[BUG] http.query does not validate URI to Subject Alternative Name in certificate SSL verification

Description

http.query does not validate URI to Subject Alternative Name in certificate SSL verification

Setup

Certificate generated with CN but no SANs.
Certificate is attached to an HTTPS configured web server using TLSv1.2

Steps to Reproduce the behavior

Run http.query with the URI as the IP address rather than the CN. method is POST, and data is given. Backend is: tornado

salt 'minion' http.query https://10.10.10.10/..... method=POST data='{.....}'

Expected behavior

I am expecting, similar to curl, the URI used to be invalid with regard the certificate, and an error would be returned.

Versions Report

Salt Version:
           Salt: 3001.1

Dependency Versions:
           cffi: 1.14.3
       cherrypy: unknown
       dateutil: 2.7.3
      docker-py: Not Installed
          gitdb: 2.0.6
      gitpython: 3.0.7
         Jinja2: 2.11.2
        libgit2: 1.0.0
       M2Crypto: 0.36.0
           Mako: 1.1.0
   msgpack-pure: Not Installed
 msgpack-python: 1.0.0
   mysql-python: 1.4.4
      pycparser: 2.20
       pycrypto: Not Installed
   pycryptodome: 3.9.8
         pygit2: 1.2.1
         Python: 3.8.5 (default, Jul 28 2020, 12:59:40)
   python-gnupg: 0.4.5
         PyYAML: 5.3.1
          PyZMQ: 19.0.2
          smmap: 2.0.5
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.3.2

System Versions:
           dist: ubuntu 20.04 focal
         locale: utf-8
        machine: x86_64
        release: 4.15.0-111-generic
         system: Linux
        version: Ubuntu 20.04 focal

Additional context

To verify, some SSL validation is being performed. If the CAs are missing on the Minion server, the following is returned by the http.query :

[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)

This is by-passed with adding verify_ssl=False.

Start by tracing the http.query HTTPS path using the Tornado backend and reproduce the request with a certificate that has a CN but no SANs. Compare the result with the expected curl behavior; done means an IP-to-SAN mismatch returns a certificate verification error while normal CA verification continues to work.