[Feature request]: Ship allow-auto-renewal: true in the packaged ca.conf

[miharp]

Use Case

Expired certificates are a recurring operational failure mode: with the default ca_ttl of 5 years, every deployment hits host certificate expiry on a schedule, usually as a surprise outage (most recently an expired primary server certificate at the 5-year mark, in the community Slack).

The server has supported automatic certificate renewal for a long time and every OpenVox agent supports it, but the packaged ca.conf ships allow-auto-renewal: false, so almost nobody benefits from the feature. Worse, the failure is silent from the agent side: puppet ssl renew_cert against a default-configured CA gets a 404 from the renewal endpoint, swallows it, and exits 0 without renewing anything.

Describe the solution you would like

Ship allow-auto-renewal: true in ezbake/config/conf.d/ca.conf, so new installs get short-lived, automatically renewing agent certificates out of the box.

Behavior consequences, verified on Ubuntu 24.04 containers (openvox-server 8.15.2, openvox-agent 8.28.1):

• With the setting enabled, certificates issued to renewal-capable agents get the auto-renewal-cert-ttl lifetime (the packaged file sets "60d"; the built-in default when the setting is absent is 90d) instead of ca_ttl.
• Agents renew transparently during a regular run once the certificate is within hostcert_renewal_interval (30d default) of expiry, and puppet ssl renew_cert works on demand, including for certificates issued before the setting was enabled.
• Upgrades keep the admin's existing ca.conf (config file semantics), so the change takes effect mainly on new installs.
• The CA certificate itself (15y) and the primary server's own certificate are unaffected; renewal only covers client certificates presented to the renewal endpoint.

Describe alternatives you've considered

• Leave the default off and document the situation: done in Add certificate renewal and regeneration how-to openvox-docs#447, but documentation doesn't prevent the 5-years-later outage for people who never read that page.
• Flip the default only in OpenVox 9: the Slack consensus leaned toward fixing it now, since the change is confined to newly installed configs.

Additional context

Discussed in the community Slack (Aug 11, 2026): bastelfreak suggested a PR against the ezbake ca.conf, CVQuesty argued for fixing it now rather than waiting for OpenVox 9.

A container-verified transcript of the renewal behavior (including the silent renew_cert no-op against a default-config CA) is in the collapsed section of OpenVoxProject/openvox-docs#447. The silent exit-0 of puppet ssl renew_cert when the CA refuses renewal is its own agent-side bug, independent of this default: OpenVoxProject/openvox#605.