TLS connection to an absolute FQDN (hostname ending with a trailing dot) fails hostname verification

A hostname written as an absolute FQDN (e.g. mariadb.database.svc.cluster.local. ) is valid DNS syntax and resolves normally, but mysql->host is passed unchanged to both TLS uses of the name:

• SSL_set_tlsext_host_name(ssl, mysql->host) (libmariadb/secure/openssl.c:452). OpenSSL accepts it, so the trailing dot is sent in SNI, which RFC 6066 §3 forbids ("the hostname is represented as a byte string using ASCII encoding without a trailing dot").
• X509_check_host(cert, mysql->host, ...) (libmariadb/secure/openssl.c:818) returns 0 for host.example.com. against a certificate with SAN dNSName=host.example.com, so the connection is rejected when ssl_verify_server_cert is enabled (verified with OpenSSL 3.5.5).

The GnuTLS backend fails the same way: gnutls_x509_crt_check_hostname2() (libmariadb/secure/gnutls.c:1512) IDNA-maps the name with the dot included and string-compares it. Schannel is unverified.

The trailing dot is a DNS root-label marker, not part of the identity, and certificates never carry it. It must be kept for name resolution ( in Kubernetes it is a documented way to skip the search/ndots list ) and removed for SNI and certificate matching.

Same issue as CONJ-1336 in Connector/J.