Currently, hostname verification cannot be disabled even when tls_hostname_verification_enabled is set to false, as long as allow_insecure_connection is also false.
https://github.com/streamnative/pulsar-rs/blob/master/src/connection.rs#L975-L977
Users should be able to disable hostname verification (tls_hostname_verification_enabled = false) independently of the allow_insecure_connection setting, matching the behavior of the official Pulsar clients.
According to the Pulsar TLS documentation:
By default, Pulsar clients disable hostname verification, as it requires that each broker has a DNS record and a unique cert.
The client disables allowInsecureConnection by default, and you should always disable allowInsecureConnection in production environments.