p11: check if cert is valid before selecting it
    
    Currently the first certificate was selected and if it was not valid
    p11_child just returned an error. With this patch the validity is
    checked first and the first valid certificate is selected.
    
    Resolves https://fedorahosted.org/sssd/ticket/2801
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
    (cherry picked from commit d0de7701d44c7a75210a9cb04634913ce3a94bfb)