Certificates for double proxy (mTLS)

*Title*: Certificates for double proxy (mTLS)

*Description*:

The envoy [docs](https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/double-proxy) has an example of running double proxy using Envoy for postgres. However, the docs does not cover which certificate is to be used where. The guide generates 2 certificates with the same key. The [docker-compose](https://github.com/envoyproxy/envoy/blob/main/examples/double-proxy/docker-compose.yaml) file in the repo refers to the certificates in a different name, making it not clear on which certificate to use on which machine(container).

A section to clarify that in the guide would be helpful.

I am following the same guide and have generated certificates for AWS EC2's internal DNS name. However I get the error `TLS error: 268435581:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED` on the client side and `TLS error: 268436502:SSL routines:OPENSSL_internal:SSLV3_ALERT_CERTIFICATE_UNKNOWN` on the server side.

Server Envoy TLS config section -
```yaml
transport_socket:
name: envoy.transport_sockets.tls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
require_client_certificate: true
common_tls_context:
validation_context:
trusted_ca:
filename: /home/ubuntu/certs/ca.crt
tls_certificates:
- certificate_chain: { filename: "/home/ubuntu/certs/ip-10-0-101-153.ap-south-1.compute.internal.crt" } # ip-10-0-101-153 is the IP of the server machine
private_key: { filename: "/home/ubuntu/certs/ap-south-1.compute.internal.key" }
```

Client Envoy TLS config section -
```yaml
transport_socket:
name: envoy.transport_sockets.tls
typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
common_tls_context:
tls_certificates:
- certificate_chain:
filename: /home/ubuntu/certs/ip-10-0-101-74.ap-south-1.compute.internal.crt # ip-10-0-101-74 is the IP of the client machine
private_key:
filename: /home/ubuntu/certs/ap-south-1.compute.internal.key
#tls_params:
#tls_minimum_protocol_version: TLSv1_2
#tls_maximum_protocol_version: TLSv1_2
validation_context:
match_subject_alt_names:
- exact: ip-10-0-101-74.ap-south-1.compute.amazonaws.com
trusted_ca:
filename: /home/ubuntu/certs/ca.crt
```

[optional *Relevant Links*:]
https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/double-proxy