Certificates - Consul or Vault?

I would like a tool to manage the PEM stored in a Kubernetes secret used by one of my apps for TLS. Is this a job for Consul or Vault?