Deploy server CA certificate for smart-proxy rather than default

manifests/foreman_proxy.pp

@@ -107,13 +107,26 @@
       require    => Cert[$proxy_cert_name],
     }
 
-    file { $proxy_ca_cert:
-      ensure  => file,
-      source  => $default_ca_cert,
+    concat { $proxy_ca_cert:
+      ensure  => present,
       owner   => $owner,
       group   => $group,
       mode    => '0440',
-      require => File[$default_ca_cert],
+      require => File[$server_ca_cert],
+    }
+
+    concat::fragment { 'default_ca_cert':
+      target => $proxy_ca_cert,
+      source => $default_ca_cert,
+      order  => '01',
+    }
+
+    if $server_cert {
+      concat::fragment { 'server_ca_cert':
+        target => $proxy_ca_cert,
+        source => $server_ca_cert,
+        order  => '02',
+      }
     }
 
     certs::keypair { $foreman_proxy_client_cert_name:

spec/acceptance/foreman_proxy_spec.rb

@@ -162,6 +162,59 @@
     end
   end
 
+  context 'with server cert' do
+    before(:context) do
+      ['.crt', '.key', '-chain.pem'].each do |ext|
+        source_path = "fixtures/example.partial.solutions#{ext}"
+        dest_path = "/server#{ext}"
+        scp_to(hosts, source_path, dest_path)
+      end
+
+      # Force regen
+      on hosts, "if [ -e /root/ssl-build/#{fact('fqdn')} ] ; then touch /root/ssl-build/#{fact('fqdn')}/#{fact('fqdn')}-foreman-proxy.update ; fi"
+    end
+
+    it_behaves_like 'an idempotent resource' do
+      let(:manifest) do
+        <<-PUPPET
+        file { '/server-chain.pem':
+          ensure => present,
+        }
+
+        class { '::certs::foreman_proxy':
+          server_ca_cert => '/server-chain.pem',
+          server_cert    => '/server.crt',
+          server_key     => '/server.key',
+        }
+        PUPPET
+      end
+    end
+
+    describe x509_certificate('/etc/foreman-proxy/ssl_cert.pem') do
+      it { should be_certificate }
+      # Doesn't have to be valid - can be expired since it's a static resource
+      it { should have_purpose 'server' }
+      its(:issuer) { should eq('CN = Fake LE Intermediate X1') }
+      its(:subject) { should eq('CN = example.partial.solutions') }
+      its(:keylength) { should be >= 2048 }
+    end
+
+    describe x509_private_key('/etc/foreman-proxy/ssl_key.pem') do
+      it { should_not be_encrypted }
+      it { should be_valid }
+      it { should have_matching_certificate('/etc/foreman-proxy/ssl_cert.pem') }
+    end
+
+    it do
+      foreman_proxy_ca = on default, "cat /etc/foreman-proxy/ssl_ca.pem"
+      default_ca = on default, "cat /root/ssl-build/katello-default-ca.crt"
+      server_ca = on default, "cat /root/ssl-build/katello-server-ca.crt"
+
+      expect(foreman_proxy_ca.output.strip).to include(default_ca.output.strip)
+      expect(foreman_proxy_ca.output.strip).to include(server_ca.output.strip)
+    end
+  end
+
   context 'with deploy false' do
     before(:context) do
       on default, 'rm -rf /root/ssl-build /etc/foreman-proxy'