@rockeristul You can take an example config from Acme dB-less example. The config will be in YAML if the dbless config itself is in .yml file.
When using vault, there’s no relationship between the lease time to the certificate valid date. The certificate is created by Kong and stored in vault, not using vault’s PKI.
But do make sure the vault token passed to Kong is valid as there’s currently no renew of token happening.