The following two commands succeed without any additional arguments:

% cockroach connect --single-node
% cockroach start-single-node

Then after issuing the following command, which was recommended by the output of connect:

% ./cockroach cert create-client root --ca-key=~/.cockroach-certs/ca-client.key

invocation of cockroach sql without argument fails:

% ./cockroach sql
[...]
ERROR: x509: certificate is valid for kenax, not localhost
Failed running "sql"

This is because of a design mismatch:

• connect and start commands use the "hostname" of the machine
• sql and other client commands default to localhost
• connect command does not populate localhost into the cert unless requested explicitly

What to do about this?

cc @aaron-crl @itsbilal

Part of #60632

Jira issue: CRDB-6274
Epic: CRDB-6663