Based on my experience, the capability model for certificate management usually went like: 1) Chaos: certificates requested and installed manually, either in r

Based on my experience, the capability model for certificate management usually went like: 1) Chaos: certificates requested and installed manually, either in response to incidents caused by expiration or calendar reminders 2) Monitoring: certificates requested and installed manually, in response to noisy alerting by probers looking for indications of pending expiration or other ill-health 3) Automation: continuous certificate provisioning, distribution and enablement either through platform or integration The Let's Encrypt revolution has taken a lot of people from stage 1 to stage 3 without stage 2 in between.