changed root CA creation options, added encryption

[mrtvfuencxozd]

Hi Jacob,
Thank you for minica.

Here is a PR somehow "reverting" #18 with the few other changes I mentioned in comments of this PR.

• added -no-auto flag to prevent automatic issuer creation
• added -root-ca-only flag to only create an issuer

The other changes are :

• added -encrypt-ca-key flag to encrypt root CA's private key (Encrypt CA key with password #2)
  to allow automated use, when required (creation/use of key),
  password can be provided by environment (MINICA_KEY_PASSWORD).
  If it is not, it will be asked to user.
  Note that this adds a dependency to "golang.org/x/crypto"
  this is for ssh/terminal, to not display typed password

Also, as you stated in #14 that you wanted to keep things "radically simple", and while still wanting to help find where a certificate comes from, I've added a simple CN customization option.

• added -ca-name flag to customize issuer CN for easier identification
  this replaces "minica" by a custom string in "minica root ca 3f3732"

• added/modified some error checking.

• modified README/Usage accordingly.

As I needed these changes, I hope you'll find them worth the merge.

[mrtvfuencxozd]

Hi Jacob,
any remark ?

[jsha]

Hi @mtrvfuencxozd! Thanks for your patience. Most of these changes, I don't want to incorporate into minica.

For the encrypted root CA private key: I think this use case can be better solved with an encrypted filesystem containing the private key.

For -root-ca-only and -ca-name, I think you can solve these by "bringing your own root," that is, by generating a root with some other software (like OpenSSL) and naming it minica.pem and minica-key.pem. I like this approach better because it reduces the need to add additional flags to minica.

For -no-auto, I can see the use, and would accept it (though I'd like to call it -no-create-root or something).

I'm going to close this PR for now; if you would like to create another one that implements -no-create-root I will take a look. Otherwise, I may implement it myself at some point.