Incus generating bad certs from internal CA

Incus
1

Incus is absolutely fantastic, but slightly too clever here incus/shared/tls/acme.go at main · lxc/incus · GitHub :

certData, err := os.ReadFile(filepath.Join(dir, "certificates", fmt.Sprintf("%s.crt", domains[0])))
if err != nil {
	return nil, nil, err
}

caData, err := os.ReadFile(filepath.Join(dir, "certificates", fmt.Sprintf("%s.issuer.crt", domains[0])))
if err != nil {
	return nil, nil, err
}

keyData, err := os.ReadFile(filepath.Join(dir, "certificates", fmt.Sprintf("%s.key", domains[0])))
if err != nil {
	return nil, nil, err
}

My CA operates an intermediary cert under a root cert, and leaf certs under that. Here, Incus pulls together the leaf cert, which my CA already delivers with the intermediate cert, and concatenates to it the leaf cert’s issuer, i.e. the intermediate. So then I get a cert that goes leaf → inter → inter, which then (for some reason I didn’t fully understand) breaks the browser managing to link it to my locally trusted root cert.

I already added my root cert to Incus’s security setting, this whole flow with renewals and all works 100% for everything else on my server, I’m pretty sure it’s just exactly those lines I linked.

I imagine there are reasons to sometimes add the issuer? For my case I would just delete the lines about the issuer, but if they’re useful for other stuff I’d add it only if its not already a substring of the concatenated result (don’t really understand the golang specifics here)

2