The SSL settings should be individual affix settings to facilitate validation both at node startup time and when changed dynamically. Once completed, the affix settings with their respective validators should replace the validators added in #49196. See #49196 (comment) for more context.