Turn off TLS by default and add option to turn it on

[greg-szabo]

Summary of Bug

Self-signed certificates are making people believe that the communication is secure. That is not the case.

In dev cases, self-signed certificates are a good way to mock security so the developer can see how things will work together. But in any decent prod scenario, those certificates need to be replaced with trusted certificates. (Customer will not trust your self-signed certificate.) And in our case, devs don't need TLS in dev scenarios.

To top that, in any decent prod scenario, header checks, CORS settings and other juicy HTTP-based protocols will be implemented that gaiacli lacks. So, the --insecure flag will be used by default and an additional TLS layer of infrastructure will be built on top of it. (nginx, ELB or other solutions). Those solutions have the option to automatically maintain the certificates too (Let's Encrypt, ACM, etc) while gaiacli cannot provide that either.

With all that said, the self-signed certificates and TLS in gaiacli turns out to have more disadvantages than benefits.

Don't get me wrong, I also hate to throw away code. So as a compromise, I propose we set gaiacli to HTTP by default and add a --tls flag (or --secure or whatever) instead to turn on TLS.

Steps to Reproduce

gaiacli --insecure -> gaiacli --tls

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned