SSL

[liviuba]

Self-signed certificates cover most cases and leaves room for ssl termination in the EBI load balancer if needed

Also create a custom CA to avoid littering downstream code with ignoreCertificates=True

[liviuba]

Custom CA was finicky due to tools sometimes (but not always) ignoring the system CAs (on linux), e.g. curl installed with conda.

Explicitly pointing to the CA pem doesn't help because we break lots of public CA conventions (ip as CN for embassy machines).

Deployed selfsigned certs but not checking host keys for the moment. Parked until public release, since then we would need an ssl setup with public CAs anyway.