create client certificates with generous not_before (fixes #5884)

i don't see any reason to not have a generous not_before value, and making it valid far back in the past allows bitmask clients to work even if the device has a bad date set.