Assuming Microsoft Windows (which is safe, I think, since "domain controller"), you can easily set up automatic renewal of certificates. I assume they probably

Assuming Microsoft Windows (which is safe, I think, since "domain controller"), you can easily set up automatic renewal of certificates. I assume they probably have a Windows box running (Enterprise) Certificate Services handling all the "Microsoft PKI" stuff that chains up (eventually) to the DoD roots, but automatic renewal is likely disabled for security reasons -- that security versus convenience trade-off coming into play yet again.