Problem is that te certificate is valid for 1 year only and we have to
redeploy it and reencrypt passwords everywhere every year.
Actually, you should be able to get a new certificate while reusing the old keypair. That way you would still have a valid certificate while still beeing able to decrypt any data without reencryption.
how to safely store CA certificate?
The easiest and cheapest (and least secure) way is to have the CA private key in a password encrypted file on a server you consider secure.
One step up would be to buy a smartcard or crypto token which features a PKCS#11 interface for storing the key and doing CA operations.
The most secure option is buying a Hardware Security Module (HSM) which is technically just a very fast and very secure (and very expensive, thinks thousands to tenthousands of Euros) smartcard.
What is a reasonable expiration time for the self signed certificates
derived from our CA?
keylength.com gives an overview how long keys with a certain size can be considered secure from todays perspective. You should not exceed these limits.
Are there tools to make this whole process simpler and secure?
Of course. A small and easy tool would be XCA for instance. If you plan to issue a lot of certificates or more advanced PKI features, the best open source solution out there is EJBCA. Very powerful, but it need considerable more time to get used to it.