from typing import Optional
import ssl


def create_ssl_context(
        certfile: str,
        keyfile: Optional[str] = None,
        dh_params_file: Optional[str] = None,
) -> ssl.SSLContext:
    """
    Create and return a :class:`ssl.SSLContext` for the server.
    The settings are chosen by the :mod:`ssl` module, and usually
    represent a higher security level than when calling the
    :class:`ssl.SSLContext` constructor directly.

    Arguments:
        - `certfile`: Path to a file in PEM format containing the
          SSL certificate of the server.
        - `keyfile`: Path to a file that contains the private key.
          Will be read from `certfile` if not present.
        - `dh_params_file`: Path to a file in PEM format containing
          Diffie-Hellman parameters for DH(E) and ECDH(E). Optional
          but highly recommended.
    """
    ssl_context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    ssl_context.load_cert_chain(certfile=certfile, keyfile=keyfile)
    if dh_params_file is not None:
        ssl_context.load_dh_params(dh_params_file)
    return ssl_context