Treat a public CA as a replaceable dependency, not a one-time setup.

Treat a public CA as a replaceable dependency, not a one-time setup. The eMudhra key failures and their exit show a CA can fail operationally overnight, and many non-browser clients won't get the memo. Build issuer agility: automate re-issuance, keep certificate lifetimes short, run regular pinning audits, and bake a rehearsed CA-rotation runbook. Test that runbook across ingress, CDN, service mesh, and any clients that pin certs or intermediates so rotation is an operation you can actually do under pressure.