Comment # 8 on bug 1219688 from Imobach Gonzalez Sosa

(In reply to Paolo Perego from comment #7)

[..]

> Ok well... interacting with the browser, using a valid certificate, not self
> signed. Interacting with a command line client, having the client validating
> all the root of trust of the certificate.

Well, bear in mind that you do not know the name or IP address the system will
use when running (after all, it is a live DVD). What we do these days in Agama
is to use a self-signed certificate (generated by Cockpit) and allow the user
to use his/her own certificate (specifying a URL to get the certificate as a
kernel cmdline option).

Not to mention than using a proper certificate would need you to distribute
such a certificate (including the private key) in the media.

Or perhaps the problem is that I am lost :-)

> eg:
> 
> > import requests
> > requests.post(url='https://foo.example', data={'bar':'baz'})
> 

[..]