[ISSUE #10302] Add SNI multi-domain certificate support for Proxy TLS

[RockteMQ-AI]

Summary

Add SNI (Server Name Indication) multi-domain certificate support for RocketMQ Proxy TLS, enabling multiple domains with different TLS certificates to be served on the same Proxy port for both gRPC and Remoting protocols.

Problem

Currently RocketMQ Proxy supports only a single certificate model — ProxyConfig has only tlsCertPath/tlsKeyPath for one cert/key pair, and both gRPC and Remoting servers build a single SslContext. This makes it impossible to serve multiple top-level domains with different certificates on the same Proxy port.

Fixes #10302

Solution

Introduced SNI support using Netty's SniHandler. The Proxy inspects the TLS ClientHello's SNI hostname and dynamically selects the corresponding certificate.

New files (4):

• TlsDomainConfig.java — per-domain cert/key path POJO
• SniHostnameMatcher.java — wildcard hostname matching (exact > wildcard > bare-domain fallback)
• TlsSniManager.java — manages multiple SslContext instances for gRPC (shaded Netty)
• TlsContextProvider.java — manages multiple SslContext instances for Remoting (non-shaded Netty)

Modified files (7):

• ProxyConfig.java — added tlsDomainConfigs map
• TlsCertificateManager.java — extended for multi-pair file watching with per-domain reload
• ProxyAndTlsProtocolNegotiator.java — uses SniHandler when domain configs present
• GrpcServer.java — registers domain TLS reload handler
• MultiProtocolTlsHelper.java — added buildDomainSslContext() for remoting
• MultiProtocolRemotingServer.java — accepts TlsContextProvider for SNI
• RemotingProtocolServer.java — wires domain SSL contexts into remoting server

Wildcard matching rules:

• Exact match first (foo.example.com)
• Wildcard: foo.example.com matches *.example.com
• Bare domain: example.com matches *.example.com
• Multi-level (a.b.example.com) does NOT match *.example.com
• No match → fallback to default certificate

Backward compatibility: When tlsDomainConfigs is not configured, behavior is identical to the current single-certificate model.

Testing

• Unit tests added: SniHostnameMatcherTest (12 test cases covering full wildcard matrix)
• Unit tests added: TlsSniManagerTest (13 test cases covering context resolution, reload, mapping)
• Existing TlsCertificateManagerTest passes (12 tests, no regression)
• Existing ProxyAndTlsProtocolNegotiatorTest passes (4 tests, no regression)
• Local build passes (mvn compile)

Changes

• proxy/src/main/java/.../config/TlsDomainConfig.java: New POJO for per-domain cert/key configuration
• proxy/src/main/java/.../config/ProxyConfig.java: Added tlsDomainConfigs field with getter/setter
• proxy/src/main/java/.../service/cert/SniHostnameMatcher.java: Wildcard hostname matching logic
• proxy/src/main/java/.../service/cert/TlsSniManager.java: Multi-context manager for gRPC SNI
• proxy/src/main/java/.../service/cert/TlsContextProvider.java: Multi-context manager for Remoting SNI
• proxy/src/main/java/.../service/cert/TlsCertificateManager.java: Extended for multi-pair watching
• proxy/src/main/java/.../grpc/ProxyAndTlsProtocolNegotiator.java: SNI handler in gRPC pipeline
• proxy/src/main/java/.../grpc/GrpcServer.java: Domain reload handler registration
• proxy/src/main/java/.../remoting/MultiProtocolTlsHelper.java: Domain SSL context builder
• proxy/src/main/java/.../remoting/MultiProtocolRemotingServer.java: TlsContextProvider support
• proxy/src/main/java/.../remoting/RemotingProtocolServer.java: Domain SSL wiring

[codecov-commenter]

Codecov Report

❌ Patch coverage is 20.66421% with 215 lines in your changes missing coverage. Please review.
✅ Project coverage is 48.10%. Comparing base (8242c1e) to head (a7a9e30).

Files with missing lines	Patch %	Lines
...etmq/proxy/grpc/ProxyAndTlsProtocolNegotiator.java	8.77%	50 Missing and 2 partials ⚠️
...etmq/proxy/service/cert/TlsCertificateManager.java	5.76%	44 Missing and 5 partials ⚠️
...ocketmq/proxy/service/cert/TlsContextProvider.java	0.00%	35 Missing ⚠️
...ocketmq/proxy/remoting/RemotingProtocolServer.java	0.00%	33 Missing ⚠️
.../apache/rocketmq/proxy/config/TlsDomainConfig.java	0.00%	15 Missing ⚠️
...ocketmq/proxy/remoting/MultiProtocolTlsHelper.java	0.00%	13 Missing ⚠️
...ava/org/apache/rocketmq/proxy/grpc/GrpcServer.java	0.00%	7 Missing ⚠️
...mq/proxy/remoting/MultiProtocolRemotingServer.java	0.00%	4 Missing ⚠️
...che/rocketmq/proxy/service/cert/TlsSniManager.java	88.88%	2 Missing and 2 partials ⚠️
.../org/apache/rocketmq/proxy/config/ProxyConfig.java	50.00%	2 Missing ⚠️
... and 1 more

Additional details and impacted files

@@              Coverage Diff              @@
##             develop   #10587      +/-   ##
=============================================
- Coverage      48.26%   48.10%   -0.17%     
- Complexity     13433    13436       +3     
=============================================
  Files           1378     1382       +4     
  Lines         100817   101085     +268     
  Branches       13040    13074      +34     
=============================================
- Hits           48660    48623      -37     
- Misses         46211    46493     +282     
- Partials        5946     5969      +23     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.