Vault PKI will stop providing certificates when the CA has less than 90 days to expire

[saltiyazan]

Bug Description

Vault by default will have 90 days asa validity for the certificates signed using PKI. Vault will also prevent the issuer from signing certificates that would outlive the CA cert of the issuer, therefore the issuer won't provide any certificates when it is 90 days or less to its expiry as the charm currently doesn't renew the issuer before that period.

To Reproduce

1. Deploy Vault
2. Deploy self signed certs
3. configure self signed certs to use short validity times
4. Integrate both charm
5. Deploy a requirer
6. Integrate the requirer with Vault
7. Observer the issue when the CA has not yet expired but entered the period described above (by default this should happen right away as the charm relies on the default ttl of issued certificates)

Environment

Not relevant

Relevant log output

cannot satisfy request, as TTL would result in notAfter <date and time> that is beyond the expiration of the CA certificate at <date and time>

Additional context

No response