server: add self-signed cert generation from SAN envvars

[s3rj1k]

Overview

Add opt-in ephemeral self-signed certificate generation to llama-server.

When --ssl-san-dns and/or --ssl-san-ip are set (and --ssl-key-file/--ssl-cert-file are not), the server generates a single in-memory ECDSA P-256 cert at startup with the supplied SANs and uses it for the process lifetime.

Validity is configurable via --ssl-validity-days (default 365).

All three flags also have matching LLAMA_ARG_SSL_* env vars.

Requirements

• I have read and agree with the contributing guidelines
• AI usage disclosure: YES — AI assistant used to help draft the OpenSSL cert-generation code and this description.

[ggml-gh-bot]

Hi @s3rj1k, thanks for your contribution!

Per our contribution guidelines, the automated PR checker found the following issue(s) that need your attention:

• AI-generated content: This project does not accept PRs, descriptions or commit messages that are fully or predominantly AI-generated. If you have used AI to assist you in writing code, please make sure to disclose that explicitly.

---

Please note that maintainers reserve the right to make final decisions on PRs. If you believe there is a mistake, please comment below.

[ngxson]

close as not in-scope feature