[YW] Handle invalid certs/keys correctly

[iSignal]

1. Creating a universe with an invalid certificate key/crt leads to the following error trace - however the universe itself shows up as "Ready" with no errors. Deleting this kind of a universe may also fail because it is not full set up.

2. A similar error happens if one goes to the Certificates list and clicks Actions -> Get Client certificate from the dropdown. One issue there is that there is no way to remove the invalid cert from the list (because we do not allow removing any certs once they are added).

2020-09-04 05:22:51.286 INFO  UniverseController.java:465 [application-akka.actor.default-dispatcher-11] Created universe 9f15fa61-5e3d-47b3-8621-85af2e93636b : sanketh-test-1.
2020-09-04 05:22:51.289 INFO  UniverseController.java:471 [application-akka.actor.default-dispatcher-11] Added universe 9f15fa61-5e3d-47b3-8621-85af2e93636b : sanketh-test-1 for customer [1].
2020-09-04 05:22:51.607 ERROR CertificateHelper.java:183 [application-akka.actor.default-dispatcher-11] Unable to create client CA for username yugabyte: {}
java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: invalid key format
	at sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.java:252)
	at java.security.KeyFactory.generatePrivate(KeyFactory.java:372)
	at com.yugabyte.yw.common.CertificateHelper.createClientCertificate(CertificateHelper.java:181)
	at com.yugabyte.yw.controllers.UniverseController.create(UniverseController.java:494)
	at v1.Routes$$anonfun$routes$1$$anonfun$applyOrElse$67$$anonfun$apply$67.apply(Routes.scala:3112)
	at v1.Routes$$anonfun$routes$1$$anonfun$applyOrElse$67$$anonfun$apply$67.apply(Routes.scala:3112)
	at play.core.routing.HandlerInvokerFactory$$anon$3.resultCall(HandlerInvoker.scala:143)
	at play.core.routing.HandlerInvokerFactory$$anon$3.resultCall(HandlerInvoker.scala:142)
	at play.core.routing.HandlerInvokerFactory$JavaActionInvokerFactory$$anon$8$$anon$2$$anon$1.invocation(HandlerInvoker.scala:116)
	at play.core.j.JavaAction$$anon$1.call(JavaAction.scala:112)
	at play.http.DefaultActionCreator$1.call(DefaultActionCreator.java:33)
	at com.yugabyte.yw.controllers.TokenAuthenticator.call(TokenAuthenticator.java:107)
	at play.core.j.JavaAction$$anonfun$9.apply(JavaAction.scala:171)
	at play.core.j.JavaAction$$anonfun$9.apply(JavaAction.scala:171)
	at scala.concurrent.impl.Future$PromiseCompletingRunnable.liftedTree1$1(Future.scala:24)
	at scala.concurrent.impl.Future$PromiseCompletingRunnable.run(Future.scala:24)
	at play.core.j.HttpExecutionContext$$anon$2.run(HttpExecutionContext.scala:65)
	at play.api.libs.streams.Execution$trampoline$.execute(Execution.scala:72)
	at play.core.j.HttpExecutionContext.execute(HttpExecutionContext.scala:57)
	at scala.concurrent.impl.Future$.apply(Future.scala:31)
	at scala.concurrent.Future$.apply(Future.scala:492)
	at play.core.j.JavaAction.apply(JavaAction.scala:171)
	at play.api.mvc.Action$$anonfun$apply$2.apply(Action.scala:98)
	at play.api.mvc.Action$$anonfun$apply$2.apply(Action.scala:91)
	at scala.concurrent.Future$$anonfun$flatMap$1.apply(Future.scala:251)
	at scala.concurrent.Future$$anonfun$flatMap$1.apply(Future.scala:249)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:32)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
	at akka.dispatch.BatchingExecutor$BlockableBatch$$anonfun$run$1.apply$mcV$sp(BatchingExecutor.scala:92)
	at akka.dispatch.BatchingExecutor$BlockableBatch$$anonfun$run$1.apply(BatchingExecutor.scala:92)
	at akka.dispatch.BatchingExecutor$BlockableBatch$$anonfun$run$1.apply(BatchingExecutor.scala:92)
	at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:72)
	at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
	at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:41)
	at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:49)
	at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)
	at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)
	at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)
	at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)
Caused by: java.security.InvalidKeyException: invalid key format
	at sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:331)
