security: support multiple CN for TLS connections

[lhy1024]

What problem does this PR solve?

Issue Number: Close #5134

What is changed and how does it work?

It can be reviewed after #8441 is merged.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)

test in tiup with multi cn

• without this PR
  
• with this PR
  

Release note

security: support multiple CN for TLS connections

[ti-chi-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[lhy1024]

Is it necessary?

[codecov]

Codecov Report

Attention: Patch coverage is 68.75000% with 10 lines in your changes missing coverage. Please review.

Project coverage is 77.64%. Comparing base (571c59b) to head (26a86dc).
Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8518      +/-   ##
==========================================
- Coverage   77.66%   77.64%   -0.02%     
==========================================
  Files         474      474              
  Lines       61884    61851      -33     
==========================================
- Hits        48061    48026      -35     
- Misses      10277    10301      +24     
+ Partials     3546     3524      -22     

Flag	Coverage Δ
unittests	77.64% <68.75%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[lhy1024]

Manual test

script

tiup cluster deploy test nightly /home/lhy1024/t.yml
tiup cluster start test --init
tiup cluster patch test /home/lhy1024/pd/bin/pd.tar.gz -R pd --overwrite
tiup cluster edit-config test
tiup cluster tls test enable
tiup cluster edit-config test
tiup cluster reload test
tiup cluster scale-out test scale-out.yaml
tiup cluster display test
mysql --comments --host 192.168.8.88 --port 4000 -u root --ssl-verify-server-cert=false -p
sysbench oltp_insert --mysql-host=192.168.8.88  --mysql-port=4000 --mysql-user=root  --mysql-password="" --tables=32 --report-interval=1 --events=0 --time=0 --threads=32 prepare
tiup ctl:v8.2.0 pd -u https://192.168.8.88:2379 --cacert="/home/tidb/.tiup/storage/cluster/clusters/test/tls/ca.crt" --key="/home/tidb/.tiup/storage/cluster/clusters/test/tls/client.pem" --cert="/home/tidb/.tiup/storage/cluster/clusters/test/tls/client.crt" member

config file

Note: we need add test-client because of https://github.com/pingcap/tiup/blob/a16d04fccb22106a5c8b2d7d074b7ab94a1dd677/pkg/cluster/manager/cacert.go#L65

result

tiup display:

sysbench test:

pd ctl:

[HuSharp]

This parameter doesn't be used. It seems like we can remove this parameter directly, maybe we can discuss it in another issue.

[HuSharp]

plz help to update doc as well :)

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2024-09-03 04:20:49.800742816 +0000 UTC m=+331774.318795738: ☑️ agreed by rleungx.
• 2024-09-04 01:59:20.49493746 +0000 UTC m=+409685.012990385: ☑️ agreed by HuSharp.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: HuSharp, niubell, rleungx

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [HuSharp,rleungx]
• client/tlsutil/OWNERS [niubell]
• server/config/OWNERS [niubell]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment