[ca] Include a signing profile for cross-signing CA certs externally

[cyli]

When we make an external CA request to cross-sign a certificate, include a particular signing profile that can be implemented by the external CA.

This way it will be easier for them to implement extra policies.

This is not urgent, but would be good to make this part of the input external CAs that interact with swarm should expect.

cc @diogomonica @aaronlehmann @jlhawn

[codecov]

Codecov Report

Merging #2212 into master will decrease coverage by 0.01%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master    #2212      +/-   ##
==========================================
- Coverage   60.24%   60.22%   -0.02%     
==========================================
  Files         124      124              
  Lines       20114    20115       +1     
==========================================
- Hits        12117    12114       -3     
- Misses       6639     6643       +4     
  Partials     1358     1358

[cyli]

Actually, this would be useful for folks running the default CFSSL server (such as me when I'm testing) and so would probably be good to include in 17.06.

In our sample external signing server, we run our own TLS server and write our own HTTP handler, which unmarshalls the signing request directly from JSON: https://github.com/docker/swarmkit/blob/master/ca/testutils/externalutils.go#L200

In the CFSSL server, the request is first unmarshalled to an intermediary object, which does not support the SignRequest.Extensions field. Without the extensions field, we cannot tell the server that we want this to be a CA other than by using the signing profile (and we may want to use the CA profile name instead, since a lot of folks may have that, as it's documented in https://github.com/cloudflare/cfssl/blob/master/doc/cmd/cfssl.txt#L184).

I'll submit a PR upstream to CFSSL to support the SignRequests.Extensions field in the intermediary object, but it may be useful to include the profile name in the sign request as well in case people are using a pinned version that wouldn't have that change (if it gets accepted), since the intermediary object does support the profile name.

[diogomonica]

we don't need crl sign, but there is nothing wrong with including it.