Create new puppet setting, TBD, to specify when to attempt client cert renewal relative to its expiration date, e.g. N weeks prior.
The setting should be of type "duration" It should be on by default. It should be possible to disable the renewal behavior by setting the value to "0" It's default value should be TBD
Create a new puppet setting, TBD "hostcert_renewal_interval", to specify when to attempt client cert renewal relative prior to its expiration date. The setting name should start with "hostcert_*", e because "hostcert" is the setting for the client cert.g. N weeks prior.
The setting should be of type "duration"
It should be off ON by default (since puppetserver. Puppetserver support will be off by default in FOSS), but that way only a server config change will be needed.
It should be possible to disable the renewal behavior by setting the value to "0"