fix: select proper box certificate by SNI presence

[Netfreak25]

Select the certificate presented by the box HTTPS listener based on whether the TLS ClientHello contains an SNI extension.

Connections without SNI use the existing TB1 certificate, while connections with SNI use the TB2 certificate. This allows TB1 and TB2 devices to share the same HTTPS listener while receiving the appropriate certificate.

The SNI-based behavior is documented in docs/box-https-sni.md.

Verification

Tested against commit 81b6d01 using OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024).

Both connections target the same TeddyCloud HTTPS listener. The relevant difference is whether the TLS ClientHello contains an SNI extension.

Without SNI

$ openssl s_client -connect <target>:443 -showcerts -noservername

The server presents the TB1 certificate:

subject=C=DE, ST=NW, L=Duesseldorf, O=Team RevvoX, CN=TeddyCloud Server
issuer=C=DE, ST=NW, L=Duesseldorf, O=Team RevvoX, CN=TeddyCloud CA Root Cert.
serial=6A79F125
sha256 Fingerprint=AE:23:4D:D6:38:2F:D5:AA:61:C3:6B:E4:0C:3C:48:2C:3F:BE:C0:D0:4A:A1:72:C2:8A:65:C5:EE:7E:43:E1:6F

Handshake:

Certificate chain
 0 s:C = DE, ST = NW, L = Duesseldorf, O = Team RevvoX, CN = TeddyCloud Server
   i:C = DE, ST = NW, L = Duesseldorf, O = Team RevvoX, CN = TeddyCloud CA Root Cert.
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256

New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit

With SNI

$ openssl s_client -connect <target>:443 -showcerts -servername <hostname>

The server presents the TB2 certificate:

subject=C=DE, ST=North Rhine-Westphalia, L=Duesseldorf, O=Team RevvoX, CN=tbs2.tonie.cloud
issuer=C=DE, ST=North Rhine-Westphalia, L=Duesseldorf, O=Team RevvoX, CN=TeddyCloud Root CA
serial=6A7069CC0000000000
sha256 Fingerprint=FD:13:AC:E4:41:30:C6:B1:91:FE:CC:27:92:4C:74:15:1C:4B:E0:70:5B:BB:EA:E8:76:91:1F:16:10:63:8C:77

Handshake:

Certificate chain
 0 s:C = DE, ST = North Rhine-Westphalia, L = Duesseldorf, O = Team RevvoX, CN = tbs2.tonie.cloud
   i:C = DE, ST = North Rhine-Westphalia, L = Duesseldorf, O = Team RevvoX, CN = TeddyCloud Root CA
   a:PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384

New, TLSv1.2, Cipher is ECDHE-ECDSA-AES256-GCM-SHA384
Server public key is 384 bit

Result

The same TeddyCloud HTTPS listener selects different certificates based solely on SNI presence:

• Without SNI: TB1 certificate (CN=TeddyCloud Server, RSA 2048)
• With SNI: TB2 certificate (CN=tbs2.tonie.cloud, EC 384)

This confirms that the SNI-based certificate selection works as intended.