New x509 command

[jhunt]

Build a new command set, safe x509 for dealing with x509 PKI certificate stuff, without being constrained by the limitations of the pki backend in Vault.

This new command should allow us to issue new certificate authorities, storing the certificate and key somewhere under secret/, and also use those CAs (identified by path) to sign other certificates and store them in under other arbitrary paths under secret/.

We should allow the special cases of self-signed certificates and intermediary CAs.

The point of this new command is to expose as much raw functionality as possible for setting up complicated PKI implementations as possible. In part, this replaces safe {pki,cert,ca-pem,crl-pem,revoke} A future command will be introduced to provide a more simplified interaction for zone-based authority domains like those found in Cloud Foundry. That command will use backend logic that we build out for the x509 command (but not call front-end commands directly)

Example invocations:

# Issue a simple self-signed certificate
safe x509 issue secret/my/cert --name www.example.com

# Put some alias (Domain and IP SANs) in the self-signed cert
safe x509 issue secret/my/cert --name www.example.com --name example.com

# Create a Certificate Authority
safe x509 issue --ca secret/my/ca --ttl 10y

# Issue a 2-year certificate, signed by the CA we just created
safe x509 issue secret/my/cert --signed-by secret/my/ca --ttl 2y --name mail.example.com

# Revoke a certificate
safe x509 revoke secret/my/cert --signed-by secret/my/ca

For certificate authorities, the following attributes should be set on the CA path:

• certificate - PEM-encoded X.509 certificate
• key - PEM-encoded RSA secret key (un-encrypted)
• serial - Certificate serial number for this CA (used internally by safe x509)
• crl - PEM-encoded Certificate Revocation List for this CA

For non-CA certificates, the following attributes should be set on the certificate path:

• certificate - PEM-encoded X.509 certificate
• key - PEM-encoded RSA secret key (un-encrypted)