Configuring Vault as a PKI Intermediate Authority for mTLS

Act as a PKI Security Engineer. Provide a highly detailed, step-by-step technical execution guide dictating exactly how to configure HashiCorp Vault to act as an active Intermediate Certificate Authority (CA). This architecture is mandatory to enable strict mutual TLS (mTLS) across a massive, zero-trust distributed network. You must integrate with an external, offline [ROOT_CA_TYPE] (e.g., AWS ACM Private CA or an air-gapped internal server) acting as the absolute trust anchor. Focus the precise Vault PKI Secrets Engine configuration explicitly on generating certificates for the internal [DOMAIN_NAME] namespace utilizing highly secure [CERT_KEY_TYPE] (e.g., ECDSA P-384 or RSA-4096) cryptographic keys. Detail the exact Vault CLI/API calls required for automated CSR generation, secure cross-signing, and the deployment of a sidecar agent to automate the high-frequency issuance and rotation of leaf certificates for ephemeral workload identities.