---
# How long before its actual expiry a certificate should be rotated.
pki_cert_renew_before: +183d