pki: T9135: preserve every certificate in an ACME chain, not just the first

certbot's chain.pem commonly holds more than one certificate - e.g. the
immediate intermediate plus its own issuing root - but the synthetic CA
entry built from it only ever kept the first, silently dropping the rest
before find_chain() ever saw them. This left a shorter chain than certbot
itself actually has, e.g. requiring a root to also be configured manually
to reach the same result certbot's own data already provides.

Parse every certificate block in chain.pem and emit one synthetic entry
per certificate, numbering entries after the first so each is still its
own addressable, non-redundant, non-settable object exactly like before.

1 files changed, 2 insertions, 4 deletions

diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py
index 91a83ea70..78b896edb 100755
--- a/src/op_mode/pki.py
+++ b/src/op_mode/pki.py
@@ -151,7 +151,6 @@ def get_config_ca_certificate(name=None):
     # object, but consumers (find_chain(), "show pki ca") should see it
     # the same way they'd see a manually-configured CA.
     from vyos.defaults import directories
-    from vyos.pki import AUTOCHAIN_PREFIX
     from vyos.pki import acme_chain_ca_entry
     from vyos.pki import acme_chain_redundant
     vyos_certbot_dir = directories['certbot']
@@ -167,9 +166,8 @@ def get_config_ca_certificate(name=None):
             continue
         if acme_chain_redundant(leaf_cert, real_ca_certs):
             continue
-        chain_entry = acme_chain_ca_entry(vyos_certbot_dir, cert_name)
-        if chain_entry:
-            autochain_name = f'{AUTOCHAIN_PREFIX}{cert_name}'
+        for autochain_name, chain_entry in acme_chain_ca_entry(
+                vyos_certbot_dir, cert_name).items():
             # A real, manually-configured CLI CA object with this name
             # wins over the synthetic one
             if autochain_name not in ca_certs: