What I find bizarre is software that accepts a self-signed certificate only to then reject the cert because it has expired. What security problem are they trying to solve there?
If you disable checking all together, then an attacker doesn't need to compromise a private key. Any impersonation attack will just work.
If you require the user to accept a specific cert (and store that information) then you can just as well let the user accept an expired cert.
The current situation just creates a lot of hassle for people without any security benefit.
Key rotation is completely separate from the lifetime of a cert. You can renew certs while keeping keys constant forever. In practice, if your key gets compromised and you have to wait for the cert to expire, then you have a very big problem. Even with letsencrypt it is likely more than a month before the cert expires.
In my experience, many "security" people see this as the purpose of their job.
So the user must still connect the self-signed certificate when connecting to the device (over ssh for example).
So in this case the user generates the certificate and also accepts it.
By the way, most ssh clients will tell you if a certificate changed. So the moment your self-signed certificate is compromised you will know.
Most implementations of ssh in the wild don't use CA (or self) signed certificates. I dont know if Cisco even supports the use of ssh with certificates.
They do -- in addition to public key auth, as GhettoMaestro mentioned.