Launcher does not launch with tls certs outside of interactive mode

[Micah-Kolide]

A customer reported that the curl table is acting up using select * from curl where url = 'https://app.kolide.com/health'; as an example, sometimes it works and sometimes it doesn't:

@directionless noted the following:

• LQ to haskell: fails
• osquery connect to the prod socket: Fails, Cannot read TLS server certificate(s): /var/osquery/certs/certs.pem"
• osquery command line: Fails, for many versions Cannot read TLS server certificate(s): /var/osquery/certs/certs.pem"
• launcher interactive: works
• osquery command line with --tls_server_certs /etc/ssl/cert.pem: works

The reason launcher interactive works is because it copies /etc/ssl/cert.pem into a tmp cert file for that session to use instead of the default osquery /var/osquery/certs/certs.pem. This ends up looking like: /tmp/launcher-interactive323414471/ca-certs-9dae8d76e55cb08991f2b672d58999ea15560d910759c16b544f843bdffbb994.crt

The go file for this part is install_ca_certs.go

launcher/cmd/launcher/interactive.go

Line 83 in de3844e

certs, err := internal.InstallCaCerts(interactiveRootDir)

The daemons are not set with an explicit tls_server_cert, so it defaults to the /var/osquery/certs/certs.pem location. This is why the socket connections fail.

https://github.com/osquery/osquery/blob/97f03d106064635ac83f8337ba848c9216f19a90/osquery/utils/config/default_paths.h#L44-L51