Ha, that’s a good question: I don’t. I chose a rather long time for the certs validity and then promised to myself that I will extend my ansible playbook when I need to.