Support choosing preferred chain

[laurelmay]

Feature Overview

Let's Encrypt currently has two certificate chains (the default and more widely trusted ISRG Root X1 and the ECDSA ISRG Root X2). I would like to be able to configure my server to prefer the ISRG Root X2 chain.

Certbot supports this with the --preferred-chain command line argument (and other tooling such as cert-manager and Ansible's community.crypto.acme_certificate support similar options).

Any issuer can present alternate cert chains, so this is not Let's Encrypt specific. This also probably would be a configuration of the certificate rather than the issuer resource.

Alternatives Considered

No response

Additional Context

• Let's Encrypt Chains of Trust
• cert-manager config example
• Ansible community.crypto.acme_certificate which allows for more granular control over selecting the chain