I just found 2 bugs reports that point out that the openssl ca app just puts -startdate and -enddate into the certificate as it was specified on the command line even when it was invalid. We should either reject them or normalize them.

Bugs:
https://gitlab.com/gnutls/gnutls/issues/196
https://bugs.debian.org/862335