protocol should default to tls if security is set

If there is nothing that speaks against that I would file a PR for this.

Should I only do this if encryption is required by the security object?

Another question: does it make sense to add a feature to automatically generate certificates for worker, scheduler and client in the jobque case?

Currently you will get an runtime error: RuntimeError: encryption required by Dask configuration, refusing communication from/to 'tcp://'

(Actually I then accidentially set tls via the scheduler options which made things worse: the workers silently failed to connect)

[jacobtomlinson]

I think only supporting file certificates in dask-jobqueue would be reasonable. In places like dask-cloudprovider we are limited to passing the certs in the Dask config because we can’t guarantee there will be a shared filesystem. But for HPC I think most cases there will be one.

[riedel]

I commented on why I did this in #520, because one could actually close this issue by only supporting file certificates in the first place. TL;DR: I think using dask.config.set alternatively could have an bigger impact than creating some tempfiles, but maybe I am not completely getting the trick here.