This Bug Report affects these Traffic Control components:

• Traffic Ops

Current behavior:

POST /api/4.1/deliveryservices/sslkeys/add accepts unrelated certificates included in the certificate.crt field

Expected behavior:

Including a certificate that is not part of the Leaf-Intermediate-Root chain should result in a response with a 400-level HTTP status code.

Steps to reproduce:

1. Create Delivery Service 1
2. Generate a self-signed certificate for DS 1
3. Create Delivery Service 2
4. Generate a self-signed certificate for DS 2
5. Append the DS 2 certificate to the bottom of the DS 1 certificate and POST

POST /api/4.1/deliveryservices/sslkeys/add response (HTTP response status code 200):

{
  "alerts": [
    {
      "text": "WARNING: SSL keys were successfully added for 'my-delivery-service-1', but the input certificate may be invalid (certificate is signed by an unknown authority)",
      "level": "warning"
    }
  ]
}