Document certificate generation and TLS verify

[stuclem]

Per #2197. No milestone yet.

[stuclem]

Requires update in both app dev and install, as there will be vic-machine create updates.

[stuclem]

#2197 is now in the ice box.

[stuclem]

#2197 is still in the ice box, but is fixed in PR #2553. Moving this to To Do.

[stuclem]

#2197 is fixed in PR #2629 (not merged) and #2553 (merged).

[stuclem]

vic-machine create now presents the following new options:

• --client-verification-ca
• --no-tlsverify
• --cname value

The following options appear if you specify --advanced-options:

• --certificate-key-size
• --organisation

[hickeng]

@stuclem FYI the --cname option will become --tls-cname in #2633 to make it more evident that it's grouped with --no-tls and --no-tlsverify

[stuclem]

#2629 was closed and split into multiple PRs:

• TLS aware liveliness check for API #2703
• Purge prior component launch status during upgrade #2706
• Clean and structure help output [full ci] #2707

[stuclem]

#2676 (env file) is related to the TLS implementation.

[stuclem]

From @hickeng via Slack:

George Hicken [7:20 PM]
If you're specifying a staticIP you can skip any tls options

Stuart Clements [7:25 PM]
I see. Maybe better not to mention that, if it's a transient state pending the arrival of the final implementation

George Hicken [7:26 PM]
nah, that should be there to stay.

Stuart Clements [7:26 PM]
ok, can add that as a note in the sections on static IP and TLS (edited)

George Hicken [7:26 PM]
That way you can do:
vic-machine create -client-network-ip=my-vch.eng.vmare.com --client-network-gateway=x.x.x.x/yy
and have it work appropriately

Stuart Clements [7:27 PM]
and then you don't need TLS?

George Hicken [7:27 PM]
My working assumption is that's the most likely usage scenario (is to have a DNS name for the client IP) so figured I'd make it easy

[7:28]
If you don't specify any TLS options in that scenario it's the same as saying --tls-cname=my-vch.eng.vmare.com (edited)

[stuclem]

Everything in this issue is done, although TLS still needs work.