Same here.

done

Use switch instead of if-else.

Extract these (revocation config) to a separate struct in a separate file.

Let's not return Security here. Returning nil, nil to indicate no config and no error seems a little cryptic (while correct, so I would suggest using the ErrNoTLS error to indicate no error, but also no TLS; so you can later have something like:

	l, err := net.Listen("tcp", p.config.Address)
	if err != nil {
		return err
	}
	tlsCfg, err := p.config.TLSConfig.Load()
	switch err {
	case nil:
		l = tls.NewListener(l, tlsCfg)
	case mptls.ErrNoTLS:
		break
	default:
		return err
	}

While this means we first start the listener and then parse the TLS config, this order is not so important; we can't have one without the other anyways.

We also need to know config is mTLS or only TLS , How can we find that config is TLS or mTLS ?

Move this alongside the new file for revocation config.

Also, this method looks very complex. Can you try to simplify or, at least, split?

Extract large strings to constants. Try to simplify the method.

Let's remove this whole construct and replace it with:

func Status(c Config) string {
	if c.CertFile == "" && c.KeyFile == "" {
		return "TLS"
	}

	if c.ClientCAFile != "" {
		if len(c.ClientValidation.ValidationMethods) > 0 {
			return "mTLS with client verification"
		}
		return "mTLS"
	}

	return "no TLS"
}

In main.go we have:

p.logger.Info(fmt.Sprintf("HTTP proxy server at %s%s with %s exiting with errors", p.config.Address, p.config.PrefixPath, mptls.Status(p.config.TLSConfig)), slog.String("error", err.Error()))

Rename to verifier. Also, separate OCSP and CRL into subpackages.

Simplify:

Use this as a util function, do not use Config receiver. Also, move it to a different package.

Same here, remove; use util method.

Remove, we do not need a new type; use the util method to determine log levels.

Replace with the list of verifiers, where Verifier is:

type Verifier interface {
	// VerifyPeerCertificate...
	VerifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
}

and in the Config we have:

func (c *Config) VerifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
	for _, v := range c.Verifiers {
		if err := v.VerifyPeerCertificate(rawCerts, verifiedChains); err != nil {
			return err
		}
	}
	return nil
}

And you use different implementations of Verifier ocsp and crl just like you already did.

And here it would be something like:

		tlsConfig.VerifyPeerCertificate = c.VerifyPeerCertificate

Fix examples/client/http/....

Please add allow_anonymous true to allow using more recent Mosquitto versions.