op-mode: T6424: ipsec: honor certificate CN and CA chain during profile generation (backport #3610)

[mergify]

Change Summary

In e6fe6e5 ("op-mode: ipsec: T6407: fix profile generation") we fixed support for multiple CAs when dealing with the generation of Apple IOS profiles.

This commit extends support to properly include the common name of the server certificate issuer and all it's paren't CAs. A list of parent CAs is automatically generated from the "PKI" subsystem content and embedded into the resulting profile.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T6424

Related PR(s)

• op-mode: ipsec: T6407: fix profile generation #3552

Component(s) name

Proposed changes

How to test

A resulting profile would look like this:

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    
    <key>PayloadDisplayName</key>
    <string>VyOS IKEv2 Profile</string>
    
    <key>PayloadIdentifier</key>
    <string>wue3.LR1</string>
    
    <key>PayloadUUID</key>
    <string>f735996a-265d-11ef-9e65-f2422b8b73f7</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadContent</key>
    <array>
        
        <dict>
            <dict>
                <key>ServerCertificateIssuerCommonName</key>
                <string>CAcert Class 3 Root</string>
                <key>ServerCertificateCommonName</key>
                <string>ipsec.vyos.net</string>
                 ...
            </dict>
        </dict>
        
        
        <dict>
            <key>PayloadIdentifier</key>
            <string>org.cacert.class.3.root</string>
            <key>PayloadUUID</key>
            <string>158483b0-8df8-8146-e725-42d6ee51ba69</string>
            <key>PayloadType</key>
            <string>com.apple.security.root</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            
            <key>PayloadContent</key>
            <data>MIIGPTCCB,,,</data>
        </dict>
        
        <dict>
            <key>PayloadIdentifier</key>
            <string>org.ca.cert.signing.authority</string>
            <key>PayloadUUID</key>
            <string>ead21fee-8172-7060-e9b7-921b7c270556</string>
            <key>PayloadType</key>
            <string>com.apple.security.root</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            
            <key>PayloadContent</key>
            <data>MIIG7jCC...</data>
        </dict>
    </array>
</dict>
</plist>

Smoketest result

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

---

This is an automatic backport of pull request #3610 done by [Mergify](https://mergify.com).

[github-actions]

👍
No issues in PR Title / Commit Title