The cert setup is pretty straightforward, but the routing details are where things can get messy. I’d test the private subnet path before adding more rules.