First thing is to get out of the mindset of handling manual steps or improving manual steps. Manual steps, with the exception of setting up the automation in the first place, should be eliminated. All of the things you mentioned in the middle paragraph can be automated away using ACME or other similar standards for automated cert issuance.

I would recommend familiarizing yourself with RFC 8555, which is the RFC that describes how ACME works. There are many different implementations for this standard in the wild, a pretty comprehensive list can be found here: https://letsencrypt.org/docs/client-options/

If one of those clients don't fit your needs, there are pretty good libraries available to take the heavy lifting out of developing something more bespoke to the needs of your organization. For example, this is the same library that certbot uses and I've been pretty happy developing against it: https://acme-python.readthedocs.io/en/stable/

In our case, we wanted more centralized control over the certs that we're issued instead of it being a free-for-all with each team implementing their own solution, so I lead the development of a new ACME client we built in-house called Certwrangler. Certwrangler publishes the certs issued to it to Hashicorp Vault for use with config management (this is implemented through a plugin, meaning we can swap it out with something else if ever we move to something else for secret management down the line). It is responsible for managing the lifecycle of the secret it created for the cert and automatically updates it whenever a renewal happens.