fix agent connection to proxy behind l7 lb

[greedy52]

fixes #48238

Integration test could not catch this since they run in insecure mode.

Also note that ALPNDialer does call GetClusterCAs on each dial so no need for the VerifyConnection hack:

teleport/api/client/alpn.go

Lines 126 to 131 in c1f368e

	// DialContext implements ContextDialer.
	func (d *ALPNDialer) DialContext(ctx context.Context, network, addr string) (net.Conn, error) {
	tlsConfig, err := d.getTLSConfig(ctx, addr)
	if err != nil {
	return nil, trace.Wrap(err)
	}

[aws-amplify-us-west-2]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-48242.d3pp5qlev8mo18.amplifyapp.com

[espadolini]

I think I missed this when I changed things to start using dynamic sources of trust, thank you for the fix!

Is it practical to change the tests to not rely on insecure mode?

[greedy52]

Is it practical to change the tests to not rely on insecure mode?

let me look into that

--- update
it's no easy task. all web clients cannot verify proxy. will leave it as a separate change.

[public-teleport-github-review-bot]

@greedy52 See the table below for backport results.

Branch	Result
branch/v17	Create PR