pki/root/sign-intermediate ignoring signer pathLen if use_csr_values=true

[robison]

Environment:

• Vault Version: Vault v0.10.1 ('bc15f5547919e01d83d89a1527317b96c0a74baa')
• Operating System/Architecture: macOS 10.13.4

Expected Behavior:

• Have CA certificate with pathLen=1 at /pki
• Sign an intermediate CSR with CA certificate at /pki/root/sign-intermediate, and use CSR values from request (use_csr_values=true)
• Receive signed CA certificate with pathLen=0, and all other CSR values copied over.

Actual Behavior:

• Receive signed CA certificate with pathLen unset, and all other CSR values copied over.

I do understand the rationale for directly copying over CSR values, but I don't think that ignoring the pathLen on the signing certificate is quite right. I'm curious to learn if this is intended behavior, or something for which a PR would be accepted. Thanks!

[robison]

N.b., the behavior is the same, regardless of whether max_path_length is specified.

[jefferai]

Unintended. If you're happy to work up a PR that would be great! Otherwies I can whip one up.

[robison]

Yup, I'll have one submitted today. Thanks for the quick feedback!