title: Automatically find right intermediate CA certificate
body: <p>We are using Puppet to configure multiple clusters running Apache HTTPD using the Apache module from Puppetlabs.</p>
  
  <p>All certificates are stored in a git repository Puppet has already access to (e.g. <code>puppet://files-host/path/to/certs/${fqdn}.crt</code>).</p>
  
  <p>Right now we have to explicit specify the intermediate CA certificate (<code>ssl_chain</code> variable in the apache class) for each used certificate.</p>
  
  <p>Is it possible to let Puppet automatically find out the correct intermediate CA certificate? In a "real" scripting language I would iterate over all *.pem files and compare the subject with the issuer of the certificate. But how could that work in Puppet?</p>
  
  <p>We do not want to embed the intermediate CA certificate into all certificates.</p>