Since only the keypair is cached, certificates are generated on each startup. This means they never expire (unless you run your application without any interruptions for a whole year).

But yeah, if they're leaked you just gotta re-send them to the clients. This isn't meant for large professional projects, only for stuff where the convenience outweights the pros of using a proper certificate.