Certificate Lifecycle Automation
Automated Let's Encrypt issuance and renewal across all managed machines, removing manual certificate handling.
Overview
TLS certificates across managed machines were issued and renewed manually, creating a recurring risk of unnoticed expiry and outages.
Problem
Certificate renewal depended on someone remembering to act before expiry, with no consistent process across the machines in scope.
Constraints
- Needed to support a heterogeneous set of managed machines
- Had to work reliably without constant manual oversight
Approach
Deployed a certificate handler that automates issuance and renewal via the ACME protocol, building a working understanding of the protocol itself to be able to debug and extend the automation rather than treat it as a black box.
Key Decisions
Automate the full certificate lifecycle via ACME
Removes the human failure point entirely instead of relying on reminders or manual processes.
Tech Stack
- Let's Encrypt
- ACME
- Ansible
Result & Impact
Certificate expiry is no longer a manual tracking problem; renewals happen automatically across all managed machines.
Learnings
- Understanding the underlying protocol (ACME) makes automation far easier to trust and extend