inputs.x509_cert: Reset c.tlsCfg.ServerName between certs. Without

this multiple remote sources (sources = [ "tcp://remote1.example.org:443",
"tcp://remote2.example.org:443" ]) reuse first SNI. Telegraf will
request wrong certificate and can fail validation when SAN/SNI doesn't match.

plugins/inputs/x509_cert/x509_cert.go

@@ -125,6 +125,9 @@ func (c *X509Cert) getCert(u *url.URL, timeout time.Duration) ([]*x509.Certifica
 		conn := tls.Client(ipConn, c.tlsCfg)
 		defer conn.Close()
 
+		// reset SNI between requests
+		defer func() { c.tlsCfg.ServerName = "" }()
+
 		hsErr := conn.Handshake()
 		if hsErr != nil {
 			return nil, hsErr
@@ -311,6 +314,14 @@ func (c *X509Cert) Init() error {
 		tlsCfg = &tls.Config{}
 	}
 
+	if tlsCfg.ServerName != "" && c.ServerName == "" {
+		// Save SNI from tlsCfg.ServerName to c.ServerName and reset tlsCfg.ServerName.
+		// We need to reset c.tlsCfg.ServerName for each certificate when there's
+		// no explicit SNI (c.tlsCfg.ServerName or c.ServerName) otherwise we'll always (re)use
+		// first uri HostName for all certs (see issue 8914)
+		c.ServerName = tlsCfg.ServerName
+		tlsCfg.ServerName = ""
+	}
 	c.tlsCfg = tlsCfg
 
 	return nil