In our system there are a lot of certificates. Some of them are used to secure HTTPS endpoints. Many more of them are used as a means of authenticating our system to an external system (we integrate with over a dozen of other systems). Some others yet are used to authenticate external systems to our system.
All in all, we have dozens of various certificates lying about all over the place. Most of them are only found in one place - the production server that needs them. Some are checked in source control which we all agree is not a good idea, but nobody has gotten around to fixing that yet. There is no list of all (or any) of them.
Me and a few other colleagues feel that this is too chaotic. It feels like we should have some sort of registry where they are stored. A central place which lists them all; where you can check which one is going to expire next; and where you can restore them from when the need arises. Occasionally a certificate does expire and nobody notices it until it's too late.
Other colleagues feel differently. Most certificates are either automatically renewed (certbot), there are notifications set in our monitoring system (Zabbix), or there are emails from 3rd parties notifying us when they expire and need to be replaced. All certificates are already backed up in the "normal" server backups which simply back up the virtual server image. And if those backups are gone too, we have bigger problems to worry about. In addition, storing the certificates elsewhere reduces security.
Is there some largely agreed upon best practice here? Should we create a central certificate registry or should each certificate be found in one place and only one? Is there perhaps already some software for securely managing a list of certificates?