client.py:obtain_certificate_from_csr should ensure that a chain is returned or cause certbot to fail

[ohemorange]

It should not successfully return a certificate without its chain. We can do this by retrying acme.fetch_chain once, then telling the user to rerun with the path to where we saved the cert after fixing the network.

This is bad because if we only tell users about the cert, they won't know to also get the chain and concat the files to make the fullchain, and they'll accidentally use the cert file, which causes that weird failure mode in modern browsers.

[ohemorange]

See https://github.com/certbot/certbot/blob/master/certbot/client.py#L245.

The problem is that there are two network calls, acme.request_issuance and acme.fetch_chain. If the first one succeeds but the second one fails, we should in some way make sure the second call is retried rather than failing silently. This could be addressed by some combination of waiting, retrying, informing the user, and waiting for user input.

[ohemorange]

One possible way to address this is demonstrated in #4113.

[dhuang]

Working on this.