Topic

Identity & Zero Trust

Entra ID, Conditional Access, Global Secure Access, PKI and workload identity.

Identity & Zero Trust
6 April 2026
17 min read

Building a Cloud-Native PKI with HashiCorp Vault
I built an HA Vault PKI on Kubernetes to sign the subordinate CA that Global Secure Access needs for TLS inspection. Vault cannot issue a certificate that is both a CA and carries Server Auth EKU, so it could not be done. Updated September 2026: Microsoft now offers a managed certificate for GSA in preview, which removes the problem entirely.

Working on something in this area?

Thirty minutes, no deck - tell me what you're building and where the pressure is coming from.