future reference to anyone that has this issue:

openssl req \
       -newkey rsa:2048  -keyout server.key \
       -x509 -days 365 -out server.crt

fill out the garbage it asked for and the des password

cat server.crt > server.pem
cat server.key >> server.pem

then edit the config.ini in witness_data_dir

rpc-tls-endpoint = 0.0.0.0:9000 # or whatever ip and port you want
server-pem = server.pem
server-pem-password = putstupidpasswordhere

when you run the cli_wallet use

cli_wallet -a server.pem -s wss://ipaddress:9000

you are welcome

still if this shit was document somewhere i wouldn't have fought with it all day, just sayin...