The only actual code change here is moving setting the server/user/pass
variables down until just before they're needed.

Move all the function calls out from inside if blocks where they're
hiding, test for error afterwards, and jump to the done label if there
was an error.  This is just to make the flow of what's actually
happening easier to follow.

Note that the gnutls docs mention that larger logging levels (like 10
that we are using here) can potentially reveal sensitive information.
However, what we are doing here should be okay because it would require
the administrator to enable pacemaker logging at the debugging level and
if that's happening, they are probably trying to debug a problem that
could be helped by the increased gnutls logging.

This function just checks whether all the environment variables needed
to support x509 encryption are set or not.  Typically, they'll be set in
the sysconfig file.

No other changes for the moment - just allow taking this type and print
it out in the error message.

This just handles everything that needs to be done during initial setup,
before a remote connects and performs the handshake.  Log error messages
if they occur - there's plenty of opportunities for things to fail here.

Ref T365

...from the client.  Because we can only require an older version of
gnutls, we have to manually set up a verification callback function.
Once we can require a later version (see the patch), we can get rid of
most of this code and have gnutls automatically verify the cert.

Ref T365

…tions.

Ref T365

We can only check a cert once the gnutls handshake has finished.
However once that happens, the server and client can both grab their own
certificate and see if it's within a month of expiration.  If so, log
that as a warning.

This does not explain how to set up your own CA, public/private key
pairs, etc.  That seems beyond the scope of pacemaker documentation.