An ACM public certificate uses DNS validation and is attached to a supported AWS service. Someone removes its validation CNAME from DNS after issuance. The certificate still works today. What should operations do to support future managed renewal?

1. Request a replacement certificate using DNS validation but leave its validation CNAME unpublished as well.
2. Restore the ACM-provided validation CNAME and keep it published while the certificate remains in use.
3. Delete the validation CNAME permanently because successful initial issuance proves domain control forever.
4. Reassociate the existing certificate with the ALB and assume that action replaces the missing domain-validation record.