I am adding a `prune` option to `ipa-cacert-manage` (as discussed in
The test for this option would be to have an expired cert installed and
that it is deleted after running the command, but I'm not sure how to add
expired certificate in first place. Any pointers on this?