change certificate lifetime to two years

change certificate lifetime to two years

instead of 10 years, to avoid issues with browsers/os that reject
certificates which have a longer lifetime
(e.g. macOs Catalina only accepts max 825 days if issued after july 2019)

also limit the lifetime by the expiry date of the ca, since
a certifiacte cannot be valid longer than its ca

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>