Unseal fails with self-signed cert

[cookandy]

Hello,

It seems vault-gatekeeper fails to unseal correctly if the certificate is self-signed.

vault-gatekeeper unseal approle --auth-app-role $ROLE_ID --auth-app-secret $SECRET_ID --gatekeeper-addr https://localhost:9201
INFO[2019-09-03T22:37:43Z] Unsealing gatekeeper at https://localhost:9201
FATA[2019-09-03T22:37:44Z] Error communicating with gatekeeper: Post https://localhost:9201/unseal: x509: certificate is valid for *.service.consul, not localhost

I didn't see any option to bypass this

Usage:
  gatekeeper unseal [method] [flags]

Flags:
      --gatekeeper-addr string      The address to gatekeeper. (default "http://localhost:9201")
      --vault-token string          Unseal gatekeeper at startup with a Vault token. (default "8809671b-9701-867e-eb29-22a6ac69795d")
      --auth-token-wrapped string   Unseal gatekeeper at startup with a Vault token that is stored with a response wrapped temp token.
      --auth-app-role string        Unseal gatekeeper at startup with a Vault token retrieved using this app role.
      --auth-app-secret string      The app role secret_id to be used.
      --auth-aws-ec2                Unseal gatekeeper at startup using EC2 login.
      --auth-aws-iam string         Unseal gatekeeper at startup using IAM login.
      --auth-aws-nonce string       AWS-EC2 nonce for repeated authentication.
      --auth-gh-token string        Vault authorized github personal token.
  -h, --help                        help for unseal

Is it possible to add a --skip-tls-verify or similar option to unseal?

[nemosupremo]

Do you mean that Vault's certificate is self-signed?

Edit: Actually I understand now. When the unseal CLI tool talks to gatekeeper, and gatekeeper's cert in self-signed, you get this error and you need a --skip-tls-verify flag to fix it.

[nemosupremo]

I've added a fix; I'll close this issue out when I create a new release.

[nemosupremo]

Also, you could just unseal with curl

$ curl --insecure -X POST -H "Content-Type: application/json" -d'{"method":"approle", "role_id":"foo", "secret_id":"bar"}' https://localhost:9201/unseal