ACME
The protocol (RFC 8555) that automates proving domain control and issuing certificates, used by Let's Encrypt and most CAs.
ACME lets a client create an account, request an order for a set of names, complete a challenge per name, then submit a CSR and download the certificate. Challenges prove control: HTTP-01 serves a token at a well-known path, DNS-01 publishes a TXT record, TLS-ALPN-01 (RFC 8737) answers on port 443 with a special certificate.
It made short-lived certificates practical and is now required thinking given shrinking lifetimes. DNS-01 is the only challenge that supports wildcards, and it suits internal hosts not reachable from the internet; internal CAs (step-ca, Vault PKI) speak ACME too.
Risks: DNS API credentials for DNS-01 are powerful and often over-scoped, anyone who can serve content on your domain can pass HTTP-01, and renewals that silently fail turn into outages. Restrict issuance with CAA records and monitor CT.