Certificate automation with ACME without hiding the hard parts
Issuance, deployment, verification and rollback are separate steps—and each needs its own evidence.
A certificate job has four outcomes
A client can obtain a certificate while the intended service continues to present the old one. Treat issuance, installation, activation and external verification as distinct outcomes.
That separation makes failure messages more useful and prevents an apparently green renewal job from masking a serving problem.
Constrain the credentials
DNS and hosting tokens are often broader than the one renewal task requires. A typed operation boundary, a dedicated identity and a narrow target list reduce the damage a routine process can cause.
Keep private keys, rollback material and logs outside the release tree. Verification should report dates and fingerprints, never secret material.