home: imp code & doc

Author: EugeneOne1

internal/home/tls.go

@@ -546,6 +546,7 @@ func (m *tlsManager) setConfig(
 	if newConf.Enabled {
 		certPath, keyPath = newConf.CertificatePath, newConf.PrivateKeyPath
 	}
+
 	err := m.manager.Set(ctx, aghtls.TLSPair{
 		CertPath: certPath,
 		KeyPath:  keyPath,
@@ -730,7 +731,8 @@ func validatePorts(
 }
 
 // validateCertChain verifies certs using the first as the main one and others
-// as intermediate.  srvName stands for the expected DNS name.
+// as intermediate.  srvName stands for the expected DNS name.  certs must not
+// be empty.
 //
 // TODO(e.burkov):  Pass logger and rootCerts through arguments and remove
 // dependency on tlsManager.