Support root ca fingerprint for self hosted ACME server

Hi, I am hosting an private ACME server using Smallstep CA.
And it would be nice if we could use the "X.509 Root Fingerprint" that step-ca prints out during boot as the trust anchor instead of having to move a certificate file around.

Meaning that in the tls directive we could use for example an directive like root_ca_fingerprint instead of root_ca, where we could put the fingerprint value instead of having to point to a PEM file. I'm not too familiar with the internals here so an option could just be that his is used as a bootstrap for querying the ACME server for their root certificate.

step-ca will usually host a PEM version of the roots at https://<hostname>/roots.pem, so this bootstrap could save the root certificates in it's own internal store. Alternatively try to simply download the chain presented by the webserver.

So a rough outline would be something like this Caddyfile:

example.com {
	respond "Hello World" 
	tls {
		ca https://<hostname>/acme/acme/directory
		root_ca_fingerprint  <fingerprintvalue>
	}
}

An the logic could be something like this possibly:

• Has root_ca_fingerprint directive
• Check if we have a PEM certificate for the root ca of https://<hostname>/acme/acme/directory stored in data with matching <fingerprintvalue>.
• If not, try to download from https://<hostname>/roots.pem if root in chain presented by webserver matches fingerprint.
  • If fails/not found, try to save the chain presented by webserver.
• Save the root chain in the information for the ACME provider if the root we got matches <fingerprintvalue>.
• <carry on as normal>

I guess the only snag would be that it's possible that fingerprints like this can be produced in a few different ways with different results. The definition that step-ca uses I've tracked down to https://github.com/smallstep/crypto/blob/master/keyutil/fingerprint.go