server.ListenAndServe assumes the certificates are on disk. This is not always the case, for instance if the certificates are held encrypted in a database. In such a case it is undesirable to serialize the decrypted certificates to disk for obvious reasons.

It looks like it would be possible to work around this as follows:

server := &http.Server{
    Addr: listen,
    TLSConfig: tlsConfig,
    Handler: router,
}
server.ListenAndServeTLS("", ""))

where tlsConfig already has the certificates added to it. Unfortunately this does not work as ListenAndServerTLS unconditionally stomps over the Certificates member even when it is already provided within the supplied TLSConfig, and even if an empty string is passed.

The first thing I would suggest is that if the TLSConfig has a non-empty Certificates member, it is not overwritten.

To get around this it would be possible to simply copy/paste ListenAndServeTLS. Unfortunately, it uses the non-exported struct tcpKeepAliveListener, which is rather important for https connections using keep-alives. This thus needs to be copied too. This is a useful bit of code which could be exported from net rather than kept private here.

The second thing I would suggest is that tlsKepAliveListener is exported from net, and ListenAndServerTLS (and friends) use this exported class instead.