Remote suite access documentation is inadequate.

[hjoliver]

To access a suite running under another user account, the CUG currently says you just need to install the suite passphrase in the right place: https://cylc.github.io/cylc/html/single/cug-html.html#12.6.1 (and that clients will automatically retrieve and install it if you have non-interactive ssh to the suite account).

In fact, additionally:

1. ssl.cert must be installed in the same place
2. if you do have non-interactive ssh to the suite account, clients will also use that to get the suite port from the contat file; otherwise the --port option is also required (after using cylc scan to find the port).

[hjoliver]

Also, even for "public" (no passphrase) access, the SSL certificate is now required (disregarding fallback to HTTP, which we'll remove - #2204)

[matthewrmshin]

Actually, the SSL certificate is not strictly required. It is required to ensure a secure connection (so the client can trust the server).

[matthewrmshin]

(Otherwise cylc scan of suites of other users would not work.)

[hjoliver]

Yeah, without the SSL cert I get InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. then it connects anyway. Should we not allow this?

[matthewrmshin]

We still need to sort this out somehow. If we can somehow have a root certificate (for generating per-suite certificates) accessible by all clients, then this should no longer be a problem, but I am not sure how to do this for a multi-user environment.

[hjoliver]

Actually, thanks to #2253 I only get the above warning if cylc < 7.4.0 is on the client end. I wonder if, in lieu of the root certificate solution, instead of filtering this warning we should abort - i.e. require users to have ssl.cert alongside passphrase (it's not much more onerous than passphrase alone)??

[matthewrmshin]

... require users to have ssl.cert alongside passphrase ...

This will not work for cylc scan (of other suite owners), but I suppose we can treat cylc scan as a special case.