Description of problem:
Customer is looking for a way to toggle to stop allowing CA's to be issued past the issuing CA's validity period.  This is a concern that they are seeking to address as they are concerned it goes against their policies.

Version-Release number of selected component (if applicable):
pki-ca*

How reproducible:
Very

Steps to Reproduce:
1. Issue a CA certificate with the date going beyond the issuing CA's validity period


Actual results:
Cert g ets issued with no problems.  All other certs will reset to the notAfter of the issuing CA.

Expected results:
Same as every other cert issued.

Additional info:
This is what occurs for a regular Server cert.  It identifies that the notAfter is past the CA's own and resets it.
[25/Jan/2021:14:46:35][http-bio-8443-exec-5]: CAService: issueX509Cert: cert past CA's NOT_AFTER...ca.enablePastCATime != true...resetting

This is what appears for a CA cert.  It just alerts you of the issue.
[25/Jan/2021:14:48:51][http-bio-8443-exec-5]: CAService: issueX509Cert: CA cert issuance past CA's NOT_AFTER.


And in looking at the code, this was intended.

base/ca/src/com/netscape/ca/CAService.java
            if (end.after(caNotAfter)) {
                if (!is_ca) {
                    if (!engine.getEnablePastCATime()) {
                        end = caNotAfter;
                        certi.set(CertificateValidity.NAME,
                                new CertificateValidity(begin, caNotAfter));
                        logger.debug("CAService: issueX509Cert: cert past CA's NOT_AFTER...ca.enablePastCATime != true...resetting");
                    } else {
                        logger.debug("CAService: issueX509Cert: cert past CA's NOT_AFTER...ca.enablePastCATime = true...not resetting");
                    }
                } else {
                    logger.debug("CAService: issueX509Cert: CA cert issuance past CA's NOT_AFTER.");
                } //!is_ca

                logger.info(CMS.getLogMessage("CMSCORE_CA_PAST_NOT_AFTER"));
            }