tls: optionally allow expired TLS client certs. (#3519)

Signed-off-by: Doug Hogan <dhogan@eero.com>

Mirrored from https://github.com/envoyproxy/envoy @ 6d3d5d72986c2131a40268467c3ddcc57ef7bbc7

envoy/api/v2/auth/cert.proto

@@ -213,6 +213,9 @@ message CertificateValidationContext {
   // certificate has not been revoked by this CRL. If this DataSource contains
   // multiple CRLs, all of them will be used.
   core.DataSource crl = 7;
+
+  // If specified, Envoy will not reject expired certificates.
+  bool allow_expired_certificate = 8;
 }
 
 // TLS context shared by both client and server TLS contexts.