So, that'd be the same for a private CA with short lifetime certs used with TLS, right?