def tls_flags(s):
    """
    Parse a comma-separated key-value list as used for command-line TLS
    configuration.

    Returns a dictionary of the key-value pairs recovered from s.
    """
    ret = {}
    for item in s.split(','):
        if not item: continue
        key, sep, value = item.partition('=')
        if not sep: raise ValueError('Invalid key-value pair %r' % (item,))
        if key in ret: raise ValueError('Duplicate key %r' % (key,))
        ret[key] = value
    return ret