Does CentOS 8 Stream route certificate-validation DNS through systemd-resolved by default?

Goal: confirm whether CentOS 8 and CentOS Stream use systemd-resolved or the legacy resolver for DNS lookups performed during TLS certificate validation, and how that choice affects /etc/resolv.conf ownership.

Constraint: CentOS 7 traditionally relies on resolvconf and static /etc/resolv.conf entries, while CentOS 8/Stream may enable systemd-resolved. The packaging decision remains unresolved, and custom installations can disable or misconfigure the resolver, so validation failures may appear as certificate errors even when DNS is reachable.

• Which resolver does CentOS 8 Stream consult first for hostname checks in an SSL handshake?
• Does enabling systemd-resolved change how /etc/resolv.conf is written and trusted by OpenSSL?
• What version-specific behavior should administrators assume when troubleshooting certificate validation on CentOS 7 versus CentOS Stream?