pki: Support absolute --not-before/after issued certificate lifetimes