The PKI Secrets Engine generates dynamic X.509 certificates. With this Secrets Engine, services can get certificates without going through the usual manual process of generating a private key and CSR, submitting to a CA, and waiting for a verification and signing process to complete.