[DB-23477] Verify node hostnames against the cluster endpoint

[HarshDaryani896]

Fixes DB-23477.

The problem

sslhostnameverifier=com.yugabyte.ysql.YBManagedHostnameVerifier — the setting our docs tell Aeon users to apply for verify-full + load balancing — fails 100% of connections. A customer hit this in production:

PSQLException: Something unusual has occurred to cause the driver to fail.
 ← RuntimeException: PSQLException: The connection attempt failed.
 ← UnknownHostException: *.<cluster-uuid>.aws.ybdb.io

The verifier never matched the host against the certificate. It read a SAN out of the certificate and dialed that SAN string as a hostname, then queried yb_servers() to decide whether the host was a cluster member. A SAN is a pattern for matching names, not an address, so every certificate shape hit one of three failures:

Certificate	Deployment	Failure
wildcard DNS SAN	Aeon	UnknownHostException — a wildcard resolves to nothing
resolvable DNS or IP SAN	YBA, on-premises	StackOverflowError — see below
no usable SAN	any	NullPointerException from setProperty("PGHOST", null)

The membership check the class exists to perform has therefore never executed.

The recursion is worth calling out: the control connection was built from the same Properties, still carrying sslhostnameverifier and verify-full, so it re-entered verify(). The static field meant to prevent that is only assigned once the constructor returns, which never happens on the first call.

Failures were also wrapped in RuntimeException, which bypassed every SQLException handler in LoadBalanceService — including the "Failed to apply load balance. Trying normal connection" fallback. That is why pools died at startup rather than degrading.

The fix

The information needed was in the connection URL all along.

LoadBalanceService records the user's host in yb-endpoint-host before replacing it with a node address. verify() then makes two comparisons with no I/O at all:

1. the dialed host against the certificate — per-node certificates (YBA, on-premises);
2. the recorded endpoint — a cluster-wide certificate (Aeon).

Wildcard matching is RFC 6125 and already implemented in PGjdbcHostnameVerifier.verifyHostName.

The resulting guarantee equals verify-full connecting straight to the endpoint: the peer must present a certificate that chains to the configured sslrootcert and is valid for the name the user asked for. This is what the Node.js smart driver already does via servername.

Removing the round trip removes the recursion, the null SAN and the RuntimeException together, and deletes getCurrentServers(), the SAN loop, the static control connection and four unused fields — about 180 lines.

The endpoint is recorded for the control connection too, because the refresh retry path in checkAndRefresh can point it at a node address from yb_servers(), which a cluster-wide certificate does not cover.

MakeSSL no longer special-cases this class by name — it has a (Properties) constructor and goes through ObjectFactory like any other verifier, restoring verifyPeerName to its upstream shape.

Testing

1. Manually tested against a multi-node VPC peered YB Aeon cluster with verify-full. (The connection string should have the load balancer IP).
2. Ran the existing 7 tests [excluding Performance Test] in driver-examples repo.
3. Added a new hostname verifier test: https://github.com/yugabyte/driver-examples/pull/71

🤖 Generated with Claude Code

[ashetkar]

Please bump up the version before merging