Automate TLS certificate issuance and renewal with cert-manager against an ACME CA, and separately monitor Certificate Transparency logs for unexpected issuance

Steps

1. Deploy cert-manager in the cluster and create an ACME Issuer or ClusterIssuer that registers an account with the ACME CA; cert-manager generates and stores the account's private key as a Secret.
2. Define Certificate resources referencing the issuer, DNS names, and a target Secret; cert-manager requests the certificate, completes HTTP-01 or DNS-01 challenges, and writes the issued certificate and key into that Secret automatically.
3. cert-manager tracks each certificate's expiry and renews it automatically ahead of expiry, rotating the Secret's contents without manual intervention as long as the challenge mechanism keeps working.
4. Separately from cert-manager, which does not natively monitor Certificate Transparency logs, query a public CT log search service such as crt.sh for your domains on a schedule to detect certificates issued for them outside your own ACME pipeline.
5. Alert on unexpected CT log entries — an unfamiliar CA, an unexpected subdomain, or an unusual validity period — as a possible mis-issuance or domain-takeover indicator, feeding them into the same incident pipeline as other security alerts.