Check whether a CSR can always have a wildcard SAN

Description

In Onionmine, and also in Onionspray, the HTTPS keys and self-certificate generation procedure involves creating a CSR so the operator can opt to apply for a CA-issued certificate.

It's preferred having a CSR ready for most use cases, like one that works either for wildcard certificates or those with only a single .onion address.

The procedure on the CA-side involves parsing and validating the CSR, which may imply in accepting, rejecting or skipping SANs, so it's worth checking whether or not the wilcard SAN should be always added.

Tasks

• Uniformize:
  • Update the CSR generation on Onionmine to behave like current implemented in Onionspray (adding a wildcard by default) (!50 (merged)).
  • Implement CSR generation on Oniongroove (oniongroove!18 (merged)).
• Check:
  • Check with CAs about what they do when a wilcard is found in a order for a single .onion address:
    • What HARICA does?
      • Ask them.
      • Document Q&A once/if a response is given.
    • What Digicert does?
      • Ask them.
      • Document Q&A once/if a response is given.
  • Check whether there's a spec on this or if it's an implementation decision.
• If the CSR is rejected due to mistmatching SANs (like a wildcard):
  • Fix Onionmine's implementation to generate two CSRs:
    • One with only the single .onion address.
    • One with a wildcard.
    • Documentation update to reflect the change.
  • Fix Onionspray's implementation to generate two CSRs:
    • One with only the single .onion address.
    • One with a wildcard.
    • Documentation update to reflect the change.
  • Fix Oniongroove's implementation to generate two CSRs:
    • One with only the single .onion address.
    • One with a wildcard.
    • Documentation update to reflect the change.
  • Update the Ecosystem documentation (ecosystem#14) accordingly.
• If the CSR is NOT rejected due to mistmatching SANs (like a wildcard):
  • Document that on Onionmine's code. Done on !50 (merged).
  • Document that on Onionmine's usage guide. Done on 175bba3d.
  • Document that on Onionspray's code. Done on ecafa37a97a645a1b47780fdb7124004e24becbd.
  • Document that on Onionspray's certificate guide. Done on d7f7f88a0bdce27a602dce37fcedf03a6e8727a1.
  • Document that on Onionsgroove's code. Done on oniongroove!18 (merged).
  • Update the Ecosystem documentation (ecosystem#14) accordingly. Done on 7865bc21cc94d75e79725eab2a7c3da5cef7570b.

Time estimation

• Complexity: very small (0.5 day)
• Uncertainty: low (x1.1)
• Reference (adapted)