Turns out accepting the date "00-00-0000 00:00" is deprecated, and rejected by default. We still do this when creating rows for not-yet-revoked certificates in the certificateStatus table, and maybe elsewhere. We should instead write some other dummy date (the unix epoch?) and then explicitly set the NO_ZERO_DATE boolean in our DSN.