Requested certificate lifetime (e.g. 1h, 30m, 24h). Defaults to 1h.

Best practice: Set the TTL to the expected maximum duration of a build plus a small buffer. Short-lived certificates minimise the impact of a key compromise and are a core benefit of using the PKI secrets engine over static certificate storage.

The requested TTL must be less than or equal to the PKI role's max_ttl.