Reject stale certificate rotations — Code review | OneNoughtOne