Signer discovery fails against orchestrators with self-signed certificates #2

The signer drops orchestrators that serve self-signed certificates, which stock orchestrators do. GET /discover-orchestrators verifies each orchestrator's certificate against the system trust store, and the signer has no option to accept anything else. Today an operator has to fetch each orchestrator's certificate and add it to the trust store (for example through SSL_CERT_DIR), then repeat that whenever the certificate rotates.

The change in NE-Build-Track/node@ebff260 goes further than discovery

NE-Build-Track/node@ebff260 adds InsecureSkipVerify. It fixes discovery, but it turns verification off for every outbound connection:

• the authorization webhook, which decides whether the signer may spend;
• Ethereum RPC, which reports the payer's deposit and reserve;
• Kafka, which carries signed-ticket events.

The operator controls those three endpoints, so they can present trusted certificates. Without verification, anyone who can intercept the webhook could approve spending, and anyone who can intercept RPC could report false balances.

Proposal

Apply the opt-out to orchestrator discovery only. That is the one place the signer contacts orchestrators. Per-orchestrator certificate pins would also work.

Related

The SDK has a matching change for its own connections: livepeer/livepeer-python-gateway#73.