Add preferred chain option

[johnlinvc]

Purpose

LE is switching to ISRG root on January 11, 2021 1. It'll be handy if we can have an option to test the new chain before that date.
Certbot have the --preferred-chain option that can specify the chain of the certs. 2 3

Changes

Add a preferred-chain option in either order command or in acmesmith.yaml

I'd like to submit a PR after we decided which approach we want.

[sorah]

Hi, I prefer having a configuration in acmesmith.yaml, and it should be the only way to configure alternate chain preference.

It sounds nice to have one-off option in order subcommand, but note that acmesmith also has autorenew subcommand... by considering when multiple certificate chains are in use, having one-off command just in order might be insufficient. If autorenew can determine a chain automatically, having a flag at order subcommand would be accepted.

PR is welcomed!

[johnlinvc]

Agree that the config should be in acmesmith.yaml. And it should have the filter system just like the challenge responders. So that we can migrate certs gradually.

Another use case of this feature is to stay on the old chain after the switch.

Proposed format in acmesmith.yaml

preferred_chains:
  - root: "ISRG Root X1" #or root_certificate ?
     ### Filter (optional)
    filter:
      subject_name_exact:
        - my-app.example.com
      subject_name_suffix:
        - .example.org
      subject_name_regexp:
        - '\Aapp\d+.example.org\z'     

[sorah]

Nice. I'd name root_issuer for the root param.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.