Backport of Send TLS SNI in JWT auth provider into release/1.20.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #22177 to be assessed for backporting due to the inclusion of the label backport/1.20.

The below text is copied from the body of the original PR.

---

Description

Send hostname in SNI while initiating a TLS connection for JWTProvider. This is required by certain JWT providers such as Auth0 and not having it leads to a handshake error immediately after CLIENT_HELLO.
This is configured by setting the UseSNI flag to true in JWT Provider Config Entry for remote JWKS.

Testing & Reproduction steps

• Run consul agent - consul agent -dev in the terminal.

• Replace PROVIDER_NAME, JWKS_URI and JWKS_URI in jwt.hcl with actual values ref. Replace PROVIDER_NAME in intentions.hcl with the same name in jwt.hcl. (remove .txt extension cos github doen't allow .hcl attachements).

• In a different terminal, using consul cli, write the following configs (remove .txt extension cos github doen't allow .hcl attachements):

• consul config write proxy-defaults.hcl; consul config write jwt.hcl; consul config write intention.hcl; consul services register counting.hcl
  counting.hcl.txt
  intention.hcl.txt
  jwt.hcl.txt
  proxy-defaults.hcl.txt

• Connect Envoy using -consul connect envoy -sidecar-for counting -- -l debug

• UseSNI is present in jwt.hcl. When this is set to false or removed, you will see 503 in the Envoy logs:

client disconnected, failure reason: TLS_error:|268436496:SSL routines:OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE|268435610:SSL routines:OPENSSL_internal:HANDSHAKE_FAILURE_ON_CLIENT_HELLO:TLS_error_end

Links

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

---

Overview of commits

• 4a489a0 - af1ea20 - d6d92b2 - 89d5099 - ed01470 - dc9fa96 - 228c9a1 - df01c94 - a9509b6 - 152c9dc - 255c71a - 83bdd58 - f7d6d33 - 660ea8a

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR