* introduce cert opts * it should be using the same signer * lint and omit serial
* Switch to WithinDuration to improve test This test was flaky before because of the time logic. Now it uses WithinDuration and should be correct. Fixes https://github.com/hashicorp/consul/issues/6857.