使用外置etcd开启tls和认证后，启动报错

我使用cfssl建立了证书：
```
echo '{"CN":"CA","key":{"algo":"rsa","size":2048}}' | cfssl gencert -initca - | cfssljson -bare ca -
echo '{"signing":{"default":{"expiry":"876000h","usages":["signing","key encipherment","server auth","client auth"]}}}' > ca-config.json
export ADDRESS=xxx-vapp-2012,172.16.20.12,127.0.0.1
export NAME=etcd-server
echo '{"CN":"'$NAME'","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -config=ca-config.json -ca=ca.pem -ca-key=ca-key.pem -hostname="$ADDRESS" - | cfssljson -bare $NAME
export ADDRESS=xxx-app-38,xxx-app-39,xxx-app-50,xxx-vapp-2012,172.16.1.38,172.16.1.39,172.16.1.50,172.16.20.12,127.0.0.1
export NAME=etcd-client
echo '{"CN":"'$NAME'","hosts":[""],"key":{"algo":"rsa","size":2048}}' | cfssl gencert -config=ca-config.json -ca=ca.pem -ca-key=ca-key.pem -hostname="$ADDRESS" - | cfssljson -bare $NAME
```
启动etcd后自测正常：
```
[root@xxx-app-38 apisix]# etcdctl --user=root --password='xxx' --cert /opt/apisix/ssl/etcd-client.pem --key /opt/apisix/ssl/etcd-client-key.pem --cacert /opt/apisix/ssl/ca.pem --endpoints="https://172.16.20.12:2379" auth status
Authentication Status: true
AuthRevision: 8
```
我在apisix的.values.yaml配置了：
```
# -- external etcd configuration. If etcd.enabled is false, these configuration will be used.
externalEtcd:
# -- if etcd.enabled is false, use external etcd, support multiple address, if your etcd cluster enables TLS, please use https scheme, e.g. https://127.0.0.1:2379.
host:
# host or ip e.g. http://172.20.128.89:2379
- https://172.16.20.12:2379
# -- if etcd.enabled is false, user for external etcd. Set empty to disable authentication
user: root
# -- if etcd.enabled is true, use etcd.auth.rbac.rootPassword instead.
# -- if etcd.enabled is false and externalEtcd.existingSecret is not empty, the password should store in the corresponding secret
# -- if etcd.enabled is false and externalEtcd.existingSecret is empty, externalEtcd.password is the passsword for external etcd.
password: ""
# -- if externalEtcd.existingSecret is the name of secret containing the external etcd password
existingSecret: "apisix-etcd-cert"
# -- externalEtcd.secretPasswordKey Key inside the secret containing the external etcd password
secretPasswordKey: "etcd-root-password"
tls:
enable: true
verify: true
caFilename: "ca.crt"
certFilename: "tls.crt"
certKeyFilename: "tls.key"
sni: "xxx-vapp-2012"
```
并创建了apisix-etcd-cert：
```
kubectl -n apisix create secret generic apisix-etcd-cert \
--from-literal=etcd-root-password='xxxxx' \
--from-file=ca.crt=/opt/apisix/ssl//ca.pem \
--from-file=tls.crt=/opt/apisix/ssl/etcd-client.pem \
--from-file=tls.key=/opt/apisix/ssl/etcd-client-key.pem
```
安装apisix后报错：
```
# helm --namespace apisix install apisix ./ -f values.yaml
NAME: apisix
LAST DEPLOYED: Wed Oct 16 17:45:06 2024
NAMESPACE: apisix
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
export NODE_PORT=$(kubectl get --namespace apisix -o jsonpath="{.spec.ports[0].nodePort}" services apisix-gateway)
export NODE_IP=$(kubectl get nodes --namespace apisix -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
[root@xxx-app-38 apisix]# kubectl -n apisix logs apisix-6b5d9b65d8-czjfp
/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init_etcd
request etcd endpoint 'https://172.16.20.12:2379/version' error, error loading private key (system lib)
all etcd nodes are unavailable
Warning! Request etcd endpoint 'https://172.16.20.12:2379/version' error, error loading private key ((null)), retry time=1
Warning! Request etcd endpoint 'https://172.16.20.12:2379/version' error, error loading private key (system lib), retry time=2
```
请问这是什么原因导致的，需要什么日志我都能提供！

Start with values.yaml and the chart templates that consume externalEtcd, then inspect the apisix.lua init_etcd startup path. Reproduce the configuration with the apisix-etcd-cert Secret and compare it with the working etcdctl command. Done means APISIX starts successfully and can reach the external etcd endpoint with TLS and authentication.

Written by the indexing model from the issue text.