TLS Hostname Verification supports only one server

[spasam-onshape]

I can connect to more than one server using MemcachedClient. But there is ability to specify only one host name for ConnectionFactoryBuilder#setHostnameForTlsVerification

ConnectionFactoryBuilder#hostnameForTlsVerification seems redundant. Why doesn't TCPMemcachedNodeImpl use NodeEndPoint or SocketAddress and get the hostname it is communicating with?

[ciaranj]

Yeah it's a bit weird, I'm not at all sure why this line in TCPMemcachedNodeImpl.java :
sslEngine = sslContext.createSSLEngine(connectionFactory.getHostnameForTlsVerification(), ((InetSocketAddress) socketAddress).getPort());
isn't something more like:
sslEngine = sslContext.createSSLEngine(((InetSocketAddress) socketAddress).getHostName(), ((InetSocketAddress) socketAddress).getPort());
I can only assume it's supporting an edge case where all the nodes share the same certificate with all the addresses for al lthe nodes set as SANs or perhaps there's a hidden dependency on a bunch of IPs [nodes] all reverse-dns'ing back to a shared domain name, so only one [shared] certificate is required across them all.

[QuChen88]

For AWS elasticache, the DNS hostname for all the nodes in a memcached cluster has similar domain name / suffix. i.e. 0001.mycluster.xkf84q.use1.cache.amazonaws.com, 0002.mycluster..xkf84q.use1.cache.amazonaws.com etc. So it is easy to wild-card the hostname in the certificate so that it works for all the nodes in the cluster (e.g. in this case it would be something like *.mycluster.xkf84q.use1.cache.amazonaws.com).

[ciaranj]

@QuChen88 that makes sense (as to the design choice) it just doesn't generalise outside of the AWS elasticache case, which is unfortunate (but understandable given the client)