Substance is right and well-thought-out. Walking through:

• Both cert and key made optional — the no_server_cert = cert_str.is_none() && key_str.is_none() short-circuit lets a tls.createSecureContext({}) placeholder or an SNICallback-only server pass through. ✓
• NoCertResolver installed when no cert — the Option<Arc<CertifiedKey>>::None return from resolve() is what triggers rustls's Error::General("no server certificate chain resolved") + AccessDenied fatal alert. The PR mirrors Node/OpenSSL by mapping that error to ERR_SSL_NO_SUITABLE_SIGNATURE_ALGORITHM server-side. The matching client-side ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE is already covered by the catch-all _ arm in rustls_error_to_node_error. ✓
• Existing "key was provided but malformed" path preserved: rustls_pemfile::private_key(...).ok().flatten()? still propagates None up to build_server_config's caller via ?, so a half-configured (cert without key, or key without cert) call still bails with the same behavior as before. ✓
• E::General(msg) if msg == "no server certificate chain resolved" — string match on rustls's error message is fragile (rustls could change the wording), but there isn't a structured variant for "resolver returned None". A // keep in sync with rustls upstream wording TODO comment would help future-proof this; non-blocking.

Test enrollment placement is wrong

tests/node_compat/config.jsonc puts the new entry after test-tls-set-encoding:

     "parallel/test-tls-set-encoding.js": {},
+    "parallel/test-tls-empty-sni-context.js": {},
     "parallel/test-tls-snicallback-error.js": {},

But e-mpty < s-et alphabetically. The entry should sort with the test-tls-e* cluster, not between set-encoding and snicallback-error. Worth fixing for the next person who's grepping for test-tls-empty-*.

CI

94 success, 1 substantive failure (test node_compat (3/3) debug windows-x86_64) + a few pending. Same single-shard windows-x86_64-debug flake we've been seeing across today's TLS / lazy-load PRs; the matching release windows-x86_64 (3/3) and other windows-x86_64 debug shards (1/3, 2/3) all pass.

Holding to COMMENT until the alphabetical placement is fixed and the windows-x86_64 (3/3) shard is confirmed flake on rerun. Substance is good; happy to flip to APPROVE with those two cleanups.

LGTM on the delta. Both prior non-blocking notes addressed:

1. Test enrollment moved to the correct alphabetical position: now slotted between test-tls-econnreset and test-tls-enable-trace-cli in the test-tls-e* cluster (was misplaced after set-encoding). ✓
2. Sync-comment added for the rustls error-string match:

   // NOTE: keep this string in sync with rustls upstream — there is no
   // structured `Error` variant for "resolver returned None".

   Future-proofs the brittle string match. ✓

Substance unchanged from my prior review — cert/key both optional in build_server_config, NoCertResolver triggers rustls's Error::General("no server certificate chain resolved") + AccessDenied fatal alert, which rustls_error_to_node_error translates back to Node's ERR_SSL_NO_SUITABLE_SIGNATURE_ALGORITHM.

CI: 90 SUCCESS, 0 FAILURE, 23 still pending. No regressions on the relevant test node_compat and test unit_node shards.