force enclosing voms certificate to have lifetime of parent credential