website/docs: update certificate doc (#18295)

* Update line

* Add expiry information

* Apply suggestion from @dominic-r

Co-authored-by: Dominic R <[email protected]>
Signed-off-by: Dewi Roberts <[email protected]>

* Apply suggestions

* Improve language

* Apply suggestions

---------

Signed-off-by: Dewi Roberts <[email protected]>
Co-authored-by: Dominic R <[email protected]>

Author: dewi-tik

website/docs/sys-mgmt/certificates.md

@@ -20,6 +20,24 @@ While this certificate can be used for SAML providers/sources, remember that it'
 
 For SAML use-cases, you can generate a certificate with a longer validity period (at your own risk).
 
+## Certificate considerations
+
+### OAuth and SAML
+
+For OAuth and SAML providers, in the vast majority of cases, certificate expiry does not matter. Most service providers don't check whether certificates are expired. What usually matters is that the signature is valid.
+
+However, there are some notable exceptions; for example, the Slack SAML integration does check for certificate expiry.
+
+We recommend checking your service provider's documentation for specific requirements.
+
+### Proxy provider and brands
+
+We recommend using a certificate generated outside of authentik that matches your Fully Qualified Domain Name (FQDN), preferably issued by a publicly trusted certificate authority.
+
+### Radius EAP-TLS
+
+We recommend using a certificate generated outside of authentik. A privately issued certificate is sufficient.
+
 ## Downloading SAML certificates
 
 To download a certificate for SAML configuration:
@@ -49,7 +67,9 @@ Certificate discovery can be manually initiated by restarting the `certificate_d
 - **Docker Compose**: A `certs` directory is mapped to `/certs` within the worker container.
 - **Kubernetes**: You can mount custom Secrets or Volumes under `/certs` and configure them in the worker Pod specification.
 
-authentik checks for new or changed files every hour and automatically triggers an outpost refresh when changes are detected.
+When a new key pair is added or changed, authentik automatically triggers an outpost refresh.
+
+When a new key pair is added with a private key that already exists in the database, authentik updates the existing key pair's certificate instead of creating a duplicate one.
 
 ### Manual imports