Issue a leaf TLS certificate from a Vault PKI intermediate CA and automate renewal with a short TTL

Steps

1. Mount a root CA at 'pki' and generate an internal root cert: 'vault write pki/root/generate/internal common_name=example.com ttl=87600h'
2. Mount an intermediate CA at 'pki_int', generate a CSR, sign it with the root, and import the signed cert: 'vault write pki_int/intermediate/generate/internal common_name=intermediate.example.com' then 'vault write pki/root/sign-intermediate csr=<CSR> format=pem_bundle ttl=43800h' then 'vault write pki_int/intermediate/set-signed certificate=<SIGNED_CERT>'
3. Create a PKI role constraining allowed domains: 'vault write pki_int/roles/example-dot-com allowed_domains=example.com allow_subdomains=true max_ttl=72h'
4. Issue a certificate: 'vault write pki_int/issue/example-dot-com common_name=web.example.com ttl=24h'
5. Extract the certificate, private_key, and issuing_ca from the response JSON and deploy to the target service
6. Automate renewal by re-issuing before expiry; use Vault Agent with a 'template' stanza to render the cert and key to disk and send SIGHUP to the service on change