Improve Subject Name handling for Conjur CA certificates

[micahlee]

Closes #705
Closes #707

What does this pull request do?

This PR updates the Conjur CA certificates in 2 ways:

1. The Common Name on the certificate is now given directly from the authenticated role (must be host), and not from the CSR. The common name has the format <account>:<ca-service-id>:host:<host-id>. A DNS alternative name is added for the leaf (right-most) portion of the slash separate host identifier. This is to support the existing demo.

2. The certificate now includes a URI subject alternative name containing the SPIFFE Id for the role. This currently takes the form of spiffe://conjur/<account>/<ca-service-id>/host/<host-id>.

Where should the reviewer start?

The core changes are in app/domain/ca/certificate_authority.rb

How should this be manually tested?

The API cucumber tests include verification that these IDs are present and correct.

If you want to, you can use the demo (https://github.com/conjurdemos/misc-util/tree/master/demos/certificate-authority/mutual-tls) to generate a certificate. You can then use OpenSSL to view the contents to verify the subject names, e.g.:

openssl x509 -in certificate.crt -text -noout

Link to build in Jenkins (if appropriate)

https://jenkins.conjur.net/job/cyberark--conjur/job/ca_csr_subject/

Questions:

Does this have automated Cucumber tests?
Yes

Can we make a blog post, video, or animated GIF out of this?
Probably

Is this explained in documentation?
Not yet.

Does the knowledge base need an update?
No

[jvanderhoof]

This code looks solid, but I think we should hold on merging until we run the host name format by a customer or two. I worry it'll be too restrictive.

[jvanderhoof]

What do you think about pulling this out? I'm not sure I'd love to need to put conjur into my host naming convention, particularly if all hosts were managed by Conjur. Without it, organizations are free to set account, service_id, and host id as they see fit.

[micahlee]

I'm ok with that. I think we had settled on this because it roughly mirrored the SPIFFE ID, but there is no other reason I am aware of at this point. I will change it.

[codeclimate]

Code Climate has analyzed commit 70456e7 and detected 5 issues on this pull request.

Here's the issue category breakdown:

Category	Count
Complexity	5

View more on Code Climate.

[jvanderhoof]

Looks good!