Align Validity Period definition with RFC 5280

[CBonnell]

Fixes #467.

[zakird]

This looks correct to me offhand, but would be good to get a second pair of eyes from @sleevi.

[sleevi]

Yeah, the fractional validity depends on the accuracy of the client clock, given that UTCTime/GeneralizedTime in the abstract can represent fractional seconds, even if 5280 forbids them. That is, a cert with a notAfter (HHMMSS) at 000000Z and checked at 000000.001Z is expired, but if checked at 000000.000Z, valid, and the validity period was effectively (.001 seconds),

Thus, in theory, the validity period is 0 seconds (some infinitesimal slice of a second), but since machines aren’t that accurate, it’s typically 1ns when computed.

This LGTM as a change, and definitely underscores the SHOULD 397 days to avoid such issues entirely.

[cpu]

@zakird @sleevi Do one of you want to try the release instructions to cut a v2.2.0-rc2 release with this fix?