But they don't require changes for altering the state of RAM on the server, or data in the database. So clearly not every change requires an associated ticket.

But they don't require changes for altering the state of RAM on the server, or data in the database. So clearly not every change requires an associated ticket. Certificate renewal is part of the regular operation of a device, not a change to that operation.