certificate: Add helpful text to the 'not yet active' message. A bad clock is going to be the issue in basically all these cases, unless you're explicitly creating interesting certs.