The controller's CA cert is invalid and missing SANs and CN is invalid

When the controller charm is related to e.g. Opentelemetry Collector, it provides its ca cert through relation data so that the collector can scrape the controller's metrics on port 17010 at /introspection/metrics.

The scrape job tells us to scrape over unit IP, however, the cert does not have a SAN IP. Also, the SAN DNS is also missing and the CN is technically invalid. This means that the collector has to do skip_insecure_verify to scrape.

This is the result of looking at the cert with openssl

Certificate:
  Data:
          Version: 3 (0x2)
          Serial Number:
              31:d3:da:eb:54:a3:01:fa:10:6e:fa:3b:df:e6:bc:c1:c0:cb:01:00
          Signature Algorithm: sha256WithRSAEncryption
          Issuer: O = Juju, CN = juju-ca
          Validity
              Not Before: Jul  2 13:47:34 2025 GMT
              Not After : Jul  2 13:52:34 2035 GMT
          Subject: O = Juju, CN = juju-ca
          Subject Public Key Info:
              Public Key Algorithm: rsaEncryption
                  Public-Key: (3072 bit)
                  Modulus:
                      ...
                  Exponent: 65537 (0x10001)
          X509v3 extensions:
              X509v3 Key Usage: critical
                  Digital Signature, Key Encipherment, Certificate Sign
              X509v3 Basic Constraints: critical
                  CA:TRUE
              X509v3 Subject Key Identifier: 
                  58:94:AC:C5:B8:DB:9F:2A:7F:B1:FC:D8:D9:63:00:65:B1:1F:B8:F2

Related Issues:

• https://github.com/canonical/tls-certificates-interface/issues/369
• https://github.com/canonical/opentelemetry-collector-k8s-operator/issues/132

Start by tracing how the controller charm generates its CA certificate and publishes it through relation data, then inspect the certificate with openssl as shown in the issue. Done means the certificate includes SAN entries for the unit IP and DNS name, uses a valid CN, and lets the collector scrape /introspection/metrics without skip_insecure_verify.