You might find FreeIPA useful. Its CA component (dogtag) has a KRA component that FreeIPA exposes as 'vaults' for secret storage. You can even do cross-forest

You might find FreeIPA useful. Its CA component (dogtag) has a KRA component that FreeIPA exposes as 'vaults' for secret storage. You can even do cross-forest trust to AD, log into your Linux systems as users who live in AD...