cli authentication using expired cert throws an exception

Steps to Reproduce:

1. Install CA instance
2. Create an Administrator user with a certificate that has validity of 1 day.
3. Push the system date to next 2 days
4. pki -v -d . -c **** -n CA_AdminE -h pki1.example.com -p 20080 ca-group-add
test

Actual results:

[root@pki1 certdb]# pki -v -d . -c **** -n CA_AdminE -h pki1.example.com -p
20080 ca-group-add test
PKI options: -v -d . -c Secret123
PKI command: CA_AdminE -n CA_AdminE -h pki1.example.com -p 20080 ca-group-add
test
Java command: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java
-Djava.ext.dirs=/usr/share/pki/lib
-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties
com.netscape.cmstools.cli.MainCLI -d . -c Secret123 --verbose -n CA_AdminE -h
pki1.example.com -p 20080 ca-group-add test
Server URI: http://pki1.example.com:20080
Client security database: /root/multihost_tests/certdb/.
Message format: null
Command: ca-group-add test
Initializing client security database
Logging into security token
HTTP request: GET /pki/rest/info HTTP/1.1
    Accept-Encoding: gzip, deflate
    Accept: application/xml
    Host: pki1.example.com:20080
    Connection: Keep-Alive
    User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 200 OK
    Server: Apache-Coyote/1.1
    Set-Cookie: JSESSIONID=8F4C188C076A75E9439CCDCAC0F272BA; Path=/pki/; HttpOnly
    Content-Type: application/xml
    Content-Length: 106
    Date: Sat, 01 Apr 2017 21:00:46 GMT
Module: ca
HTTP request: GET /ca/rest/account/login HTTP/1.1
    Accept-Encoding: gzip, deflate
    Accept: application/xml
    Host: pki1.example.com:20080
    Connection: Keep-Alive
    User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
HTTP response: HTTP/1.1 302 Found
    Server: Apache-Coyote/1.1
    Cache-Control: private
    Expires: Wed, 31 Dec 1969 19:00:00 EST
    Location: https://pki1.example.com:20443/ca/rest/account/login
    Content-Length: 0
    Date: Sat, 01 Apr 2017 21:00:46 GMT
HTTP redirect: https://pki1.example.com:20443/ca/rest/account/login
Client certificate: CA_AdminE
HTTP request: GET /ca/rest/account/login HTTP/1.1
    Accept-Encoding: gzip, deflate
    Accept: application/xml
    Host: pki1.example.com:20443
    Connection: Keep-Alive
    User-Agent: Apache-HttpClient/4.2.5 (java 1.5)
Server certificate:
CN=pki1.example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org
javax.ws.rs.ProcessingException: Unable to invoke request
    at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invo

ke(ApacheHttpClient4Engine.java:287)
at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(Cli
entInvocation.java:407)
at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(
ClientInvoker.java:102)
at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(Cl
ientProxy.java:62)
at com.sun.proxy.$Proxy32.login(Unknown Source)
at
com.netscape.certsrv.account.AccountClient.login(AccountClient.java:45)
at
com.netscape.certsrv.client.SubsystemClient.login(SubsystemClient.java:47)
at com.netscape.cmstools.cli.CACLI.login(CACLI.java:58)
at com.netscape.cmstools.cli.SubsystemCLI.execute(SubsystemCLI.java:54)
at com.netscape.cmstools.cli.CLI.execute(CLI.java:337)
at com.netscape.cmstools.cli.MainCLI.execute(MainCLI.java:573)
at com.netscape.cmstools.cli.MainCLI.main(MainCLI.java:609)
Caused by: java.io.IOException: SocketException cannot write on socket
at org.mozilla.jss.ssl.SSLSocket.write(SSLSocket.java:1188)
at org.mozilla.jss.ssl.SSLOutputStream.write(SSLOutputStream.java:24)
at org.apache.http.impl.io.AbstractSessionOutputBuffer.flushBuffer(Abst
ractSessionOutputBuffer.java:147)
at org.apache.http.impl.io.AbstractSessionOutputBuffer.flush(AbstractSe
ssionOutputBuffer.java:154)
at org.apache.http.impl.AbstractHttpClientConnection.doFlush(AbstractHt
tpClientConnection.java:278)
at org.apache.http.impl.AbstractHttpClientConnection.flush(AbstractHttp
ClientConnection.java:283)
at org.apache.http.impl.conn.ManagedClientConnectionImpl.flush(ManagedC
lientConnectionImpl.java:175)
at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpReque
stExecutor.java:260)
at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExec
utor.java:125)
at org.apache.http.impl.client.DefaultRequestDirector.tryExecute(Defaul
tRequestDirector.java:715)
at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRe
questDirector.java:520)
at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpC
lient.java:906)
at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpC
lient.java:805)
at org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient4Engine.invo
ke(ApacheHttpClient4Engine.java:283)
... 11 more
ERROR: Command '[u'/usr/lib/jvm/jre-1.8.0-openjdk/bin/java',
u'-Djava.ext.dirs=/usr/share/pki/lib',
u'-Djava.util.logging.config.file=/usr/share/pki/etc/logging.properties',
'com.netscape.cmstools.cli.MainCLI', '-d', '.', '-c', 'Secret123', '--verbose',
'-n', 'CA_AdminE', '-h', 'pki1.example.com', '-p', '20080', 'ca-group-add',
'test']' returned non-zero exit status 255

Expected results:

The cli should give an appropriate error message