How does the built-in UI cert get updated?

[troy256]

This is a question in reference to the default Rancher SSL certificate attached to the Rancher UI that is Issued to "dynamic" and Issued by "dynamiclistener-ca". We notice that is occasionally renewed (the "Valid to" date changes), but cannot figure out what triggers it to renew. Neither a container restart or a container upgrade on its own seems to force it. How does it work?

[xiaods]

read the code. and check expired func