add TLS to HTTP server about cockroach

[osguydch]

Can I implement this issue ?

[tbg]

Of course, please go ahead! Happy to have you on.

[kardianos]

No change needs to happen in "client". I don't think we need DialTLS.

I recommend:

• Continue to use the Certs directory but rather then using the node.{crt,key}, we use client.{crt.key}.
• Should the client connections and rpc connections share the ca.crt?
• Make a new package "util/tls" and move "rpc/tls.go" to the new package.
• Use the tls package in rpc and server.
• Parse the rpc and server certificates in Context.Init and store resulting TLS certificates in the Context.

Tests can generate a self signed certificate and add the trust to the client transport. Most tests will not need to populate the -Certs flag, but rather directly populate the Context certificates.

If someone can vet the above I can implement.

[bdarnell]

For now, yes, just make a client cert/key in the certs directory. I think the certs directory is going away at some point though. Same ca.crt for client and server. There's a flag that can be set in a certificate to indicate whether it is for client or server use; we should be setting that and rejecting certs that are being used in the wrong direction. The rest sounds good.

[mberhault]

done for now. All nodes and clients can talk SSL. Lots of details left (client certs, key rotation, different certs for nodes, etc...) but the basics are there.