Roll out to a cluster, canary first
Send a certificate to one node, check it, then the rest.
As pki-admin
Open /renewal/rollout-groups
Click New group
Fill Group name with "web-cluster"
Tick web-01
Tick web-02
Fill Window start with "2"
Fill Window end with "4"
Click Save group
Click web-cluster
