Complete procedures with a way back.

Create an offline root and constrained online intermediate with OpenSSL 3.5 LTS, issue inventory-approved SAN/EKU service leaves, operate revocation, and prove rotation plus full CA recovery.

Install a pinned cert-manager release, prove webhook and controller health, validate ACME staging through HTTP-01, promote one bounded certificate to production, design least-privilege DNS-01 for wildcards, and operate renewal without exposing private keys.

Deploy or repair an OpenVPN 2.6 gateway with certificate checks intact. Start Cannot resolve host address with the client's pre-tunnel DNS and actual profile; investigate VERIFY ERROR, peer certificate verification failure and TLS handshake failed only at their demonstrated transport or TLS layer.