In an enterprise, you use the API that a CA provides, and build it into the ticketing system. I helped build a system that took care of this with ServiceNow a few times now.

At one place we aggressively policed external facing certificates. Don’t follow the process, your service gets whacked.

It’s a process you should look into, because the compliance regimes will start paying attention to it someday soon.