Support own CA certificate / self-signed certificated for self-hosted installations

[corneliusludmann]

• Test what works and was not
• Write docs on how to use your own CA certificate
• Maybe add support to the installer if specific settings are needed
• Add support for CA in KOTS / Replicated installer

See also:

• [Self-Hosted] Support for own CA certificates #2615
• Support custom CA certificates in Helm #2984
• (internal)

[corneliusludmann]

Comment from @mrsimonemms (internal):

one thing that would make startup so much faster is if we didn't require a cert (or would allow a self-signed one). I did a little bit of exploration around this - we need to be able to turn off the HSTS headers emitted by proxy. That alone would allow us to run with self-signed ones

[csweichel]

If we could implement this without introducing too much variance (e.g. a special "custom CA cert" mode), that would be awesome! Those categorically variant modes don't age well (think "stage" as "prod" and "dev") :)

[mrsimonemms]

Agreed. My understanding is that we can get this working purely by allowing the HSTS headers in proxy to be configurable at deploy-time

[SirLemyDanger]

I saw (blocking) errors related to this:

1. registry facade (needs to connect to our gitlab container registry, which has a TLS cert signed by the company CA)
2. server (oauth towards gitlab, which has a TLS cert signed by the company CA)
3. ??? when opening a workspace