Automated TLS certificate issuance looks simple from the outside. An ACME client requests a certificate, a certificate authority creates a challenge, the client proves control of the requested domain, and the CA issues the certificate. Once the process has been automated, certificate renewal can happen without an administrator manually generating a CSR, uploading validation files, or downloading a replacement certificate. The interesting engineering problem is what happens between those steps...