## The problem
I've tried to replace a TLS subscription and encountered an unexpected 400 Bad Request error given the use of `force_delete` in the configuration. Might just be a misunderstanding on when we have to add `force_destroy` in reviewing this issue, but I'm not sure.
## The fix
To change the CA, just change the `certificate_authority` attribute in your config (for example from `lets-encrypt` to `certainly`) and apply. The maintainer reproduced this exact swap and it succeeded with no delete errors, so do not try to force-delete the active subscription first. One timing note from the thread: `force_destroy` and `force_update` only take effect if they are already in state, so apply them in a separate earlier apply, not in the same apply as the CA change.