Enable Custom Certificate Duration and Support External Certificate Issuers for All Components in Cloud Pak for AIOps 4.x

During Cloud Pak for AIOps 4.x installation, the certificate creation step fails because the application default certificate duration does not align with the bank’s certificate manager requirements. Specifically, the default duration conflicts with the bank’s enforced certificate validity period, resulting in failed certificate signing requests (CSR) and ultimately a failed installation.
Additionally, self‑signed certificates are prohibited in the bank’s security environment. However, AIOps 4.x currently generates multiple internal self‑signed certificates during installation, with limited ability to override them using a ClusterIssuer or Issuer (cert-manager CRDs). This restricts enterprise environments from using their approved certificate authority.
This idea proposes:

Allowing administrators to configure certificate duration, such as 17520h0m0s (2 years), to match enterprise certificate policies.
Allowing all internal certificates to be generated via ClusterIssuer/Issuer, avoiding self‑signed certificates entirely.

Why This Is Needed

Enterprise Compliance Requirements, Self-signed certificates and mismatched durations violate bank security controls and trigger installation failures.

When duration policies do not match, IBM AIOps 4.x fails certificate creation, causing:
CSR rejection
cascading operator failures
installation abort

Benefits
Eliminates certificate creation failures due to duration mismatches.
All certificates managed by enterprise-approved Certificate Authorities.
Using ClusterIssuer/Issuer enables:
automatic renewals
lifecycle management
reduced manual certificate handling

How the Proposed Solution Should Work
1. Certificate Duration Configuration
Introduce a configuration option in AIOps installation CRs (e.g., aiopsinstallation.yaml) such as:
YAMLspec:  certificate:    duration: "17520h0m0s"Show more lines
This value should be applied to all certificates generated by the platform.

2. Support for External Issuer (cert-manager)
Allow administrators to configure:
YAMLspec:  certificate:    issuerRef:      kind: ClusterIssuer      name: venafi-tpp-cluster-issuer
All certificates should be generated exclusively through the specified Issuer/ClusterIssuer.

Sample - 
spec:
 commonName: evtmanager-ir-lifecycle-flink
 dnsNames:
 - evtmanager-ir-lifecycle-flink
 - evtmanager-ir-lifecycle-flink
 - evtmanager-ir-lifecycle-flink.svc
 duration: 17520h0m0s
 issuerRef:
   kind: ClusterIssuer
   name: venafi-tpp-cluster-issuer
 renewBefore: 2380h0m0s
 secretName: evtmanager-ir-lifecycle-flink-tls

3. Replace All Self-Signed Internal Certificates
Ensure that none of the internal components default to:

self-signed CA
short-lived certificates
operator-generated certs

unless intentionally configured.

Summary
This enhancement is critical for regulated banking environments where certificate governance is mandatory. Allowing configurable certificate durations and full ClusterIssuer/Issuer integration ensures compliant, secure, and successful installations of AIOps 4.x, fully aligned with enterprise PKI policies.