Add precision to certificate chain operations

We were convolving functions that operate only on the tail of a certificate
chain (eg, `SSL_CTX_set0_chain`) and those that provide the entire chain in
one (eg, `SSL_CTX_use_certificate_chain_file` or the `Certificate` conf
directive).

Author: ctz

src/conf.rs

@@ -180,7 +180,7 @@ impl SslConfigCtx {
             State::ApplyingToCtx(ctx) => {
                 // the "Certificate" command after `SSL_CONF_CTX_set_ssl_ctx` is documented as using
                 // `SSL_CTX_use_certificate_chain_file`.
-                ctx.get_mut().stage_certificate_chain(cert_chain)?;
+                ctx.get_mut().stage_certificate_full_chain(cert_chain)?;
                 ActionResult::Applied
             }
             State::ApplyingToSsl(_) => {

src/entry.rs

@@ -283,7 +283,7 @@ entry! {
                     }
                 };
 
-                match ctx.get_mut().stage_certificate_chain(chain) {
+                match ctx.get_mut().stage_certificate_chain_tail(chain) {
                     Err(e) => e.raise().into(),
                     Ok(()) => C_INT_SUCCESS as i64,
                 }
@@ -481,7 +481,7 @@ entry! {
             Err(err) => return err.raise().into(),
         };
 
-        match ctx.get_mut().stage_certificate_chain(chain) {
+        match ctx.get_mut().stage_certificate_full_chain(chain) {
             Ok(()) => C_INT_SUCCESS,
             Err(e) => e.raise().into(),
         }
@@ -964,7 +964,7 @@ entry! {
                     }
                 };
 
-                match ssl.get_mut().stage_certificate_chain(chain) {
+                match ssl.get_mut().stage_certificate_chain_tail(chain) {
                     Ok(()) => C_INT_SUCCESS as i64,
                     Err(e) => e.raise().into(),
                 }

src/lib.rs

@@ -685,11 +685,18 @@ impl SslContext {
         self.auth_keys.stage_certificate_end_entity(end)
     }
 
-    fn stage_certificate_chain(
+    fn stage_certificate_full_chain(
         &mut self,
         chain: Vec<CertificateDer<'static>>,
     ) -> Result<(), error::Error> {
-        self.auth_keys.stage_certificate_chain(chain)
+        self.auth_keys.stage_certificate_full_chain(chain)
+    }
+
+    fn stage_certificate_chain_tail(
+        &mut self,
+        chain: Vec<CertificateDer<'static>>,
+    ) -> Result<(), error::Error> {
+        self.auth_keys.stage_certificate_chain_tail(chain)
     }
 
     fn commit_private_key(&mut self, key: evp_pkey::EvpPkey) -> Result<(), error::Error> {
@@ -946,11 +953,11 @@ impl Ssl {
         self.auth_keys.stage_certificate_end_entity(end)
     }
 
-    fn stage_certificate_chain(
+    fn stage_certificate_chain_tail(
         &mut self,
         chain: Vec<CertificateDer<'static>>,
     ) -> Result<(), error::Error> {
-        self.auth_keys.stage_certificate_chain(chain)
+        self.auth_keys.stage_certificate_chain_tail(chain)
     }
 
     fn commit_private_key(&mut self, key: evp_pkey::EvpPkey) -> Result<(), error::Error> {

src/sign.rs

@@ -34,7 +34,27 @@ pub struct CertifiedKeySet {
 }
 
 impl CertifiedKeySet {
-    pub fn stage_certificate_chain(
+    /// Set the entirety of the current certificate chain to `chain`.
+    ///
+    /// `chain[0]` is the end-entity cert.
+    pub fn stage_certificate_full_chain(
+        &mut self,
+        mut chain: Vec<CertificateDer<'static>>,
+    ) -> Result<(), error::Error> {
+        match chain.is_empty() {
+            false => {
+                self.stage_certificate_end_entity(chain.remove(0))?;
+                self.stage_certificate_chain_tail(chain)
+            }
+            true => Err(error::Error::bad_data("empty certificate full chain")),
+        }
+    }
+
+    /// Set the "bottom part" of the current certificate chain to `chain`.
+    ///
+    /// This does not contain the end-entity certificate.  That must be provided separately
+    /// with `stage_certificate_end_entity()`.
+    pub fn stage_certificate_chain_tail(
         &mut self,
         chain: Vec<CertificateDer<'static>>,
     ) -> Result<(), error::Error> {