Description of problem:
The Puppet CA's expire 5 years after creation

How reproducible:
Always

Steps to Reproduce:
1. Install Foreman
2. Wait 5 years

Actual results:
Certs are expired

Expected results:
Certs are expired, but we provide a method to renew them

Additional info:
Typically, users regenerate the CA
and re-sign all the certs. Not very nice if you have a lot of clients. There's
something here about renewing it by reverse engineering the CSR:

https://gist.github.com/kbarber/6456420