When a Renewed cert-manager CA Runs on the Same Key but a New Key Identifier
On cert-manager v1.21.2, a v1.18.6-issued rotationPolicy: Never CA renewed with the same key got a new SKI (SHA-1 → truncated SHA-256); OpenSSL accepted a pre-renewal leaf only with the old CA too.