Add authority option WithX509SignerFunc

[maraino]

Description

Caddy proposes adding a new function to be able to automatically replace the intermediate certificate in an authority using a function that returns the current certificate chain and signer to use. See caddyserver/caddy#4517.

The new option can be something like

func WithX509SignerFunc(func() (chain []*x509.Certificate, s crypto.Signer)) Option
or 
func WithX509SignerFunc(func() (chain []*x509.Certificate, s crypto.Signer, err error)) Option

Then SoftCAS if configured can use that to get the updated chain and signer.

[francislavoie]

Maybe it should return an error too as the 3rd just to be safe

[maraino]

@francislavoie what do you think would be the behavior if there's an error? fail or use a cached version of the intermediate and signer?

[francislavoie]

I'd think fail the current operation 🤷‍♂️

[francislavoie]

To elaborate, currently for Caddy I think it wouldn't be possible to return an error for the intermediate cert, but if we moved the "sign with root" behaviour into the func then it could error technically because it would have to reload it from disk.

But I think what we'd probably do is use WithX509SignerFunc for intermediates, but WithX509Signer (not func) for "sign with root", so I guess it probably wouldn't make a difference for us whether an error can be returned or not.

[maraino]

@francislavoie, @mholt
Are you ok with this #879?

[francislavoie]

Yeah, looks great to me! Thanks!!