```release-note:bug
check root and intermediate CA expiry before using it to sign a leaf certificate.
```