I've set up my configuration management system to drive certbot and to handle certificate distribution: https://github.com/irtnog/certbot-formula https://githu

I've set up my configuration management system to drive certbot and to handle certificate distribution: https://github.com/irtnog/certbot-formula https://github.com/irtnog/certbot-formula https://github.com/irtnog/salt-states/blob/production/certbot/files/etc/renewal-hooks/deploy/send-event https://github.com/irtnog/salt-states/blob/production/certbo... https://github.com/irtnog/salt-states/blob/production/salt/files/reactors/certbot-deploy.sls https://github.com/irtnog/salt-states/blob/production/salt/f... There are a few bits I haven't published mostly due to laziness on my part, like how I handle certificate assignments, but it's all pretty straightforward. The hardest part has been developing the necessary configuration scripts for Windows. It takes some effort to get keying material installed in the appropriate certificate store, which you can see part of here: https://github.com/irtnog/salt-states/blob/production/wincert/init.sls https://github.com/irtnog/salt-states/blob/production/wincer... And then there's how things that use CryptoAPI/CryptoNG reference the desired certificate by SHA-1 thumbprint, which you can see part of here: https://github.com/irtnog/salt-states/blob/production/iis/certificates.sls https://github.com/irtnog/salt-states/blob/production/iis/ce... https://github.com/irtnog/salt-states/blob/production/rd-gateway/certificates.sls https://github.com/irtnog/salt-states/blob/production/rd-gat... In some cases there isn't a clean API for certificate installation: https://github.com/irtnog/salt-states/blob/production/rdp/init.sls https://github.com/irtnog/salt-states/blob/production/rdp/in... In other cases one must run the necessary PowerShell cmdlets under user accounts with the correct privileges, which is something I haven't quite figured out (e.g., for Exchange 2007 and newer). Sometimes the services in question require the keying material be structured in very specific and slightly odd formats (e.g., Splunk). Sometimes, I just stick a load balancer in front of it, terminate the TLS connection there, and call it a day (e.g., Tableau), perfect being the enemy of good and all. I've given a lot of thought to the question "how would an attacker use CT logs against me", but I think the probable losses of something untoward happening due to certificate transparency is extremely small compared to attackers getting onto my networks and eavesdropping on sensitive, internal comms. I'm also not confident in my ability to run my own internal CA, both because it'd be a lot of work to secure and because the bus factor would be so damn high. At least this gives the rest of the team some incentive to tie new things into the configuration management system because they get certificates for "free". Maybe there's a better way. I don't know.