Terraform Enterprise Internal Vault

Does the internal vault that ships with PTFE support the PKI engine? Or does an external vault need to be stood up for that functionality?