Complete procedures with a way back.

Install a pinned cert-manager release, prove webhook and controller health, validate ACME staging through HTTP-01, promote one bounded certificate to production, design least-privilege DNS-01 for wildcards, and operate renewal without exposing private keys.

Diagnose Certbot AuthorizationError and failed ACME challenges without retrying blindly. Separate public DNS, IPv6, HTTP-01 routing, redirects, CAA, DNSSEC, DNS-01 propagation, and multi-origin failures before issuing or renewing a certificate.