Function renew_clients_ca 

pub fn renew_clients_ca(
    key_pem: &str,
    cn: &str,
    validity_days: u32,
) -> Result<String, CaError>

Re-sign a clients CA cert with an existing key, a same-key renewal.

This works like renew_cluster_ca but uses the clients-CA subject DN, which has no OU=cluster.

Errors

Returns an error when credentials or key material are invalid, cryptographic verification fails, or the TLS, SASL, or Kerberos exchange is rejected.