Renew self-signed LDAP TLS certificate for db.torproject.org

This morning Nagios started complaining about a db.torproject.org certificate:

gitlab-02] SSL cert - db.torproject.org is WARNING: Certificate will expire

This certificate is managed in Puppet, however it's not immediately clear how to renew it, especially since there seem to be two versions of the private key around.