feat: wildcard and sans certificates

[DavidePrincipi]

This PR adds support for certificate with SANs, wildcard included.

• Adds SAN support to the export-certificate script. Additional DNS names are used to create Redis keys as well as the certificate subject name. This is limited to the internal (ACME) certificate, used as default for Traefik configuration.
• The old event certificate-updated is retained for full backward compatibility.
• Define a new event, certificate-changed that is notified when a custom certificate is uploaded, or obtained/renewed by ACME. The new event includes a full list of certificate names: applications that subscribe it can match their host name(s) with the list of names in the event payload.
• Extend the get-certificate response to include a list of certificates that match the requested FQDN. The list is sorted by decreasing relevance, so a client can safely assume that certificates[0] is the best option available.

Relevance rules are (decreasing values):

• custom certificate with wildcard match
• custom certificate with exact name match
• internal (ACME) certificate with wildcard match
• default internal certificate with exact name match
• internal certificate with exact name match

If no match is found, the self-signed certificate is returned.

The use of Redis keys is deprecated and a log message is printed when they are set. In future releases the export-certificate script could be removed to avoid publishing the certificate private key in Redis.

Refs NethServer/dev#7004

See also https://github.com/NethServer/ns8-core/tree/feat-7004

[Copilot]

PR Overview

This PR adds support for certificates with Subject Alternative Names (SAN) and wildcard entries. It introduces a new event (certificate-changed), refactors the get-certificate action to handle multiple certificate matching rules and scores, and updates the certificate helper module with cryptography dependency support.

Reviewed Changes

File	Description
imageroot/actions/upload-certificate/30certificate_changed	Adds a new script to notify certificate-changed events via Redis publish.
imageroot/actions/get-certificate/20readconfig	Refactors certificate matching logic, introduces iterators for custom and ACME certificates, and sorts matches based on relevance.
imageroot/pypkg/cert_helpers.py	Updates the utility to extract certified names from certificates using the cryptography module.

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

imageroot/pypkg/cert_helpers.py:19

• [nitpick] Consider updating the type hint from 'bytearray' to 'bytes' since certificate data is typically handled as bytes.

def extract_certified_names(cert_data : bytearray) -> set:

[Copilot]

Consider adding error handling in case the corresponding key file does not exist to prevent runtime exceptions during certificate loading.

Suggested change

	with open(cert_path, 'rb') as f:
	bcert = f.read()
	with open(f"custom_certificates/{main}.key", "rb") as f:
	bkey = f.read()
	try:
	with open(cert_path, 'rb') as f:
	bcert = f.read()
	with open(f"custom_certificates/{main}.key", "rb") as f:
	bkey = f.read()
	except FileNotFoundError as e:
	print(f"Error: {e}", file=sys.stderr)
	continue