Fix TLS code review issues: SSL cleanup, TLS 1.2 min, CA verify, deprecation guards, server --help, port validation, __thread io_ssl, shared accept loop

src/client/client_cli.c

@@ -2,6 +2,7 @@
 #include "config.h"
 #include "log.h"
 #include "protocol.h"
+#include "transport_tls.h"
 #include "utils.h"
 #include <errno.h>
 #include <limits.h>
@@ -50,7 +51,7 @@ static void print_usage(void) {
   printf("  --tls               Enable TLS encryption\n");
   printf("  --cert <path>       TLS certificate file (PEM)\n");
   printf("  --key <path>        TLS private key file (PEM)\n");
-  printf("  --ca <path>         CA certificate for verification (PEM)\n");
+  printf("  --ca <path>         TLS CA certificate file (PEM)\n");
   printf("  --help              Show this help\n");
 }
 
@@ -230,6 +231,14 @@ int main(int argc, char *argv[]) {
     config->use_metadata = true;
   }
 
+  if (config->use_tls) {
+    if (!config->tls_cert || !config->tls_key) {
+      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      return 1;
+    }
+    tls_global_init();
+  }
+
   if (config->use_multithreading)
     return send_files_multithreaded(config);
   return send_files(config);

src/client/client_send.c

@@ -100,11 +100,11 @@ static int send_chunks_multithreaded(void *pipeline_context) {
     }
     client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port);
   } else if (context->config->use_tls) {
-    tls_global_init();
     client = client_create();
     if (!client || !client_connect_tls(client, server_host, server_port,
-                                       context->config->tls_cert,
-                                       context->config->tls_key)) {
+                                        context->config->tls_cert,
+                                        context->config->tls_key,
+                                        context->config->tls_ca)) {
       if (client) client_delete(client);
       fprintf(stderr, "Error: could not connect to server via TLS\n");
       return thrd_error;
@@ -254,10 +254,10 @@ int send_files(Config *config) {
     client = client_connect_ssh(config->ssh_destination, config->ssh_port);
     if (!client) return 1;
   } else if (config->use_tls) {
-    tls_global_init();
     client = client_create();
     if (!client || !client_connect_tls(client, server_host, server_port,
-                                       config->tls_cert, config->tls_key)) {
+                                        config->tls_cert, config->tls_key,
+                                        config->tls_ca)) {
       if (client) client_delete(client);
       fprintf(stderr, "Error: could not connect to server via TLS\n");
       return 1;