Limit certificate lifetime to a reasonable date

It is operationally beneficial to have certificates run out on a workday. This might be, say, a Tuesday at 10:00. (DFN will limit cert lifetimes to 825 days real soon now.)