I'm searching for an on-premise web service, that allows me to manage and generate X.509 certificates. I would like to be able to save root/intermediate CA keys and certificates within the software and have users be able to request certificates to be signed with the saved CA keys. The users should be authenticated through OpenID, OAuth2, LDAP or similar and it should be possible to map their signing authorization (i.e. which domains they are allowed to get certificates for) through roles, groups or a similar concept.
Software I have found that falls into this category up until now is:
- HashiCorp Vault
- Cloudflare's CFSSL
Are there other notable tools that (partially) satisfy my requirements and which of the ones given do you think fit my requirements best?