When attempting to install and configure cert-manager in our private network, we get an error when the system attempts to create the issuer against a Venafi server. The error is: "local error: tls: no renegotiation"

In golang the http.Client will allow the Transport: to specify a TLSClientConfig: parameter to allow Renegotiation.

example:

           Transport: &http.Transport {
                          TLSClientConfig: &tls.Config{
                                          RootCAs: caCertPool,
                                          Renegotiation: tls.RenegotiationOnceAsClient,
                          },
            },
}
req, err := http.NewRequest(...

If there is an existing command line flag we can use to invoke this, please let us know. In looking at the source code in cert-manager, it appears that there are many places the http.Client object is created and altered, and even some outside the cert-manager project and in the Venafi "Vcert" project source code.

In our organization we have limited ability to affect the configuration of the Venafi server and we believe it may be running behind an IIS server. If we could resolve this within the cert-manager install that would be our most expedient method.

Best regards,
John Marx