add support for:
- Issuing certificates to be valid in the future
- Overriding the default 2hr window certs can be downloaded from S3