Certificate renewals belong in DR rehearsal notes

Many teams rehearse databases while forgetting that TLS material often issues against DNS names that do not follow the failover cluster. Capture renewal dependencies beside each application card.

Where private PKI is involved, document CRL distribution points reachable during isolated networks. Test negative cases quarterly.

If this sounds tedious, compare the cost to an outage during a retail promotion window.