extend jwk cert store about hydra HOT 3 CLOSED

upstream square/go-jose#95

from hydra.

Without support from go-jose, the library needs to be forked and the functionality added. the specification for x509 certificates is available at https://tools.ietf.org/html/rfc7517

Until that is implemented, the HTTPS TLS certificate is gob encoded and stored as a PSK in the JWK store. It should be documented that the JWK store does not support the x509 claims as of now.

This approach is okay because:

• There is no security impact. PSKs are encrypted using AES-GCM as well
• It is not trivial to add a new TLS certificate using the HTTP REST API. this could be documented somewhere. importing TLS certificates still works!
• Precomputed values are removed to reduce likelyhood of possible attack vector
• One draw back is that clients need to be able to decode gob streams. As the certificate will be used only internally in hydra, this is not an issue.

from hydra.

There's not field for it in the struct right now, but it should be fairly simple to add. I can take a look at adding this next week maybe. Or if you want to take a shot at it, pull requests are welcome!

square/go-jose#95 (comment)

from hydra.