OpenSSL does not allow access to custom start date without the full 'ca' facility, do the work to set up the full CA and then backdate certificates. This does open the way for managed CA if required.