From a05b379c835fc821be126f5532d8eb4bbe94cec6 Mon Sep 17 00:00:00 2001
From: Shivaram Lingamneni <slingamn@cs.stanford.edu>
Date: Wed, 22 Jul 2026 04:31:58 -0400
Subject: [PATCH] clean up loadCertWithLeaf (#2426)

tls.LoadX509KeyPair started populating Leaf automatically in go1.23
---
 irc/config.go | 21 +++------------------
 1 file changed, 3 insertions(+), 18 deletions(-)

diff --git a/irc/config.go b/irc/config.go
index ab53eb12..7a149491 100644
--- a/irc/config.go
+++ b/irc/config.go
@@ -8,7 +8,6 @@ package irc
 import (
 	"bytes"
 	"crypto/tls"
-	"crypto/x509"
 	"errors"
 	"fmt"
 	"io"
@@ -942,7 +941,7 @@ func loadTlsConfig(config listenerConfigBlock) (tlsConfig *tls.Config, err error
 	if len(config.TLSCertificates) != 0 {
 		// SNI configuration with multiple certificates
 		for _, certPairConf := range config.TLSCertificates {
-			cert, err := loadCertWithLeaf(certPairConf.Cert, certPairConf.Key)
+			cert, err := tls.LoadX509KeyPair(certPairConf.Cert, certPairConf.Key)
 			if err != nil {
 				return nil, err
 			}
@@ -950,7 +949,7 @@ func loadTlsConfig(config listenerConfigBlock) (tlsConfig *tls.Config, err error
 		}
 	} else if config.TLS.Cert != "" {
 		// normal configuration with one certificate
-		cert, err := loadCertWithLeaf(config.TLS.Cert, config.TLS.Key)
+		cert, err := tls.LoadX509KeyPair(config.TLS.Cert, config.TLS.Key)
 		if err != nil {
 			return nil, err
 		}
@@ -993,20 +992,6 @@ func tlsMinVersionFromString(version string) uint16 {
 	}
 }
 
-func loadCertWithLeaf(certFile, keyFile string) (cert tls.Certificate, err error) {
-	// LoadX509KeyPair: "On successful return, Certificate.Leaf will be nil because
-	// the parsed form of the certificate is not retained." tls.Config:
-	// "Note: if there are multiple Certificates, and they don't have the
-	// optional field Leaf set, certificate selection will incur a significant
-	// per-handshake performance cost."
-	cert, err = tls.LoadX509KeyPair(certFile, keyFile)
-	if err != nil {
-		return
-	}
-	cert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])
-	return
-}
-
 // prepareListeners populates Config.Server.trueListeners
 func (conf *Config) prepareListeners() (err error) {
 	if len(conf.Server.Listeners) == 0 {
@@ -1079,7 +1064,7 @@ func (config *Config) processAPI() (err error) {
 
 	var tlsConfig *tls.Config
 	if config.API.TLS.Cert != "" {
-		cert, err := loadCertWithLeaf(config.API.TLS.Cert, config.API.TLS.Key)
+		cert, err := tls.LoadX509KeyPair(config.API.TLS.Cert, config.API.TLS.Key)
 		if err != nil {
 			return err
 		}