create client certificates with generous not_before (fixes #5884)