Rename vpm_int.h to x509_lcl.h
Don't use expired certificates if possible.

When looking for the issuer of a certificate, if current candidate is
expired, continue looking. Only return an expired certificate if no valid
certificates are found.

PR#3359