if rm.cfg.CertificateValidityPeriod != nil {
		cfg.NotAfter = startTime.Add(rm.cfg.CertificateValidityPeriod.Duration)
	}

	// reads the CA
	caCert, caKey, err := certsphase.LoadCertificateAuthority(rm.cfg.CertificatesDir, handler.CABaseName)
	if err != nil {
		return false, err
	}

	// create a new certificate with the same config
	newCert, newKey, err := NewFileRenewer(caCert, caKey).Renew(cfg)