PKI CA chain starts with an empty line (invalid CA by Android)

[ljagiello]

Describe the bug
/pki/ca_chain endpoints returns an empty line + ca_chain.

File that starts with an empty is not a valid certificate according to Android :( (Works perfectly fine if we remove an empty line).

Place in a code: https://github.com/hashicorp/vault/blob/master/builtin/logical/pki/path_fetch.go#L178
Easy test case: https://play.golang.org/p/CAMdrOHT7C1

To Reproduce
Steps to reproduce the behavior:

➜  ~ curl -s https://active.vault-dev.service.sjc.consul:8200/v1/pki/ca_chain

-----BEGIN CERTIFICATE-----
MIIFrzCCA5egAwIBAgIUXwd2M12345678958F123456778wDQYJKoZXCVBNM
[…]

Expected behavior
No empty line at the beginning.

Environment:

• Vault Server Version (retrieve with vault status):

:~# vault status
Key                    Value
---                    -----
Seal Type              shamir
Initialized            true
Sealed                 false
Total Shares           8
Threshold              2
Version                0.11.4
Cluster Name           vault-cluster-98765432
Cluster ID             abcdefgh-1234-5678-9012-123456789012
HA Enabled             true
HA Cluster             https://10.8.40.109:8201
HA Mode                active

• Vault CLI Version (retrieve with vault version):

~ % vault version
Vault v0.11.4 ('612120e76de651ef669c9af5e77b27a749b0dba3')

Also tested on current master branch. The same issue.

• Server Operating System/Architecture:

~ % uname -a
Linux vault-dev 4.15.0-30-generic #32-Ubuntu SMP Thu Jul 26 17:42:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Vault server configuration file(s):

ui = true
disable_mlock = false
disable_cache = false
default_lease_ttl = "768h"
max_lease_ttl = "768h"
plugin_directory = "/etc/vault/plugins"

backend "consul" {
  address = "127.0.0.1:8500"

  path = "vault-dev/"
  scheme = "http"
  check_timeout = "5s"
  disable_registration = "false"
  service = "vault-dev"
  service_tags = "dev"

  max_parallel = "128"
  tls_skip_verify = "false"
}

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = "false"
  tls_cert_file="/etc/vault/ssl/vault-bundle.pem"
  tls_key_file="/etc/vault/ssl/vault-key.pem"
}

telemetry {
  statsd_address = "127.0.0.1:9466"
  disable_hostname = true
}

Additional context
This issue can be fixed with PR: #5779