from irc:
the cluster should be able to generate SSL certs (invoke openssl I guess) for internode comms as well as act as a certificate authority to generate certs for client access.
the end goal would be to allow people to set up a cockroach cluster without having to understand any of that stuff, but for larger orgs, they can specify configuration more particularly