plugin/tls: make CA parameter optional (#1800)

plugin/tls/README.md

@@ -22,9 +22,11 @@ wire data of a DNS message.
 ## Syntax
 
 ~~~ txt
-tls CERT KEY CA
+tls CERT KEY [CA]
 ~~~
 
+Parameter CA is optional. If not set, system CAs can be used to verify the client certificate
+
 ## Examples
 
 Start a DNS-over-TLS server that picks up incoming DNS-over-TLS queries on port 5553 and uses the

plugin/tls/tls.go

@@ -24,10 +24,10 @@ func setup(c *caddy.Controller) error {
 
 	for c.Next() {
 		args := c.RemainingArgs()
-		if len(args) != 3 {
+		if len(args) < 2 || len(args) > 3 {
 			return plugin.Error("tls", c.ArgErr())
 		}
-		tls, err := tls.NewTLSConfig(args[0], args[1], args[2])
+		tls, err := tls.NewTLSConfigFromArgs(args...)
 		if err != nil {
 			return plugin.Error("tls", err)
 		}