conf := &tls.Config{
			MinVersion:         tls.VersionTLS12,
			ClientSessionCache: tls.NewLRUClientSessionCache(tlsClientSessionCacheSize),
		}
		if s := env.Get(EnvKESAPIKey, ""); s != "" {
			key, err := kes.ParseAPIKey(s)
			if err != nil {
				return nil, err
			}

			cert, err := kes.GenerateCertificate(key)
			if err != nil {
				return nil, err
			}