Add Flag to disable cert check

[mkohn]

For some dev environments, a valid SSL cert might not be setup, it would be nice to be able to disable the Cert Validation Check to not get x509: certificate signed by unknown authority and terraform to fail.

[taiidani]

@mkohn Trying to clarify your use case a little further. Is there something pushing you to use self-signed certificates and HTTPS? There are a few secure ways outside of the app that I've typically seen followed in dev environments, such as trusting the cert in your client(s) or switching to a published port+http over the localhost loopback.

It's not impossible to disable the cert verification but given the security implications I'd love to have a use case to point to.

[mkohn]

@taiidani for our ephemeral dev Jenkins environments we are using self-signed certs but still leave the Jenkins service to only communicating over HTTPs. We are testing Terraform to provision and maintain our jenkins jobs.

[taiidani]

Hmm -- I'm still not following as to why you're not trusting the self-signed cert in your clients to avoid the MITM attack vulnerability, but I can see that starting out a dev environment you might want to begin with the [much] easier route of turning off certificate verification.

I'll tag this in for our 0.10 release 👍

[github-actions]

Stale issue message

[github-actions]

Stale issue message

[taiidani]

Having a hard time allocating free time to configure this and test it appropriately to ensure stability, but it's still a valid request. Reopening issue.

[github-actions]

Stale issue message

[AssafKatz3]

Any workaround for it?

[killmeplz]

I assume you can add your self signed cert into CA storage on a server where you apply terraform from.