Renew self-signed LDAP TLS certificate for db.torproject.org

This morning Nagios started complaining about a db.torproject.org certificate:

gitlab-02] SSL cert - db.torproject.org is WARNING: Certificate will expire

This certificate is managed in Puppet, however it's not immediately clear how to renew it, especially since there seem to be two versions of the private key around.

Edited Jan 25, 2022 by Jérôme Charaoui

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information