Lower DNS TTL before a move and budget the rollback cache windowLower the TTL early if you expect to move a hostname.
CAA records should authorize the issuer you actually useCAA narrows certificate issuance policy, but a mistaken record can block renewal as effectively as an expired certificate.
