Exclude expired certificates from CRL