OFTLSStream currently only has client support. While adding server support itself is not hard, finding an abstract enough API is: Different TLS libraries take certificates in a different form, some from files, some from a system cert store. There needs to be a way flexible enough that works with all of them.