Connection fails to DB backends that have trailing dot in the SAN field of TLS certificate

[mgarstecki]

Describe the bug
We have a DB backend that uses TLS and has a server certificate with a trailing dot in the SAN field of the certificate. The latest version of Vault fails to connect to that server with the following error : error creating database object: error verifying connection: ping failed: failed to connect to host=REDACTED user=vault-uLmTVnVc database=postgres: failed to write startup message (tls: failed to parse certificate from server: x509: SAN dNSName is malformed)

The certificate is valid and used by other clients successfully. This is likely due to this Go bug, fixed in 1.25.3: golang/go#75828

To Reproduce
Steps to reproduce the behavior:

1. Create a connection to a DB backend that has a trailing dot in the SAN field of its TLS certificate.
   • We see this kind of certificate on the CloudSQL instances of S3NS, a french cloud provider based on GCP.
2. See the error when Vault tries to connect to the DB.

Expected behavior

Vault accepts the certificate as valid and connects to the DB host successfully.

Environment:

• Vault Server Version (retrieve with vault status): 1.21.0
• Vault CLI Version (retrieve with vault version): irrelevant
• Server Operating System/Architecture: Linux amd64

Vault server configuration file(s):

I think it's irrelevant, but can provide it if you really think it's needed.

Additional context

This is very likely a consequence of this Go bug: golang/go#75828

DNS names that finish with dots are perfectly valid, and we can't expect our cloud provider to change to certificates without this trailing dot.

Releasing a version of Vault built with Go 1.25.3 is likely to fix the issue.

[JcKlomp]

Similarly since vault 1.21.0 we also seem to be hitting the Go bug golang/go#75828 where the issue
non-email email-address SAN values prevent certificate parsing results in a failure of the PKI tidy process, which then fails the rotation of a CRL.

A new version of Vault with the fixed Go version is expected to resolve our issue too.

[JcKlomp]

This appears fixed in v1.21.1.
Unfortunately cannot verify until next week if it resolves our issue with the PKI tidy process and the CRL rotation.

[JcKlomp]

Our issue with the SAN parse failure (x509: SAN rfc822Name is malformed) and the failure to rotate the CRL is indeed fixed with v1.21.1.
Most likely the issue with the trailing dot is also fixed by it.