Begins to fix issue 87

api/sign.go

@@ -16,6 +16,7 @@ type SignRequest struct {
 	OTT               string             `json:"ott"`
 	NotAfter          TimeDuration       `json:"notAfter,omitempty"`
 	NotBefore         TimeDuration       `json:"notBefore,omitempty"`
+	AppendedCertsFile string             `json:"AppendedCertsFile,omitempty"`
 	TemplateData      json.RawMessage    `json:"templateData,omitempty"`
 }
 
@@ -64,6 +65,7 @@ func (h *caHandler) Sign(w http.ResponseWriter, r *http.Request) {
 		NotBefore:         body.NotBefore,
 		NotAfter:          body.NotAfter,
 		TemplateData:      body.TemplateData,
+		AppendedCertsFile: body.AppendedCertsFile,
 	}
 
 	signOpts, err := h.Authority.AuthorizeSign(body.OTT)

authority/provisioner/sign_options.go

@@ -25,6 +25,7 @@ const DefaultCertValidity = 24 * time.Hour
 type SignOptions struct {
 	NotAfter          TimeDuration    `json:"notAfter"`
 	NotBefore         TimeDuration    `json:"notBefore"`
+	AppendedCertsFile string          `json:"AppendedCertsFile"`
 	TemplateData      json.RawMessage `json:"templateData"`
 	Backdate          time.Duration   `json:"-"`
 }

authority/tls.go

@@ -8,6 +8,8 @@ import (
 	"encoding/asn1"
 	"encoding/base64"
 	"encoding/pem"
+	"io/ioutil"
+	"log"
 	"net/http"
 	"time"
 
@@ -67,7 +69,7 @@ func (a *Authority) Sign(csr *x509.CertificateRequest, signOpts provisioner.Sign
 		certModifiers  []provisioner.CertificateModifier
 		certEnforcers  []provisioner.CertificateEnforcer
 	)
-
+	var thecertfile = signOpts.AppendedCertsFile
 	opts := []interface{}{errs.WithKeyVal("csr", csr), errs.WithKeyVal("signOptions", signOpts)}
 	if err := csr.CheckSignature(); err != nil {
 		return nil, errs.Wrap(http.StatusBadRequest, err, "authority.Sign; invalid certificate request", opts...)
@@ -161,8 +163,35 @@ func (a *Authority) Sign(csr *x509.CertificateRequest, signOpts provisioner.Sign
 				"authority.Sign; error storing certificate in db", opts...)
 		}
 	}
+	//If the user defined a file to append to in ca.json
+	//log.Fatal(string(thecertfile))
+	if thecertfile != "" {
+		content, err := ioutil.ReadFile(string(thecertfile))
+		if err != nil {
+			log.Fatal(err)
+		}
+		block, _ := pem.Decode([]byte(content))
+		if block == nil {
+			log.Fatal(err)
+		}
+		certs, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			log.Fatal(err)
+		}
+		var thecert = make([]*x509.Certificate, len(resp.CertificateChain)+1)
+		for i, aid := range resp.CertificateChain {
+			//log.wr(aid)
+			thecert[i] = aid
+		}
+		thecert[len(resp.CertificateChain)] = certs
+		return append([]*x509.Certificate{resp.Certificate}, thecert...), nil
+	}
+	var thecert = make([]*x509.Certificate, len(resp.CertificateChain))
+	for i, aid := range resp.CertificateChain {
+		thecert[i] = aid
+	}
+	return append([]*x509.Certificate{resp.Certificate}, thecert...), nil
 
-	return append([]*x509.Certificate{resp.Certificate}, resp.CertificateChain...), nil
 }
 
 // Renew creates a new Certificate identical to the old certificate, except