pki: ca_chain endpoints do not return the chain when populated by root/generate

[dnephin]

Background

Vault has 3 endpoints for reading certificates from a PKI secrets engine, one of which has multiple options for the response:

1. pki/ca/pem - returns the single certificate
2. pki/ca_chain - returns the full certificate chain
3. pki/cert/{ca,ca_chain} - returns a JSON response with either the single certificate, or the full certificate chain

Describe the bug

pki/ca_chain and pki/cert/ca_chain return an empty response when the value was created with /pki/root/generate/internal. They correctly return the full chain if the value was populated using /pki/intermediate/set-signed.

To Reproduce
Steps to reproduce the behavior:

$ vault secrets enable pki
$ vault write -field=certificate pki/root/generate/internal common_name="dc1.consul"

$ curl -v "${VAULT_ADDR}/v1/pki/ca_chain"
# 204 No Content , with empty response body

$ curl -v "${VAULT_ADDR}/v1/pki/cert/ca_chain"
{"data":{"certificate":"","revocation_time":0}}

Expected behavior

The docs say the following about these endpoints:

This endpoint retrieves the CA certificate chain, including the CA

And, when a chain is saved using /pki/intermediate/set-signed they do properly return the full chain (including the root cert, if it was included in the PEM passed to set-signed).

So my expectations are:

The first curl should have a response body with the certificate PEM, not an empty response. A chain of 1 root cert is still a valid chain.

The second curl should have a non-empty value for data.certificate. The value should be the certificate PEM of the root cert.

[dnephin]

Related to hashicorp/consul#11598

[dnephin]

I understand fixing this may be a breaking change for anyone expecting an empty result. But it seems like pki/cert/ca_chain can be changed in a backwards compatible way. A new ca_chain field could be added to the JSON response.