Typical certificate management practices for internal PKI are just absolutely set up to cause outages like this. The certificates get issued for a year, or two years, or whatever. This is infrequent enough that it doesn't feel like it makes sense to automate the process, and then it becomes a run-book that only ever comes out once a year, it's way too easy to add additional services without remembering to monitor which certificates you deployed to them etc.

Start from the idea that you're going to issue certificates valid for 24 hours, and think how different your environment would need to look.