[Story] Separate TLS keystore/truststore from host application about cryostat-agent HOT 2 OPEN

Another possibility: generate a certificate in advance, common to all Agent instances. The certificate's domain will be incorrect in this case so the Cryostat server's webclient will need to ignore host verification. This certificate would be bundled as a resource in the Agent JAR as well as included in the Cryostat server's default truststore. This way, the Agent instances can always present an HTTPS API and all data leaving the Agent can always be encrypted with this cert, and the Cryostat server can at least trust this certificate for its Agent webclients, even if it cannot verify the hostname. This way there is a zero-configuration setup that allows HTTPS to be always on for Cryostat<->Agent communications.

In the future this could be extended with a configurable setup that allows the user to supply their own cert as originally outlined at the top of this issue. The Operator could be in charge of supplying this cert to the Agent for it to use for its embedded HTTPS server, and to the Cryostat instance in its truststore. This would allow more granularity so that the certificate is common to all Agents within a given Namespace, rather than all Agent instances indiscriminately.

from cryostat-agent.

https://stackoverflow.com/questions/2308479/simple-java-https-server

from cryostat-agent.