The problem was boring, and that’s the point
Before automation, certificates on managed machines were issued and renewed manually. Nothing exotic—just a recurring task that depended on someone remembering to act before an expiry date. Boring problems like this are exactly the ones that cause outages, because nobody treats them with urgency until they’ve already failed.
Why automate instead of just reminding people
The obvious fix is a calendar reminder. I didn’t want that, for the same reason I didn’t want to rely on someone remembering to check a lab instrument’s calibration date: reminders depend on humans staying reliable indefinitely, and the cost of one missed reminder (an expired certificate taking down a service) is disproportionate to how little effort it would take to remove the human step entirely.
So the goal became: deploy a certificate handler that automates issuance and renewal end to end, using the ACME protocol, across every managed machine.
Why I didn’t treat it as a black box
It would have been possible to install a tool, point it at a domain, and move on without understanding what it was actually doing. I didn’t want that, mainly because automation you don’t understand is automation you can’t debug at 2am when it silently stops working.
So part of the work was building a working understanding of the ACME protocol itself: how a client proves control over a domain, how the certificate authority issues a certificate in response, and where the renewal cycle can quietly break—expired API credentials, a firewall rule that changed, a DNS record that no longer points where the validation step expects it to.
That mattered later. When something did go wrong (as it always eventually does with any automation), I could reason about which step in the protocol had failed instead of just restarting the service and hoping.
The actual outcome
Certificate expiry stopped being something a human had to track. The automation runs, renews what needs renewing, and only surfaces when something genuinely needs attention. That’s the bar I try to hold automation to in general: not “it works when I’m watching it,” but “it keeps working when I’m not, and tells me clearly when it can’t.”
It’s a small piece of infrastructure compared to identity management or secrets handling, but it’s a good example of the pattern I keep coming back to: automate the boring, recurring task completely, understand the protocol underneath it well enough to trust the automation, and make failures loud instead of silent.