Need to create certificates signed by a generated CA

[MikaelSmith]

This is primarily a requirement to work around openssl/openssl#1418. All current OpenSSL releases won't verify certificates when provided a self-signed certificate. It will only accept a self-signed certificate if the verifying certificate includes the KeyCertSign bit in KeyUsage. The simplest way to work around this is first generate a CA cert/key pair, then use that to generate a certificate. The application that needs to trust the generated certificate can verify against the generated CA certificate.

This can be approximately accomplished with

repl{{$ca := genCA "ca" 365}}repl{{$cert := genSignedCert "host" nil nil 365 $ca}}repl{{cat ($ca.Cert | b64enc) ($cert.Cert | b64enc) ($cert.Key | b64enc)}}

and then using split and indexing to access individual entries. However using this in a Config reliably is again difficult because you either regenerate it every time the config is evaluated (producing a different certificate), or generate it once and never change it (so the certs can't depend on other config inputs).

I'd like to have an equivalent of TLSCert/TLSKey that caches the generated certs and can access them again by name. This provides sufficient longevity to make them useful as an easy onboard tool.