Certificate and PKI management

Design a certificate and PKI management system that issues, renews, and revokes TLS certificates for an internal fleet of 200k services plus external customer domains. It must support automated issuance/renewal (ACME-style) at ~10k issuances/hour, short-lived certs to minimize revocation reliance, and a compromised intermediate CA must be containable without re-trusting every leaf. Cover the CA hierarchy, automated lifecycle, the revocation strategy, and how you protect the root signing keys.