The validUntil attribute should have a dateTime type set to UTC, which is questionable because python's isoformat() doesn't put the tzinfo, which violates ISO-8601, but I am not here to argue that. For some applications (SimpleSAMLphp) that "validate" the metadata, they kick back the metadata provided by ipsilon because it doesn't have a "Z" at the end of the dateTime. There are a few workarounds mentioned in http://stackoverflow.com/questions/19654578/python-utc-datetime-objects-iso-format-dont-include-z-zulu-or-zero-offset .. but I think the easiest is:

d.isoformat() + 'Z'

Along this same pattern, I am not sure when a "timedelta" would come into play, but datetime.datetime.now() should probably be datetime.datetime.utcnow() to ensure consistency. I know that will only matter on one very special day (certificate expiration day), but its probably better to have it corrected while adding the "Z"