Certgen: provide parameter for setting expiry date for gRPC certificates

[tsaarni]

Currently certgen generates gRPC certificates with fixed one year expiration period. Contour does not yet support rotation of gRPC certificates. It is expected that users will handle this.

Assumption: Many users will miss the documentation and unknowingly set a "time bomb" which will cause an incident in 365 days.

Proposal 1: add a parameter to certgen for users to set the expiration date for the gRPC certificates.
Proposal 2: as long as there is no automated enrollment, use default expiration period that will NOT expire in any reasonable time.

Certificates are preferably rotated but due to lack of automation at this point, there is a high risk that user will not be prepared for it either. In that case, never expiring certificate is better than expired certificate. Added security risk is negligible.

[youngnick]

You make a fair point, and I think that Proposal 2 is probably better for now. I've raised #2020 to cover us writing documentation about the rotation process, as the first step towards deciding if it's automatable.

Envoy supports hot reload for lots of things, but the xDS connection is a bit tricky as it's possible to break the connection, rendering the Envoy un-updateable without a restart. So any automation of this rotation will need to be carefully tested.

[jpeach]

Sorry for the inconsistent advice @tsaarni, but we now agree that Proposal 1 is preferable :)