We've laid out a pretty flexible foundation for this first release of Infisical PKI. The API is fully exposed, so you'd be able to orchestrate your own CA renewal workflow as you wish.

You can't reissue the same CA with a new validity period yet but you can definitely issue new CA(s) as part of your CA succession — This does take some manual work to do at the moment but we do plan to introduce more automated renewal workflows soon involving automatic generation of CSRs to parent CAs, auto-approving + reissuing new certificates, etc.

Definitely be on the lookout for that! Happy to expand on some of these plans :)