environs/config: make CA cert optional

juju/bootstrap.go

 package juju
 
 import (
         "bytes"
         "crypto/rand"
         "crypto/rsa"
         "crypto/sha1"
         "crypto/tls"
         "crypto/x509"
         "crypto/x509/pkix"
@@ skipping 56 matching lines @@
                         // TODO quote the environment name when we start using
                         // Go version 1.1. See Go issue 3791.
                         CommonName:   fmt.Sprintf("juju-generated CA for environment %s", envName),
                         Organization: []string{"juju"},
                 },
                 NotBefore:             now.UTC().Add(-5 * time.Minute),
                 NotAfter:              now.UTC().AddDate(10, 0, 0), // 10 years hence.
                 SubjectKeyId:          bigIntHash(priv.N),
                 KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
                 BasicConstraintsValid: true,
-                IsCA:       true,
-                MaxPathLen: 0, // Disallow delegation for now.
+                IsCA:                  true,
+                MaxPathLen:            0, // Disallow delegation for now.
         }
         certDER, err := x509.CreateCertificate(rand.Reader, template, template, &priv.PublicKey, priv)
         if err != nil {
                 return nil, fmt.Errorf("canot create certificate: %v", err)
         }
         var b bytes.Buffer
         pem.Encode(&b, &pem.Block{
                 Type:  "CERTIFICATE",
                 Bytes: certDER,
         })
@@ skipping 95 matching lines @@
         tlsCert, err := tls.X509KeyPair(pem.EncodeToMemory(certBlock), pem.EncodeToMemory(keyBlock))
         if err != nil {
                 return nil, nil, err
         }
         priv, ok := tlsCert.PrivateKey.(*rsa.PrivateKey)
         if !ok {
                 return nil, nil, fmt.Errorf("CA private key has unexpected type %T", tlsCert.PrivateKey)
         }
         return cert, priv, nil
 }