Comment 1 for bug 1841138

As a w/a, you could use:

vault secrets tune -max-lease-ttl=8760h -default-lease-ttl=8760h charm-pki-local

Then, Vault will start issuing certificates with expiration date = 1 year. However, it would be nice to have this configurable as a charm config option.