cert-crypto: implement certificate expiration