The cert that couldn't see its own proof

Let's Encrypt DNS-01 posted its proof to the public internet, and then checked for it through the LAN's split-horizon DNS, which will never carry it. The fix is one line: make the self-check look where the CA looks, not where you live.

• tls
• dns
• cert-manager
• lets-encrypt
• split-horizon