How does the built-in UI cert get updated? 

This is a question in reference to the default Rancher SSL certificate attached to the Rancher UI that is Issued to "dynamic" and Issued by "dynamiclistener-ca".  We notice that is occasionally renewed (the "Valid to" date changes), but cannot figure out what triggers it to renew.  Neither a container restart or a container upgrade on its own seems to force it.  How does it work?