On MacOS, our generated root cert can only be valid for 397 days, or MacOS will not accept it. Obviously, then, it will expire soon enough. We need a mechanism to detect when this happens, and trigger just the cert generation/installation step, again, then.