Added a variant of the test that uses HashiCorp Vault to manage te

Certificate Authorities.

vault_configure.sh

@@ -0,0 +1,49 @@
+# Enable the PKI secrets engine for the root CA and for the issuing CA
+vault secrets enable pki
+vault secrets enable -path=pki_int pki
+
+# Set the maximum TTLs of the CAs
+vault secrets tune -max-lease-ttl=87600h pki
+vault secrets tune -max-lease-ttl=43800h pki_int
+
+# Generate the root CA inside Vault
+vault write pki/root/generate/internal \
+    common_name="Test CA" \
+    issuer_name=root \
+    key_type=rsa \
+    key_bits=4096 \
+    ttl=87600h \
+    max_path_length=1
+
+# Generate the issuing CA key and CSR
+vault write -field=csr pki_int/intermediate/generate/internal \
+    common_name="Issuing Test CA" \
+    key_type=rsa \
+    key_bits=4096 > issuing_ca.csr
+
+# Sign the issuing CA CSR with the root CA
+vault write -field=certificate pki/root/sign-intermediate \
+    csr=@issuing_ca.csr \
+    format=pem_bundle \
+    ttl=43800h \
+    max_path_length=0 > issuing_ca_signed.pem
+
+# Install the signed issuing CA certificate
+vault write pki_int/intermediate/set-signed certificate=@issuing_ca_signed.pem
+
+# Create a role that issues client authentication certificates
+vault write pki_int/roles/wif-client \
+    allow_any_name=true \
+    enforce_hostnames=false \
+    server_flag=false \
+    client_flag=true \
+    key_type=rsa \
+    key_bits=4096 \
+    key_usage=DigitalSignature,KeyEncipherment \
+    ttl=8760h \
+    max_ttl=8760h \
+    no_store=true
+
+# Export the CA certificates
+vault read -field=certificate pki/cert/ca > ca_cert.pem
+vault read -field=certificate pki_int/cert/ca > issuing_ca_cert.pem