Bug 1436714

Cloned from upstream: https://pagure.io/freeipa/issue/6652

To improve performance of the vault, we should consider to cache the transport cert. The transport cert is used to wrap the session key for vault payload with the public RSA key of the KRA's transport cert.

## client

ipaclient.plugin.vault


            # retrieve transport certificate
            config = self.api.Command.vaultconfig_show()['result']
            transport_cert_der = config['transport_cert']
            nss_transport_cert = nss.Certificate(transport_cert_der)


## server

```ipaserver.plugins.vault```


            kra_client = self.api.Backend.kra.get_client()
            transport_cert = kra_client.system_certs.get_transport_cert()
            config = {'transport_cert': transport_cert.binary}


The method ```get_transport_cert``` performs another HTTPS connection to retrieve the KRA transport cert from Dogtag.

## Caching

The KRA transport cert should be cached on both server side and client side, but at least on the client side. Perhaps it is possible to use certmonger to track the cert and have it automatically reloaded when it is renewed?