Self-signed SSL certificate handling

[kontsevoy]

Teleport appears to be handling self-signed certificates differently based on how you start it. (or maybe it's a user error).

Scenario 1

1. Wipe out /var/lib/teleport
2. Start teleport start without a config file.
3. It will create a self-signed certificate/key pair (/var/lib/teleport/webproxy_cert.pem and /var/lib/teleport/webproxy_key.pem)
4. It will work, i.e. teleport start will run.

Scenario 2

1. The same
2. Start teleport start with a config file: teleport start -c proxy-conf.yaml, which looks like this :

# proxy-conf.yaml
proxy_service:
  enabled: "yes"
  https_key_file: /var/lib/teleport/webproxy_key.pem
  https_cert_file: /var/lib/teleport/webproxy_cert.pem

These are basically the default values, i.e. the same thing which teleport should default to when no configuration file is present.

You will get this:

unable to verify HTTPS certificate chain in /var/lib/teleport/webproxy_cert.pem: WARNING:

  The proxy you are connecting to has presented a certificate signed by a
  unknown authority. This is most likely due to either being presented
  with a self-signed certificate or the certificate was truly signed by an
  authority not known to the client.

  If you know the certificate is self-signed and would like to ignore this
  error use the --insecure flag.

  If you have your own certificate authority that you would like to use to
  validate the certificate chain presented by the proxy, set the
  SSL_CERT_FILE and SSL_CERT_DIR environment variables respectively and try
  again.

  If you think something malicious may be occurring, contact your Teleport
  system administrator to resolve this issue.

Minor issue: formatting of the error (shall we place WARNING on a new line?)
Major issue: why isn't it starting? how do I start it?

[moritzdietz]

@kontsevoy Yup that's exactly what I am seeing on my system. It doesn't help trying to start teleport with the --insecure flag; I still get that error message.

moritz@vps:~$ sudo teleport start --insecure --config=/etc/teleport/teleport.yaml
unable to verify HTTPS certificate chain in /var/lib/teleport/webproxy_cert.pem: x509: certificate signed by unknown authority
moritz@vps:~$

Now I am left with a system it won't start from again. If this isn't reproducible let me know :-)