implement buildSecureClientTransportEngine with serverName parameter

CHANGELOG.md

@@ -12,6 +12,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ### Enhancements
 - Support nested JWT claims in role DLS queries ([#5687](https://github.com/opensearch-project/security/issues/5687))
+- Support creation of client SSL engine with a given SNI ([#5894](https://github.com/opensearch-project/security/pull/5894))
+
 ### Bug Fixes
 - Fix IllegalArgumentException when resolved indices are empty in PrivilegesEvaluator ([#5770](https://github.com/opensearch-project/security/pull/5797))
 - Fixes an issue where recursive LDAP role search would fail with a NullPointerException ([#5861](https://github.com/opensearch-project/security/pull/5861))

src/main/java/org/opensearch/security/ssl/OpenSearchSecureSettingsFactory.java

@@ -128,7 +128,14 @@ public Optional<SSLEngine> buildSecureServerTransportEngine(Settings settings, T
 
             @Override
             public Optional<SSLEngine> buildSecureClientTransportEngine(Settings settings, String hostname, int port) throws SSLException {
-                return sslSettingsManager.sslContextHandler(CertType.TRANSPORT_CLIENT).map(c -> c.createClientSSLEngine(hostname, port));
+                return this.buildSecureClientTransportEngine(settings, null, hostname, port);
+            }
+
+            @Override
+            public Optional<SSLEngine> buildSecureClientTransportEngine(Settings settings, String serverName, String hostname, int port)
+                throws SSLException {
+                return sslSettingsManager.sslContextHandler(CertType.TRANSPORT_CLIENT)
+                    .map(c -> c.createClientSSLEngine(hostname, port, serverName));
             }
         });
     }

src/main/java/org/opensearch/security/ssl/SslContextHandler.java

@@ -19,6 +19,7 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
+import javax.net.ssl.SNIHostName;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLParameters;
@@ -62,10 +63,22 @@ public SSLEngine createSSLEngine() {
      * Creates a SSL engine for usage as a client. In this case, we can optionally perform hostname verification.
      */
     public SSLEngine createClientSSLEngine(final String hostname, final int port) {
+        return createClientSSLEngine(hostname, port, null);
+    }
+
+    /**
+     * Creates a SSL engine for usage as a client with a specified Server Name Indication (SNI).
+     */
+    public SSLEngine createClientSSLEngine(final String hostname, final int port, final String serverName) {
         SSLEngine sslEngine = sslContext.newEngine(NettyAllocator.getAllocator(), hostname, port);
-        if (hostname != null) {
+        if (hostname != null || serverName != null) {
             SSLParameters sslParams = new SSLParameters();
-            sslParams.setEndpointIdentificationAlgorithm("HTTPS");
+            if (hostname != null) {
+                sslParams.setEndpointIdentificationAlgorithm("HTTPS");
+            }
+            if (serverName != null) {
+                sslParams.setServerNames(List.of(new SNIHostName(serverName)));
+            }
             sslEngine.setSSLParameters(sslParams);
         }
         return sslEngine;