|  | @@ -65,24 +65,27 @@ tsi_ssl_pem_key_cert_pair* ConvertToTsiPemKeyCertPair(
 | 
	
		
			
				|  |  |  grpc_status_code TlsFetchKeyMaterials(
 | 
	
		
			
				|  |  |      const grpc_core::RefCountedPtr<grpc_tls_key_materials_config>&
 | 
	
		
			
				|  |  |          key_materials_config,
 | 
	
		
			
				|  |  | -    const grpc_tls_credentials_options& options, bool server_config,
 | 
	
		
			
				|  |  | -    grpc_ssl_certificate_config_reload_status* reload_status) {
 | 
	
		
			
				|  |  | +    const grpc_tls_credentials_options& options, bool is_server,
 | 
	
		
			
				|  |  | +    grpc_ssl_certificate_config_reload_status* status) {
 | 
	
		
			
				|  |  |    /** Verify that either |key_materials_config| is populated or |options| has a
 | 
	
		
			
				|  |  |     *  credential reload config. **/
 | 
	
		
			
				|  |  |    GPR_ASSERT(key_materials_config != nullptr);
 | 
	
		
			
				|  |  | -  GPR_ASSERT(reload_status != nullptr);
 | 
	
		
			
				|  |  | +  GPR_ASSERT(status != nullptr);
 | 
	
		
			
				|  |  |    bool is_key_materials_empty =
 | 
	
		
			
				|  |  |        key_materials_config->pem_key_cert_pair_list().empty();
 | 
	
		
			
				|  |  |    grpc_tls_credential_reload_config* credential_reload_config =
 | 
	
		
			
				|  |  |        options.credential_reload_config();
 | 
	
		
			
				|  |  | +  /** If there are no key materials and no credential reload config and the
 | 
	
		
			
				|  |  | +   *  caller is a server, then return an error. We do not require that a client
 | 
	
		
			
				|  |  | +   *  always provision certificates. **/
 | 
	
		
			
				|  |  |    if (credential_reload_config == nullptr && is_key_materials_empty &&
 | 
	
		
			
				|  |  | -      server_config) {
 | 
	
		
			
				|  |  | +      is_server) {
 | 
	
		
			
				|  |  |      gpr_log(GPR_ERROR,
 | 
	
		
			
				|  |  |              "Either credential reload config or key materials should be "
 | 
	
		
			
				|  |  |              "provisioned.");
 | 
	
		
			
				|  |  |      return GRPC_STATUS_FAILED_PRECONDITION;
 | 
	
		
			
				|  |  |    }
 | 
	
		
			
				|  |  | -  grpc_status_code status = GRPC_STATUS_OK;
 | 
	
		
			
				|  |  | +  grpc_status_code reload_status = GRPC_STATUS_OK;
 | 
	
		
			
				|  |  |    /** Use |credential_reload_config| to update |key_materials_config|. **/
 | 
	
		
			
				|  |  |    if (credential_reload_config != nullptr) {
 | 
	
		
			
				|  |  |      grpc_tls_credential_reload_arg* arg = new grpc_tls_credential_reload_arg();
 | 
	
	
		
			
				|  | @@ -92,13 +95,12 @@ grpc_status_code TlsFetchKeyMaterials(
 | 
	
		
			
				|  |  |        /** Credential reloading is performed async. This is not yet supported.
 | 
	
		
			
				|  |  |         * **/
 | 
	
		
			
				|  |  |        gpr_log(GPR_ERROR, "Async credential reload is unsupported now.");
 | 
	
		
			
				|  |  | -      *reload_status = GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED;
 | 
	
		
			
				|  |  | -      status =
 | 
	
		
			
				|  |  | +      *status = GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED;
 | 
	
		
			
				|  |  | +      reload_status =
 | 
	
		
			
				|  |  |            is_key_materials_empty ? GRPC_STATUS_UNIMPLEMENTED : GRPC_STATUS_OK;
 | 
	
		
			
				|  |  |      } else {
 | 
	
		
			
				|  |  |        /** Credential reloading is performed sync. **/
 | 
	
		
			
				|  |  | -      GPR_ASSERT(reload_status != nullptr);
 | 
	
		
			
				|  |  | -      *reload_status = arg->status;
 | 
	
		
			
				|  |  | +      *status = arg->status;
 | 
	
		
			
				|  |  |        if (arg->status == GRPC_SSL_CERTIFICATE_CONFIG_RELOAD_UNCHANGED) {
 | 
	
		
			
				|  |  |          /* Key materials is not empty. */
 | 
	
		
			
				|  |  |          gpr_log(GPR_DEBUG, "Credential does not change after reload.");
 | 
	
	
		
			
				|  | @@ -107,7 +109,8 @@ grpc_status_code TlsFetchKeyMaterials(
 | 
	
		
			
				|  |  |          if (arg->error_details != nullptr) {
 | 
	
		
			
				|  |  |            gpr_log(GPR_ERROR, "%s", arg->error_details);
 | 
	
		
			
				|  |  |          }
 | 
	
		
			
				|  |  | -        status = is_key_materials_empty ? GRPC_STATUS_INTERNAL : GRPC_STATUS_OK;
 | 
	
		
			
				|  |  | +        reload_status =
 | 
	
		
			
				|  |  | +            is_key_materials_empty ? GRPC_STATUS_INTERNAL : GRPC_STATUS_OK;
 | 
	
		
			
				|  |  |        }
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  |      gpr_free((void*)arg->error_details);
 | 
	
	
		
			
				|  | @@ -120,7 +123,7 @@ grpc_status_code TlsFetchKeyMaterials(
 | 
	
		
			
				|  |  |      }
 | 
	
		
			
				|  |  |      delete arg;
 | 
	
		
			
				|  |  |    }
 | 
	
		
			
				|  |  | -  return status;
 | 
	
		
			
				|  |  | +  return reload_status;
 | 
	
		
			
				|  |  |  }
 | 
	
		
			
				|  |  |  
 | 
	
		
			
				|  |  |  grpc_error* TlsCheckHostName(const char* peer_name, const tsi_peer* peer) {
 |