Use CLI without pinning HTTPS certificate

[UberKitten]

Is your feature request related to a problem? Please describe.

In my company, Conjur is deployed as a central service by IT. The service uses globally trusted TLS certificates. These certificates are regularly updated by IT with no advance warning to me.

When Conjur's certificates are updated, the CLI refuses to connect to the Conjur server. I have to override the hard-coded certificate. This makes it difficult to use the CLI in automation workflows, scripts, and applications as they will fail often.

Describe the solution you would like

By default, the CLI should not pin HTTPS certificates. This matches how most of the Conjur tools work (all the SDKs, Jenkins plugin, probably others). This matches industry best practices. The existing behavior could be preserved behind an option to conjur init like --pin-cert.

This way, I can use the Conjur CLI from applications and scripts without having to worry about the command failing when certificates are replaced. This would also mean that when you run conjur init --force, there is no longer any user input needed. This matches the common usage of --force by most CLI tools.

Describe alternatives you have considered

Alternatively, the default behavior could remain, and an option like --no-pin-cert could be added to conjur init. This flag would also have to be represented in .conjurrc.

Additional context

Currently, the best way to use the Conjur CLI from a script or tool is to always run the following when starting:

rm ~/conjur-server.pem
yes | conjur init --url https://example.com --account example --force

This is kind of silly.

[UberKitten]

Notably, the default behavior I suggested can be achieved by editing .conjurrc and removing the cert_file: line. This behavior is already the default in one sense, but you can't choose this behavior through the CLI itself.