Multiple CN support for TLS connections

[Tema]

Bug Report

I want to use different CN for clients and TiKV nodes, but pd-server fails to startup if I specify more than one. I don't use TiDB layer and my clients run on a completely separate fleet and use completely separate certificates, so just do not make sense to have same CN.

What did you do?

Specify multiple values under:

[security]
## A CN which must be provided by a client
cert-allowed-cn = ["TiKV", "Client"]

as PD config accepts multiple values under security.cert-allowed-cn:

pd/conf/config.toml

Lines 34 to 35 in af174e6

	## A CN which must be provided by a client
	# cert-allowed-cn = ["example.com"]

What did you expect to see?

pd-server starts up and client with different CN could connect to it.

What did you see instead?

pd-server fails to start to startup due to this check:

pd/pkg/grpcutil/grpcutil.go

Lines 93 to 103 in b4c1804

	// GetOneAllowedCN only gets the first one CN.
	func (s TLSConfig) GetOneAllowedCN() (string, error) {
	switch len(s.CertAllowedCN) {
	case 1:
	return s.CertAllowedCN[0], nil
	case 0:
	return "", nil
	default:
	return "", errs.ErrSecurityConfig.FastGenByArgs("only supports one CN")
	}
	}

.

What version of PD are you using (pd-server -V)?

5.4, but the latest master has same issue

[nolouch]

/assign @nolouch

[lhy1024]

1. make etcd support multiple cn and wait etcd release
   • Support multiple values for allowed client and peer TLS identities etcd-io/etcd#18015
   • [3.5] Support multiple values for allowed client and peer TLS identities etcd-io/etcd#18160
2. update etcd to 3.5.15 in tidb-dashboard and pd
   • update go to 1.21  pingcap/tidb-dashboard#1709
   • update etcd to 3.5.15 pingcap/tidb-dashboard#1707
   • *: upgrade etcd to v3.5.15  #8441
3. support multiple cn in pd and update doc
   • security: support multiple CN for TLS connections #8518
   • security: support multiple CN for TLS connections #8518 (comment)
   • update doc