Add full TLS support

[morgo]

Currently we auto-select the rds-ca-2019-root.pem certificate if the hostname matches an RDS hostname. There's 2 problems with this:

1. Users may select a newer RDS certificate.
2. Users (outside of RDS) may want to use TLS and have their own certificate.

This is a FR to add full TLS support. We are open to external contributors.