Issues an ephemeral X.509 certificate from the Vault PKI secrets engine and writes the PEM-encoded components to temporary files in the build workspace.

Certificate PEM variable

Environment variable set to the path of the PEM file containing the issued certificate (-----BEGIN CERTIFICATE-----), followed by the intermediate CA certificates (without the root). This is the client certificate chain that tools such as curl, Docker or Go present during mutual TLS; for a root-only PKI it contains just the certificate.

Private key PEM variable

Environment variable set to the path of the PEM file containing the private key. The file is created with 0400 permissions on POSIX systems and restricted to the file owner on Windows; the build fails if the permissions cannot be applied. Do not print the file contents to the build log.

CA certificate PEM variable

Environment variable set to the path of the PEM file containing the CA chain (intermediate CA(s) up to the root, as returned in Vault's ca_chain), or the issuing CA certificate for a root-only setup.

All three files come from the same Vault issuance and are automatically deleted when the withCredentials block exits.

Tip: For tools that accept a PKCS12 keystore, use the standard Certificate binding (keystoreVariable / passwordVariable) instead – it also works with Vault PKI credentials.