The invalid states are as follows:

The above table must be checked at startup time. At runtime, only the following must be checked to preserve these invariants:

sendKeyFile -> sendX509: Verify that sslMode is either preferSSL or requireSSL