	at sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:356)
	at sun.security.rsa.RSAPrivateCrtKeyImpl.<init>(RSAPrivateCrtKeyImpl.java:130)
	at sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(RSAPrivateCrtKeyImpl.java:80)
	at sun.security.rsa.RSAKeyFactory.generatePrivate(RSAKeyFactory.java:357)
	at sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.java:248)
	... 38 common frames omitted
2020-09-04 05:22:51.607 ERROR UniverseController.java:557 [application-akka.actor.default-dispatcher-11] Error creating universe
java.lang.RuntimeException: Could not create client cert.
	at com.yugabyte.yw.common.CertificateHelper.createClientCertificate(CertificateHelper.java:184)
	at com.yugabyte.yw.controllers.UniverseController.create(UniverseController.java:494)
	at v1.Routes$$anonfun$routes$1$$anonfun$applyOrElse$67$$anonfun$apply$67.apply(Routes.scala:3112)
	at v1.Routes$$anonfun$routes$1$$anonfun$applyOrElse$67$$anonfun$apply$67.apply(Routes.scala:3112)
	at play.core.routing.HandlerInvokerFactory$$anon$3.resultCall(HandlerInvoker.scala:143)
	at play.core.routing.HandlerInvokerFactory$$anon$3.resultCall(HandlerInvoker.scala:142)
	at play.core.routing.HandlerInvokerFactory$JavaActionInvokerFactory$$anon$8$$anon$2$$anon$1.invocation(HandlerInvoker.scala:116)
	at play.core.j.JavaAction$$anon$1.call(JavaAction.scala:112)
	at play.http.DefaultActionCreator$1.call(DefaultActionCreator.java:33)
	at com.yugabyte.yw.controllers.TokenAuthenticator.call(TokenAuthenticator.java:107)
	at play.core.j.JavaAction$$anonfun$9.apply(JavaAction.scala:171)
	at play.core.j.JavaAction$$anonfun$9.apply(JavaAction.scala:171)
	at scala.concurrent.impl.Future$PromiseCompletingRunnable.liftedTree1$1(Future.scala:24)
	at scala.concurrent.impl.Future$PromiseCompletingRunnable.run(Future.scala:24)
	at play.core.j.HttpExecutionContext$$anon$2.run(HttpExecutionContext.scala:65)
	at play.api.libs.streams.Execution$trampoline$.execute(Execution.scala:72)
	at play.core.j.HttpExecutionContext.execute(HttpExecutionContext.scala:57)
	at scala.concurrent.impl.Future$.apply(Future.scala:31)
	at scala.concurrent.Future$.apply(Future.scala:492)
	at play.core.j.JavaAction.apply(JavaAction.scala:171)
	at play.api.mvc.Action$$anonfun$apply$2.apply(Action.scala:98)
	at play.api.mvc.Action$$anonfun$apply$2.apply(Action.scala:91)
	at scala.concurrent.Future$$anonfun$flatMap$1.apply(Future.scala:251)
	at scala.concurrent.Future$$anonfun$flatMap$1.apply(Future.scala:249)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:32)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
	at akka.dispatch.BatchingExecutor$BlockableBatch$$anonfun$run$1.apply$mcV$sp(BatchingExecutor.scala:92)
	at akka.dispatch.BatchingExecutor$BlockableBatch$$anonfun$run$1.apply(BatchingExecutor.scala:92)
	at akka.dispatch.BatchingExecutor$BlockableBatch$$anonfun$run$1.apply(BatchingExecutor.scala:92)
	at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:72)
	at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
	at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:41)
	at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:49)
	at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)
	at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)
	at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)
	at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)
2020-09-04 05:22:51.607 ERROR ApiResponse.java:21 [application-akka.actor.default-dispatcher-11] Hit error 500, message: {"error":"Could not create client cert."}

[streddy-yb]

Hi @iSignal - Should we fail the upload cert action if the cert is invalid? Can you handle this as part of TLS workflow improvements? thanks

[iSignal]

We could do two improvements here:

1. Verify the cert at upload time itself
2. The failure to create client certs is somehow not bubbling up to the create universe task flow. We also need to make sure the universe creation fails properly and that it can be then be deleted properly.

For the future, we could also consider allowing deletion of certs that do not have any univs associated with them.

[jitendra-12113]

Back end changes are done. Please review.
#6780

PS: UI changes need to be done accordingly.
cc: @gaurav061