Implement fingerprint-based certificate verification for self-signed
Implement fingerprint-based certificate verification for self-signed

LXD's certificates are usually self-signed which then requires the user
to pass the expected server certificate to verify= rather than just a
boolean.

On newer python releaes, this seems to be properly handled by requests
except for the SANs (URL) not lining up and needing to be disabled. But
on older systems, SSL fails when the self-signed certificate isn't
marked as a CA.

To get a working behavior everywhere, extract the fingerprint of the
expected certificate and use the assert_fingerprint mechanism to ensure
that we're talking to the correct server. Use SHA256 for certificate
hashing which should be plenty to avoid collisions.

Signed-off-by: Stéphane Graber <089afc6d81f66f1168a9849e15660feae286e024@ubuntu.com>

lxc/pylxd,lxc/pylxd