[tls] Add options for certificate expiry and renew

[LaurenceJJones]

A user has requested we added options to the TLS for cert manager, they work in a business that only allow "short-life" certificates. They are currently rolling there own deployment for this, but would love to see this an option.

  duration: 2160h # certificate lifetime
  renewBefore: 360h # certificate should be renewed

https://cert-manager.io/docs/usage/certificate/#creating-certificate-resources

However, upstream issue should be resolved before exploring it further