I am adding a `prune` option to `ipa-cacert-manage` (as discussed in https://pagure.io/freeipa/issue/7404).
The test for this option would be to have an expired cert installed and check
that it is deleted after running the command, but I'm not sure how to add an
expired certificate in first place. Any pointers on this?

Thank you!