RFC5280 says that the nextUpdate field is optional.

Fixes #8085.

R=bradfitz
CC=golang-codereviews
https://golang.org/cl/149770044