private CA cert, CA chain, Two-Way SSL

Hello,

We're working with GRR v3.3.0.4, installed on Ubuntu from the release debs.

And we are facing issues when dealing with some requirements during our deployments:

- First, we need to be able to use a private CA certificate (a chain actually) for HTTPS communication between the clients and the load-balancer/reverse proxy
- We also need client certificate authentication

For the custom CA, short of opening the zip templates to replace the cacert.pem bundled with certifi, it does not seem to be possible without modifying the code of the client builder.
Same issue with client certificate authentication, which is not implemented.

Are we missing something there?

Would be great to have a confirmation that we actually need to produce some code before starting the heavy lifting. Especially as we can already foresee some difficulties:

- with urllib/requests which support only path to files for client certificate authentication (so no trivial way to put that in the configuration)
- and the config module itself which, unless we're mistaken, will probably choke if we try to have more than one certificate in a single configuration entry, a certificate chain being usually the concatenation of a root CA and its (multiple) subCA ...

Thanks for your help!