webhook does not support the use of intermediate certificates

[mcb30]

Affected Puppet, Ruby, OS and module versions/distributions

All versions

How to reproduce (e.g Puppet code you use)

Attempt to use any webhook server certificate that requires the use of an intermediate certificate. For example, using a certificate for the machine's FQDN issued by LetsEncrypt:

class { 'r10k::webhook::config':
  enable_ssl => true,
  public_key_path => "/etc/letsencrypt/live/${::fqdn}/fullchain.pem",
  private_key_path => "/etc/letsencrypt/live/${::fqdn}/privkey.pem",
}
class { 'r10k::webhook':
  require => Class['r10k::webhook::config'],
}

What are you seeing

Connections to the webhook fail TLS verification because the intermediate certificate is missing. For example:

$ gnutls-cli <fqdn> -p 8088
...
- Got a certificate list of 1 certificates.
- Status: The certificate is NOT trusted. The certificate issuer is unknown. 

What behaviour did you expect instead

Connections to the webhook should succeed. This requires the webhook to present the intermediate certificate(s) along with its own certificate.

Any additional information you'd like to impart

A pull request to fix this issue is ready and will be submitted shortly.