pki: T4026: Only emit private keys when available (backport #3655)

[mergify]

Change Summary

Adding a simple check before printing out the private key to a file or console output that it exists, where the code path permits a None private_key.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T4026

Related PR(s)

Component(s) name

• pki

Proposed changes

• install_certificate() code path handles private_key=None & key_passphrase=None OK already
• file and console output paths will error trying to encode None as a key
• This is only an issue for a couple of the generate_*_sign() functions, where having a null private key is possible
  • Self-signing and CA creation always generate a private key
  • Certreqs will generate a private key if not already provided
• Do not prompt for a private key passphrase if we aren't giving back a private key

How to test

# run generate pki certificate sign test-ca 
Do you already have a certificate request? [y/N] y
Paste certificate request and press enter:
[...snip...]
Enter how many days certificate will be valid: (Default: 365) 
Enter certificate type: (client, server) (Default: server) 
Note: If you plan to use the generated key on this router, do not encrypt the private key.
Do you want to encrypt the private key with a passphrase? [y/N] 
-----BEGIN CERTIFICATE-----
[...snip, but valid...]
-----END CERTIFICATE-----

[edit]

Also ran through ca_cert and install combinations successfully.

Smoketest result

$ python3 /usr/libexec/vyos/tests/smoke/cli/test_pki.py 
test_certificate_eapol_update (__main__.TestPKI.test_certificate_eapol_update) ... PKI: Updating config: interfaces ethernet eth1 eapol certificate eapol
ok
test_certificate_https_update (__main__.TestPKI.test_certificate_https_update) ... PKI: Updating config: service https certificates certificate smoke-test_foo

WARNING: No certificate specified, using build-in self-signed
certificates. Do not use them in a production environment!

ok
test_certificate_in_use (__main__.TestPKI.test_certificate_in_use) ... 
PKI object "smoketest" still in use by "service https certificates
certificate"


WARNING: No certificate specified, using build-in self-signed
certificates. Do not use them in a production environment!

ok
test_invalid_ca_valid_certificate (__main__.TestPKI.test_invalid_ca_valid_certificate) ... 
Invalid certificate on CA certificate "invalid-ca"

ok
test_valid_pki (__main__.TestPKI.test_valid_pki) ... ok

----------------------------------------------------------------------
Ran 5 tests in 38.449s

OK

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

---

This is an automatic backport of pull request #3655 done by [Mergify](https://mergify.com).