code: func (m *manager) nextRotationDeadline() time.Time {
  	// forceRotation is not protected by locks
  	if m.forceRotation {
  		m.forceRotation = false
  		return time.Now()
  	}
  
  	m.certAccessLock.RLock()
  	defer m.certAccessLock.RUnlock()
  
  	if !m.certSatisfiesTemplateLocked() {
  		return time.Now()
  	}
  
  	notAfter := m.cert.Leaf.NotAfter
  	totalDuration := float64(notAfter.Sub(m.cert.Leaf.NotBefore))
  	deadline := m.cert.Leaf.NotBefore.Add(jitteryDuration(totalDuration))
  
  	klog.V(2).Infof("Certificate expiration is %v, rotation deadline is %v", notAfter, deadline)
  	if m.certificateExpiration != nil {
  		m.certificateExpiration.Set(float64(notAfter.Unix()))
  	}
  	return deadline
  }
docs: // nextRotationDeadline returns a value for the threshold at which the
  // current certificate should be rotated, 80%+/-10% of the expiration of the
  // certificate.