reverse-proxy: T6419: build full CA chain when verifying backend server (backport #3546)

[mergify]

Change Summary

Using a CA with intermediate to verify a backend service

set load-balancing reverse-proxy backend nextcloud ssl ca-certificate 'CAcert_Class_3_Root'`
set pki ca CAcert_Class_3_Root certificate 'MIIGPTCCBCWg...'
set pki ca CAcert_Signing_Authority certificate 'MIIG7jCCBNagAwIBAgIBDzANB...'

One will see that the rendered ceritficate used inside haproxy.conf

# Backend
backend nextcloud
    balance roundrobin
    option forwardfor
    http-request set-header X-Forwarded-Port %[dst_port]
    http-request add-header X-Forwarded-Proto https if { ssl_fc }
    server lnx03 172.16.36.40:443 ssl ca-file /run/haproxy/CAcert_Class_3_Root.pem

vyos@vyos# cat  /run/haproxy/CAcert_Class_3_Root.pem
-----BEGIN CERTIFICATE-----
MIIGPTCCBCWgAwIBAgIDFOIoM...
-----END CERTIFICATE-----[edit]

does not contain the full CA chain path, as only one of the two certificates is added into the file.

This PR calculates the CA chain and adds all required certificates to the resulting file

After this PR the file looks like:

vyos@vyos# cat /run/haproxy/CAcert_Class_3_Root.pem
-----BEGIN CERTIFICATE-----
MIIGPTCCBCWgAwIB...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIG7jCCBNagAwIBAg...
-----END CERTIFICATE-----

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T6419

Related PR(s)

Component(s) name

reverse-proxy

Proposed changes

How to test

Smoketest result

$ /usr/libexec/vyos/tests/smoke/cli/test_load-balancing_reverse-proxy.py
test_01_lb_reverse_proxy_domain (__main__.TestLoadBalancingReverseProxy.test_01_lb_reverse_proxy_domain) ... ok
test_02_lb_reverse_proxy_cert_not_exists (__main__.TestLoadBalancingReverseProxy.test_02_lb_reverse_proxy_cert_not_exists) ... ok
test_03_lb_reverse_proxy_ca_not_exists (__main__.TestLoadBalancingReverseProxy.test_03_lb_reverse_proxy_ca_not_exists) ... ok
test_04_lb_reverse_proxy_backend_ssl_no_verify (__main__.TestLoadBalancingReverseProxy.test_04_lb_reverse_proxy_backend_ssl_no_verify) ... ok
test_05_lb_reverse_proxy_backend_http_check (__main__.TestLoadBalancingReverseProxy.test_05_lb_reverse_proxy_backend_http_check) ... ok
test_06_lb_reverse_proxy_tcp_mode (__main__.TestLoadBalancingReverseProxy.test_06_lb_reverse_proxy_tcp_mode) ... ok
test_07_lb_reverse_proxy_http_response_headers (__main__.TestLoadBalancingReverseProxy.test_07_lb_reverse_proxy_http_response_headers) ... ok

----------------------------------------------------------------------
Ran 7 tests in 41.120s

OK

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

---

This is an automatic backport of pull request #3546 done by [Mergify](https://mergify.com).