Allow HTTP requests to insecure servers

With SYSTEM_HTTP_CLIENT_TSL_INSECURE we reconfigure DefaultTransport and allow requests to insecure
hosts. This has direct effect on OIDC autodiscovery.

internal/config/http.go

@@ -13,6 +13,8 @@ type (
 		Tracing bool
 		Metrics bool
 
+		ClientTSLInsecure bool
+
 		MetricsUsername, MetricsPassword string
 	}
 )
@@ -50,6 +52,8 @@ func (*HTTP) Init(prefix ...string) *HTTP {
 	flag.BoolVar(&http.Pretty, p("http-pretty-json"), false, "Prettify returned JSON output")
 	flag.BoolVar(&http.Tracing, p("http-error-tracing"), false, "Return error stack frame")
 
+	flag.BoolVar(&http.ClientTSLInsecure, p("http-client-tsl-insecure"), false, "Skip insecure TSL verification on outbound HTTP requests (allow invalid/self-signed certificates)")
+
 	flag.BoolVar(&http.Metrics, "metrics", false, "Provide metrics export for prometheus")
 	flag.StringVar(&http.MetricsUsername, "metrics-username", "metrics", "Provide metrics export for prometheus")
 	flag.StringVar(&http.MetricsPassword, "metrics-password", "", "Provide metrics export for prometheus")

system/start.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
 	"net/http"
@@ -34,6 +35,19 @@ func Init(ctx context.Context) (err error) {
 		return
 	}
 
+	if flags.http.ClientTSLInsecure {
+		// This will allow HTTPS requests to insecure hosts (expired, wrong host, self signed, untrusted root...)
+		// With this enabled, features like OIDC auto-discovery should work on any of examples found on badssl.com.
+		//
+		// With SYSTEM_HTTP_CLIENT_TSL_INSECURE=0 (default) next command returns 404 error (expected)
+		// > ./system-cli external-auth auto-discovery foo-tsl-1 https://expired.badssl.com/
+		//
+		// Without SYSTEM_HTTP_CLIENT_TSL_INSECURE=1 next command returns "x509: certificate has expired or is not yet valid"
+		// > ./system-cli external-auth auto-discovery foo-tsl-1 https://expired.badssl.com/
+		//
+		http.DefaultTransport.(*http.Transport).TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	}
+
 	// configure resputil options
 	resputil.SetConfig(resputil.Options{
 		Pretty: flags.http.Pretty,