##### SUMMARY
The file contents that end up as the output of ecs_certificates "full_chain_path" are not a valid format for import into, for example, a PKCS12 store.

This is the result of the return value of the ECS API being an array, and not properly turning that array into concatenated certificates for the resulting PEM file.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
ecs_certificate

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
Applies to ansible 2.9.0.dev0

##### CONFIGURATION
N/A affects all configurations

##### OS / ENVIRONMENT
N/A affects all OS/environment


##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->
Populate full_chain_path and inspect output

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->
A properly formatted PEM certificate chain

##### ACTUAL RESULTS
A certificate chain in format ['CERT','CERT']

I(force) is specified or C(cert_days < remaining_days).
            - Specifying C(request_type=validate_only) means the request will be validated against the ECS API, but no certificate will be issued.
            - Specifying C(request_type=new) means a certificate request will always be submitted and a new certificate issued.
            - Specifying C(request_type=renew) means that an existing certificate (specified by I(tracking_id) if present, otherwise I(path)) will be renewed.
              If there is no certificate to renew, a new certificate is requested.
            - Specifying C(request_type=reissue) means that an existing certificate (specified by I(tracking_id) if present, otherwise I(path)) will be
              reissued.
              If there is no certificate to reissue, a new certificate is requested.
            - If a certificate was issued within the past 30 days, the 'renew' operation is not a valid operation and will fail.
            - Note that C(reissue) is an operation that will result in the revocation of the certificate that is reissued, be cautious with it's use.
            - I(check_mode) is only supported if C(request_type=new)
            - For example, setting C(request_type=renew) and C(remaining_days=30) and pointing to the same certificate on multiple playbook runs means that on
              the first run new certificate will be requested. It will then be left along on future runs until it is within 30 days of expiry, then the
              ECS "renew" operation will be performed.
        type: str
        choices: [ 'new', 'renew', 'reissue', 'validate_only']
        default: new
    cert_type:
        description:
            - The type of certificate product to request.
            - If a certificate is being reissued or renewed, this parameter is ignored, and the C(cert_type) of the initial certificate is used.
        type: str
        choices: [ 'STANDARD_SSL', 'ADVANTAGE_SSL', 'UC_SSL', 'EV_SSL', 'WILDCARD_SSL', 'PRIVATE_SSL', 'PD_SSL', 'CODE_SIGNING', 'EV_CODE_SIGNING',
                   'CDS_INDIVIDUAL', 'CDS_GROUP', 'CDS_ENT_LITE', 'CDS_ENT_PRO', 'SMIME_ENT' ]
    subject_alt_name:
        description:
            - The subject alternative name identifiers, as an array of values (applies to I(cert_type) with a value of C(STANDARD_SSL), C(ADVANTAGE_SSL),
              C(UC_SSL), C(EV_SSL), C(WILDCARD_SSL), C(PRIVATE_SSL), and C(PD_SSL)).
            - If you are requesting a new SSL certificate, and you pass a I(subject_alt_name) parameter, any SAN names in the CSR are ignored.
              If no subjectAltName parameter is passed, the SAN names in the CSR are used.