[tech] client certificate expiry

[mbays]

Does it make sense to give a self-signed client certificate an expiration date? I think not, and therefore according to RFC5280 section 4.1.2.5, notAfter should be set to 9999-12-31 23:59.
=> https://tools.ietf.org/html/rfc5280#section-4.1.2.5

The same goes for self-signed server certificates, but I mention this in the context of client certs because the notAfter time gives a way to fingerprint clients. So it would be good for clients which generate client certs to agree on this.