Since the actual duration is unknown until a cert has been issued,
providing an absolute duration for renewBefore can result in accidental
renewal loops. The new renewBeforePercentage field computes the
effective renewBefore using the actual duration, allowing users to
better express intent while maintaining backwards compatibility.
Fixes#4423, resolves#5821
Signed-off-by: Christopher Broglie <cbroglie@cloudflare.com>
0f74d7536e