To secure your applications, your organization uses certificates generated by a public CA.

Comprehensive and Detailed In-Depth Explanation:

The PKI secrets engine in Vault generates dynamic X.509 certificates, acting as a certificate authority (CA) or intermediate CA. It allows quick, cost-effective certificate creation for internal applications, with configurable TTLs and revocation capabilities, avoiding reliance on expensive public CAs. For example, vault write pki/issue/ generates a certificate instantly. The Identity engine (A) manages identities, not certificates. The SSH engine (C) handles SSH credentials, not X.509. The Transit engine (D) is for encryption, not certificate generation. The PKI docs highlight its suitability for this use case.