TLS client endpoint string descriptions could be more convenient to use wrt certificate chains

	@exarkun reported
Trac ID	trac#9167
Type	enhancement
Created	2017-06-09 17:09:29Z

The existence or non-existence of a certificate chain is essentially an attribute of the certificate itself. Switch between two certificates and you may have to change the chain - including changing between having a chain and not having one at all.

If you switch from a certificate without a chain to one with a chain, you have to change your endpoint string description structurally from:

ssl:9999:certKey=cert.pem:privateKey=key.pem

to

ssl:9999:certKey=cert.pem:privateKey=key.pem:extraCertChain=chain.pem

And similarly for the reverse. This is inconvenient because it breaks simple string-interpolation based configuration systems.

If there were an option for "my certificate and its chain" in a single file that would address the problem.

trac-id__9167 9167
type__enhancement enhancement
reporter__exarkun exarkun
priority__normal normal
milestone__None None
branch__ 
branch_author__ 
status__new new
resolution__None None
component__core core
keywords__None None
time__1497028169634977 1497028169634977
changetime__1497028169634977 1497028169634977
version__None None
owner__None None

Search Twisted's endpoint parsing and TLS setup for handling of ssl endpoint descriptions and the certKey, privateKey, and extraCertChain options. Read the existing endpoint and certificate-related tests before changing behavior. Done means a certificate and its chain can be represented together without requiring a structural endpoint-string change when switching between chained and unchained certificates.