Update CA Chain to report entire chain

[cipherboy]

This merges the ca_chain JSON field (of the /certs/ca_chain path) with
the regular certificate field, returning the root of trust always. This
also affects the non-JSON (raw) endpoints as well.

We return the default issuer's chain here, rather than all known issuers
(as that may not form a strict chain).

Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>

[stevendpclark]

Note: we will need to address the comment within the Vault documentation about this not returning the full chain and to use pki/cert/ca_chain ca_chain field https://www.vaultproject.io/api-docs/secret/pki#read-ca-certificate-chain

[cipherboy]

Yeah, that's a good point. There's a lot of docs that will need to be updated. :-)

Edit: Thanks Steve, merging!

[cipherboy]

This PR was merged in #15277. See that PR and the relevant docs PR #15238 for more information about this change.

[epieddy]

Hello, I'm using vault 1.11.0 and this is still not working : when I issue a certificat from an intermediate CA, the field ca_chain in the json response contains only the intermediate CA, not the root CA

[epieddy]

Hello, I'm using vault 1.11.0 and this is still not working : when I issue a certificat from an intermediate CA, the field ca_chain in the json response contains only the intermediate CA, not the root CA

My bad, you need to upload the full chain (intermediate CA + root CA) when you upload the signed intermediate CA with set-signed (#2075 (comment))

[cipherboy]

@epieddy As a note, you can generically import chain certificates now in Vault 1.11.0; see: https://www.vaultproject.io/api-docs/secret/pki#import-ca-certificates-and-keys