By default Elastic operator generates self-signed certificates automatically in the form secrets. Does the operator take care of cert rotation?
Yes.
Certificates are configured for a validity of 1 year by default. They are rotated automatically 24h before that 1 year period is reached.
You can tweak those periods through operator configuration: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-operator-config.html.