Send short certificate links to on-call engineers by morning

Your certificate challenge URLs sit unmonitored, causing missed renewals. On-call engineers get shortened links and an audit log so renewals are fixed before the next workday.