Explanation
Box 1: 30 days
We cannot tell for sure without the exhibit. It would likely be either 30 or 90 days.
The Azure Stack Hub root certificate is provisioned during deployment with an expiration of five years.
Starting with 2108, internal secret rotation also rotates the root certificate. The standard secret expiration alert identifies the expiry of the root certificate and generates alerts at both 90 (warning) and 30 (critical) days.
Note: Manual remediation
If the Repair option is not supported, be sure to follow the complete set of remediation instructions provided in the alert. As an example, the internal certificate expiration remediation steps will guide you through the process of secret rotation:
Graphical user interface, text, application Description automatically generated

Box 2: running the Start-SecreatRotation -Internal PowerShell cmdlet from the priveged endpoint (PEP) session Start-SecretRotation cmdlet rotates the infrastructure secrets of an Azure Stack Hub system. This cmdlet can only be executed against the Azure Stack Hub privileged endpoint, by using an Invoke-Command script block passing the PEP session in the -Session parameter. By default, it rotates only the certificates of all external network infrastructure endpoints.
Reference:
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-rotate-secrets
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-monitor-health