Snow 2388762 crl post review fixes

[sfc-gh-pczajka]

Please answer these questions before submitting your pull requests. Thanks!

1. What GitHub issue is this PR addressing? Make sure that there is an accompanying issue to your PR.

   Fixes #NNNN

2. Fill out the following pre-review checklist:

   • I am adding a new automated test(s) to verify correctness of my new code
   • I am adding new logging messages
   • I am adding a new telemetry message
   • I am modifying authorization mechanisms
   • I am adding new credentials
   • I am modifying OCSP code
   • I am adding a new dependency

3. Please describe how your code solves the related issue.

   Please write a short description of how your code change solves the related issue.

4. (Optional) PR for stored-proc connector:

[sfc-gh-jkasten]

nit: The not_valid_after field is inclusive. This will calculate that the lifetime is 1 second shorter than it actually is. I think this falls on the safe side of the equation down below, (it will treat certificates as short-lived which are technically not).

RFC 5280 Section 4.1.2.5 text

The other thing you have to worry here is an underlying library trying to include leap seconds on you.
It is common in the WebPKI to give a little buffer and to stay away from the edges[design doc]. Competent CAs will always give a lot of breathing room away from the edges.