Users can't change their own active flag
Make more room for cert-end column