Issue

I'm getting an alert because ipa-healthcheck warning me that my directory server certificate expires within 30 days.

# ipa-healthcheck --source=ipahealthcheck.ds.nss_ssl --check=NssCheck --output-type=human 
ERROR: ipahealthcheck.ds.nss_ssl.NssCheck.DSCERTLE0001: The certificate (Server-Cert) will expire in less than 30 days

certmonger is responsible for renewing this certificate before it expires, but in the default configuration, it will only do so when the certificate is 28 days away from expiry.

ipa-server should configure certmonger to renew expiring certificates (say) 32 days before they expire. Thus the warning will only be raised after certmonger has had at least one chance to rewnew the certificate. In the happy path, certmonger will sucessfully renew the certificate without a warning ever being raised.

The underlying source of the warning is a 389-ds-base healthcheck, so alternatively 389-ds-base could be modified to align with certmonger's default behaviour.

Steps to Reproduce

1. Install an ipa-server with a CA
2. Configure alerting based on ipa-healthcheck output
3. Wait until the directory server certificate is 30 days away from expiry

Actual behavior

The healthcheck raises a warning. With no intervention, the warning will resolve itself 2 days later.

Expected behavior

No warning if certmonger's first attempt to renew the certificate is successful.

Version/Release/Distribution

ipa-server-4.9.13-12.module+el8.10.0+22138+e77d88cf.x86_64
ipa-client-4.9.13-12.module+el8.10.0+22138+e77d88cf.x86_64
389-ds-base-1.4.3.39-8.module+el8.10.0+22275+e4fc04d4.x86_64
package pki-ca is not installed
krb5-server-1.18.2-29.el8_10.x86_64
ipa-healthcheck-0.12-4.module+el8.10.0+22138+e77d88cf.noarch
idm-pki-ca-10.15.1-1.module+el8.10.0+21991+2e8cd757.noarch

(FYI the template needs updating, it is missing idm-pki-ca in the list of packages)