ZOOKEEPER-5070: Support Single EKU certificates

[PDavid]

Goal

Support certificates with a single Extended Key Usage (EKU) - one cert with serverAuth for incoming connections, another with clientAuth for outgoing connections

Approach

Use separate SSLContext instances for client and server role instead of one. Each is initialized with standard PKIX managers from its own keystore / truststore.

If these new properties are not set, ZooKeeper falls back to the existing keyStore.* and trustStore.* configs (shared for both roles), so the change is fully backward-compatible.

Configuration changes

Introduces the following new config properties:

Client keystore

Presented when initiating connections (client role). Allows using a certificate with only clientAuth EKU.

zookeeper.ssl.client.keyStore.location=/etc/zookeeper/certs/client-keystore.jks
zookeeper.ssl.client.keyStore.password=clientKeystorePass
zookeeper.ssl.client.keyStore.type=JKS

Server truststore

Used when accepting connections (server role). Validates the connecting client's certificate during mTLS.

zookeeper.ssl.server.trustStore.location=/etc/zookeeper/certs/server-truststore.jks
zookeeper.ssl.server.trustStore.password=serverTruststorePass
zookeeper.ssl.server.trustStore.type=JKS

Quorum client keystore

zookeeper.ssl.quorum.client.keyStore.location=/etc/zookeeper/certs/quorum-client-keystore.jks
zookeeper.ssl.quorum.client.keyStore.password=quorumClientKeystorePass

Quorum server truststore (validates clients when accepting connections)

zookeeper.ssl.quorum.server.trustStore.location=/etc/zookeeper/certs/quorum-server-truststore.jks
zookeeper.ssl.quorum.server.trustStore.password=quorumServerTruststorePass