Hi,
Looks like it doesn't support an on-premise Certificate Authority (CA) as of today, but non-partnered providers/authorities are allowed.
There's a uservoice feedback about allowing an on-premise CA for Azure Key Vault over here:
https://feedback.azure.com/forums/906355-azure-key-vault/suggestions/36416761-active-directory-certificate-service-as-external-c
(Please don't forget to accept helpful replies as answer)
Best regards,
Leon