Update Vault CA provider to apply full cert chain

[krarey]

Modifies the Vault CA provider for Consul Connect to apply the complete CA chain to generated certificates. More information in issue #11448.

[acpana]

Thanks for putting this out @krarey -- it overall LGTM! Would you mind adding some specific tests that tests for a cert chain presence?

---

Also, to err on the side of over caution, do we think such a change could break any practitioner workflows? As in, say folks are looking for just one cert and now receive more than one?

[krarey]

Thanks @FFMMM!

Would you mind adding some specific tests that tests for a cert chain presence?

I think I need more detail on what you have in mind. Are you thinking a test that actually parses the returned certificate chain and makes sure each issuer cert is provided in the expected order? If so, that may make more sense at a higher level, when the respective Sign() call is made against any of the Built-in/Vault/ACM engines. If something else, let me know, I'm happy to flesh out the validation logic a bit more.

Also, to err on the side of over caution, do we think such a change could break any practitioner workflows? As in, say folks are looking for just one cert and now receive more than one?

I don't think this should have any impact – the existing code was already attaching the issuer CA, and in most cases (root + consul-managed intermediate), this patch will result in an identical chain. In this case we are just ensuring any additional subordinate CAs are also added, should they be available and properly configured on the issuing Vault intermediate (if the subordinate CAs haven't been attached to the intermediate ca_chain in Vault, the result would again be the same as before, leaf cert + issuing CA). That said, I haven't worked extensively on TLS code prior, so would absolutely invite another opinion!

[dnephin]

I noticed CI has not run (verify-ci is "waiting for status"), which is usually a github permissions problem. We'll need to get that sorted out.

[krarey]

Currently held while we work through changes to the secondary DC intermediate signing flow.

[github-actions]

This pull request has been automatically flagged for inactivity because it has not been acted upon in the last 60 days. It will be closed if no new activity occurs in the next 30 days. Please feel free to re-open to resurrect the change if you feel this has happened by mistake. Thank you for your contributions.

[dnephin]

This ended up requiring a few bug fixes, and a few more changes to the vault provider. Existing releases of vault have this bug hashicorp/vault#13489, which meant using ca_chain directly was not always possible. Those changes can be seen in #11910.

Thanks for getting us started and pointed in the right direction @krarey! I'm going to close this PR since it is replaced by #11910.