It is telling you that your certificate at https://127.0.0.1:6443/api?timeout=32s is self signed, more or less. You'd need to go into whatever the trust store used by the service listening at 6443 and trust the self signed certificate "always"