make certificate verification work for self-signed certificate

[william-xiang]

The changes in this PR make sure it can get the correct content of certificate and trust it for secure connection.
The main change is trying to use certificate verification during TLS handshake as much as possible. There are four scenarios:

1. Self-signed certificate, should do the verification by trusting this certificate
2. Certificate signed by a publicly trusted CA, should do the verification using the well-known CA certificates provided by node
3. Certificate signed by a internal private CA, should do the verification by trusting the obtained root CA certificate
4. User has to make sure server certificate is configured correctly

[jonnyz32]

Do we need to add new tests for this?

[jonnyz32]

If we pass in the db2server.ca into the function, shouldn't the server get verified based on if it has that certificate? I'm not sure why rejectUnauthorized is not just True here

[william-xiang]

Ideally it should use that specified CA certificate to verify the server's certificate. But in scenario that server does not use a self-signed certificate and is not configured properly to send the full chain certificate during the handshake, the db2server.ca is just the server certificate. Since this certificate is not a self-signed, it cannot be verified by itself. That's the reason why rejectUnauthorized needs to be false for this scenario.

[william-xiang]

Do we need to add new tests for this?

We can keep using existing test cases unless we want to use the designated machines to test the getRootCerttificate part.

[jonnyz32]

Do we need to add new tests for this?

We can keep using existing test cases unless we want to use the designated machines to test the getRootCerttificate part.

I don't think we have any tests that the client will not connect if the certificate is invalid