Function renew_cluster_ca 

pub fn renew_cluster_ca(
    key_pem: &str,
    cn: &str,
    validity_days: u32,
) -> Result<String, CaError>

Re-sign a cluster CA cert with an existing key, a same-key renewal.

This function generates a fresh self-signed cert with the SAME subject DN, CN=<cn>, O=krabka, OU=cluster, plus CA:TRUE, KU keyCertSign|cRLSign, and a new validityDays window. It keys the cert with key_pem and not with a freshly generated key. The public key (SPKI) and the subject DN are identical to the cert this one replaces, so leaf certs issued under the old cert still chain to the renewed one. The renewal is non-disruptive. This function returns the cert PEM only, because the caller already holds the key.

Errors

Returns an error when credentials or key material are invalid, cryptographic verification fails, or the TLS, SASL, or Kerberos exchange is rejected.