The renew CA service can be used to automatically renew CAs that are about to expire. This might be used for SubCAs that are valid only short periods of time. The specific settings are:
CAs to Check: CAs to be checked and renewed if they are about to expire.
Time before CA expires to renew: Amount of time before the CA actually expires, that the service should renew the CA.
For CAs using soft keystores and not using the default password, auto-activation is required.