Improve documentation of TLS Server Name Indication (SNI) and fix its use by CMP client

[DDvO]

Add recommendation that TLS clients should use SSL_set_tlsext_host_name() for SNI and that this should be done jointly with using {SSL,X509_VERIFY_PARAM}_{set1,add1}_host(). On this occasion fix nits and omissions in the respective .pod files.

Fix inconsistent use of these functions in the CMP CLI: Any given -tls_host option must take precedence over using the host part of the server URL, and SSL_set_tlsext_host_name() must not be used with IP addresses.

Also fix OSSL_parse_url() going too far when scanning for '@' to detect the end of the userinfo component., going astray when an @ symbol occurs after the host component, for instance in the query component.

Checklist

• [x] documentation is added or updated
• [x] tests are added or updated

[DDvO]

BTW, since doing the SNI and hostname/address checks is important for correct and secure TLS connections, how about calling on client side SSL_set_tlsext_host_name() and X509_VERIFY_PARAM_set1_host() by default?

[t8m]

This needs a rebase due to conflicts.

[DDvO]

This needs a rebase due to conflicts.

Done. Also squashed all fixup commits due to review comments.

[openssl-machine]

This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago

[openssl-machine]

This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago

[DDvO]

After experimenting with the outcome of the new check_backports CI, I removed 3.0 from the target list because unfortunately there is a trivial merge conflict that I cannot work around in this PR. So a backport to 3.0, if still desirable, will require a separate PR.

I also tried with 3.2, but then noticed that there is some other such merge conflict there, and since 3.2 will anyway expire soon, I removed the 'branch: 3.2' label - so the above CI failure for 3.2 does no more apply.

[DDvO]

Thanks @mattcaswell and @vdukhovni for your comments of mid-June on my simplistic IS_IP_ADDR() - I finally took the time to fix this after getting reminded of this a few days back.

[DDvO]

@vdukhovni did you see that I meanwhile did the suggested fix?

[DDvO]

Can we please now get this bug+doc fix PR done. The new option suggested above by @vdukhovni is going to be added in a separate PR.

[DDvO]

Ping @openssl/committers for further reviews/approvals, please.

[DDvO]

This PR meanwhile should include all needed changes.

Asking again @openssl/committers for review and approvals.

[openssl-machine]

This PR is in a state where it requires action by @openssl/committers but the last update was 30 days ago

[DDvO]

@vdukhovni as mentioned in mid-August, I believe to have covered your comments. Okay now from your perspective?

[DDvO]

Ping again @vdukhovni

[DDvO]

Ping @openssl/committers for approvals