Set list of trusted SSL CAs for client to verify
Set list of trusted SSL CAs for client to verify

As per SSL_CTX_set_client_CA_list(3SSL), set the list of acceptable CAs
advertised to SSL clients to include the server's own certificate. This
evidently fixes the pycurl/gnutls RPC client.

During the TLS Handshake, when client verification is requested, the
Server sends a CertificateRequest message which states that the client
should send a valid certificate as a response. The CertificateRequest
message contains a section called "certificate_authorities", which,
according to the standard, is a list of the Distinguished Names (DNs) of
acceptable certification authorities. The client uses this list to send
a certificate signed by one of the acceptable CAs.

Under OpenSSL's server implementation, this list must be set manually
using some appropriate call, otherwise the list is empty. TLS 1.0[1]
does not state whether the list may be left blank, whereas TLS 1.1[2]
and 1.2[3] state that in case the list is blank, then the client *may*
send any certificate of a valid type (valid types are specified
elsewhere in the handshake).

OpenSSL clients seem to obey the behaviour specified in TLS 1.1+,
whereas at least curl+GnuTLS does not send any certificates if the list
is empty (which is not wrong per the spec, but also evidently not
configurable).

[1] http://tools.ietf.org/html/rfc2246
[2] http://tools.ietf.org/html/rfc4346
[3] http://tools.ietf.org/html/rfc5246

Signed-off-by: Apollon Oikonomopoulos <2346bd49f3482f908ee2692e0cc8970349c7870a@noc.grnet.gr>
Reviewed-by: Michael Hanselmann <68b67885ff74281219b4a4be33cc20fd45078d7c@google.com>
Reviewed-by: Guido Trotter <f62ca4d5358bdaeef0e50e57f9f7e231de63727e@google.com>

dimara/ganeti,apyrgio/ganeti,bitemyapp/ganeti,ganeti/ganeti,andir/ganeti,dimara/ganeti,yiannist/ganeti,ganeti/ganeti,mbakke/ganeti,onponomarev/ganeti,grnet/snf-ganeti,ganeti/ganeti,apyrgio/snf-ganeti,apyrgio/snf-ganeti,apyrgio/ganeti,leshchevds/ganeti,mbakke/ganeti,yiannist/ganeti,ganeti-github-testing/ganeti-test-1,grnet/snf-ganeti,ganeti-github-testing/ganeti-test-1,yiannist/ganeti,andir/ganeti,bitemyapp/ganeti,leshchevds/ganeti,mbakke/ganeti,onponomarev/ganeti,leshchevds/ganeti,andir/ganeti