1. Fix max days, supposed to be 1000 but was getting set back to 365 in
   one missed place.

2. Add -P option; use the existing passphrase from the DB instead of a
   new one. This makes it easy to update someones encrypted certificate,
   reusing their key (-r) and their password.

Note to self; we do not give Portal users a UI for updating their
encrypted certificates, and we do not do it for them when they
expire. That will need to change real soon (like, by tomorrow morning
when the next user gets an expired certificate error).