PKI and other dynamic secret recommendations

[rmb938]

Being that most applications require a signal (or be restarted) to reload certificates and other secrets (i.e nginx and uwsgi) what is the recommendation to handle that? i.e A certificate has an expiry of 90 days and there isn't really a concept of "renewing" it, you just request a new one with the same CSR.

Or is that not really a use case for vault-sidekick? If so is the use case to use it with custom created applications that can detect file system changes and automatically reload on their own?