It can happen that the user configures the Kafka cluster with a custom clients CA and also configures some certificate validity which is shorter than the CA validity. In such case, the user certificate needs to renew even when the CA does not change. This does not work in the User Operator because it never checks the expiration of the certificate. It just waits for the CA certificate to change (which would if the CA expires, but not with a custom CA which might have different validity then the user certs).