Todd's Tenth Rule of certificate automation

Any sufficiently complicated SSL certificate renewal system contains an ad hoc, informally-specified, bug-ridden, slow implementation of half a certificate lifecycle manager. I'm taking credit for this one.