the CA expiration date is unfortunately not a separate attribute on the CA itself. It is available if you wish to parse out the dates from the Certificate(s) on the CA, just not exposed in a separate attribute at this time.

The date values are exposed in separate attributes on the Certificate object and those attributes are added/updated by the PKI Health Check process.

A quick solution might be adding the attributes "NDSPKI:Not After" and "NDSPKI:Not Before" to the CA object (class=NDSPKI:Certificate Authority), just like they are on the Certificate objects (class=NDSPKI:Key Material). The "NDSPKI:Public Key Certificate" attribute has the full Certificate including the valid dates embedded does exist on both object classes.

There is also the NDSPKI:Public Key Certificate EC that may come in to play these days as well.

The CA expiration date is an attribute on the object. You can read it from an LDAP search.