USER PROBLEM
^{What is the user experiencing as a result of the bug? Include steps to reproduce.}

There is a bug where the Operator would enter an irreconcilable state during CA rotation, after an upgrade from a previous version of ACS that does not support CA rotation, and has a CA older than 4 years:

• Initial central-tls secrets validation determined AddSecondary CA rotation action is needed (typically done after 3 years)
• Post-generation validation now sees that PromoteSecondary CA rotation action is needed
• Which causes "CA rotation action needed" error in post-generation validation

CONDITIONS
^{What conditions need to exist for a user to be affected? Is it everyone? Is it only those with a specific integration? Is it specific to someone with particular database content? etc.}

• pending

ROOT CAUSE
^{What is the root cause of the bug?}

• pending

FIX
^{How was the bug fixed (this is more important if a workaround was implemented rather than an actual fix)?}

• pending