Prevents issuing credentials with a longer lifetime than the certificate

Signed-off-by: egavard <ewann@bakeup.io>