[elevation]

My dream configuration in the past was Vault, protected by step-ca's ACME implementation, with an IdP like KanIDM for SSO.

But it seems like there is so much feature creep: OpenBao now has its own ACME server. And KanIDM is considering it... Why is every app vying to be my root of trust?

[cipherboy]

Vault has had PKI since pre-v1; ACME was introduced in 2022 to modernize its APIs.