TLS improvements (#90)

* Fix typo when passing arguments to tls.LoadX509KeyPair()

* Support TLS 1.2 too

* Do not require a controller to only present a single certificate

* No need to set ServerName since we use InsecureSkipVerify

* Use host's root CA set by default and support normal SNI scenarios

internal/command/controller/init.go

@@ -27,7 +27,7 @@ func FindControllerCertificate(dataDir *controller.DataDir) (controllerCert tls.
 		if err = checkBothCertAndKeyAreSpecified(); err != nil {
 			return controllerCert, err
 		}
-		return tls.LoadX509KeyPair(controllerCertPath, controllerCertPath)
+		return tls.LoadX509KeyPair(controllerCertPath, controllerKeyPath)
 	} else if !dataDir.ControllerCertificateExists() {
 		// otherwise, generate a self-signed certificate if it's not already present
 		controllerCert, err = GenerateSelfSignedControllerCertificate()

internal/command/controller/run.go

@@ -80,7 +80,7 @@ func runController(cmd *cobra.Command, args []string) (err error) {
 		controller.WithDataDir(dataDir),
 		controller.WithLogger(logger),
 		controller.WithTLSConfig(&tls.Config{
-			MinVersion: tls.VersionTLS13,
+			MinVersion: tls.VersionTLS12,
 			Certificates: []tls.Certificate{
 				controllerCert,
 			},