/exp/slices"
 )
 
 // BlockingMode is an enum of all allowed blocking modes.
@@ -145,7 +146,8 @@ type FilteringConfig struct {
 	IpsetListFileName string `yaml:"ipset_file"`
 }
 
-// TLSConfig is the TLS configuration for HTTPS, DNS-over-HTTPS, and DNS-over-TLS
+// TLSConfig is the TLS configuration for HTTPS, DNS-over-HTTPS, DNS-over-TLS,
+// and DNS-over-QUIC.
 type TLSConfig struct {
 	cert tls.Certificate
 
@@ -184,6 +186,11 @@ type TLSConfig struct {
 	hasIPAddrs bool
 }
 
+// CertDataClone returns a deep copy of certificate data.
+func (c TLSConfig) CertDataClone() (certData, keyData []byte) {
+	return slices.Clone(c.CertificateChainData), slices.Clone(c.PrivateKeyData)
+}
+
 // DNSCryptConfig is the DNSCrypt server configuration struct.
 type DNSCryptConfig struct {
 	ResolverCert   *dnscrypt.Cert