Automatic Cert Enrollment / DNS architecture question

Good evening,

As the powers that be push us towards shorter and shorter certificate durations, large enterprise grapples with certificate management . We were previously using Microsoft native for workstations / servers / laptops which was working ok with a few shortcomings.

The responsible team looked at other ‘enterprise’ solutions and ultimately picked Venafi by Palo (previously CyberArk). We have run into a seemingly insurmountable issue impacting only laptops that roam between sites that have differing deployment options for the DNS and DDNS zone names. I.E. Execs travel to hospitals or local managers travel to system office, etc.

At it’s home site, the device gets a zone name (via deployment option) of acme.com (the parent). The device gets it’s cert and all is good with a FQDN of device123.acme.com. Device then travels to the Ann Arbor site and is handed a deployment option for the zone of aa.acme.com.

Now the fun starts: Device cert happens to expire while at remote site and attempts to get new cert but is unable because now the updated FQDN of the device is device123.aa.acme.com and the cert server (AEC) refuses due to FQDN mismatch.

So here are my couple of questions for the brain trust:

1. Palo confirmed that this is working as expected. Their engineers specific to the PKI product set (not 1st level) seemed bewildered at the concept of parent / child DNS zones. We are a very large enterprise and have utilized parent w/ delegated child zones for 25+ years. I know that I do run into some folks that are in the ‘throw it all in one domain’ camp but require the ability to administratively segment control of each hospital system across the nation as only one of the several drivers and have architected our forward and reverse DNS architecture with local XHA pairs at each hospital. I guess I’m looking for feedback on how many folks leverage the parent / child architecture today. Palo called it a ‘corner case’ which literally made me laugh out loud.
2. Has anyone implemented auto enrollment and management (renewal) of certs on laptops using ANY product where the laptops roam across different child zones? Can you please share your experience?

Thanks in advance for any thoughts.