Bump validity of all certificates to 10 years

It is both more convenient and makes sure we don't get
"single moment" validity for CA certificates with certain OpenSSL
versions on OS X/BSD.