The controller's server certificates' life cycles are managed externally, not by the controller. The controller reads certificates only on startup. This means it's necessary to deploy/restart the controller more often than the server certificate(s) expire to avoid presenting an expired server certificate to ctrl plane and edge clients.

Document these facts in the controller deployment guide or Helm chart readme or both.

Relevant forum topic: https://openziti.discourse.group/t/certificate-life-cycle/1128/3?u=qrkourier