CA re-initialization could result in invalid certs

We initialize our CA config on a fresh cluster, and also on leader elections. If any CA certificate in the chain has already expired (either root or intermediate), the leader loop currently doesn't regenerate them.

Potential fix for this is to regenerate any expired CA certs in the leader loop. This logic is specific per provider and this issue may need to be broken up into smaller issues per provider.

One option is to implement this (ie regenerate if expired) in the `GenerateRoot` or `GenerateIntermediate` methods (current behavior in these methods is to not regenerate if there's a non empty value).