@@ -11,8 +11,9 @@ import (

 	kapi "k8s.io/kubernetes/pkg/api"

 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"

-	"k8s.io/kubernetes/pkg/util/crypto"

+	kcrypto "k8s.io/kubernetes/pkg/util/crypto"

+	"github.com/openshift/origin/pkg/cmd/server/crypto"

 	"github.com/openshift/origin/pkg/cmd/templates"

 )

@@ -24,6 +25,8 @@ type CreateClientOptions struct {

 	ClientDir string

 	BaseName  string

+	ExpireDays int

+

 	User   string

 	Groups []string

@@ -41,7 +44,11 @@ var createClientLong = templates.LongDesc(`

 	master as the provided user.`)

 func NewCommandCreateClient(commandName string, fullName string, out io.Writer) *cobra.Command {

-	options := &CreateClientOptions{SignerCertOptions: NewDefaultSignerCertOptions(), Output: out}

+	options := &CreateClientOptions{

+		SignerCertOptions: NewDefaultSignerCertOptions(),

+		ExpireDays:        crypto.DefaultCertificateLifetimeInDays,

+		Output:            out,

+	}

 	cmd := &cobra.Command{

 		Use:   commandName,

@@ -71,6 +78,7 @@ func NewCommandCreateClient(commandName string, fullName string, out io.Writer)

 	flags.StringVar(&options.APIServerURL, "master", "https://localhost:8443", "The API server's URL.")

 	flags.StringVar(&options.PublicAPIServerURL, "public-master", "", "The API public facing server's URL (if applicable).")

 	flags.StringSliceVar(&options.APIServerCAFiles, "certificate-authority", []string{"openshift.local.config/master/ca.crt"}, "Files containing signing authorities to use to verify the API server's serving certificate.")

+	flags.IntVar(&options.ExpireDays, "expire-days", options.ExpireDays, "Validity of the certificates in days (defaults to 2 years). WARNING: extending this above default value is highly discouraged.")

 	// autocompletion hints

 	cmd.MarkFlagFilename("client-dir")

@@ -96,7 +104,7 @@ func (o CreateClientOptions) Validate(args []string) error {

 		return errors.New("certificate-authority must be provided")

 	} else {

 		for _, caFile := range o.APIServerCAFiles {

-			if _, err := crypto.CertPoolFromFile(caFile); err != nil {

+			if _, err := kcrypto.CertPoolFromFile(caFile); err != nil {

 				return fmt.Errorf("certificate-authority must be a valid certificate file: %v", err)

 			}

 		}

@@ -108,7 +116,9 @@ func (o CreateClientOptions) Validate(args []string) error {

 	if err := o.SignerCertOptions.Validate(); err != nil {

 		return err

 	}

-

+	if o.ExpireDays <= 0 {

+		return errors.New("expire-days must be valid number of days")

+	}

 	return nil

 }

@@ -128,12 +138,16 @@ func (o CreateClientOptions) CreateClientFolder() error {

 		SignerCertOptions: o.SignerCertOptions,

 		CertFile:          clientCertFile,

 		KeyFile:           clientKeyFile,

+		ExpireDays:        o.ExpireDays,

 		User:      o.User,

 		Groups:    o.Groups,

 		Overwrite: true,

 		Output:    o.Output,

 	}

+	if err := createClientCertOptions.Validate(nil); err != nil {

+		return err

+	}

 	if _, err := createClientCertOptions.CreateClientCert(); err != nil {

 		return err

 	}

@@ -17,6 +17,8 @@ type CreateClientCertOptions struct {

 	CertFile string

 	KeyFile  string

+	ExpireDays int

+

 	User   string

 	Groups []string

@@ -34,6 +36,9 @@ func (o CreateClientCertOptions) Validate(args []string) error {

 	if len(o.KeyFile) == 0 {

 		return errors.New("key must be provided")

 	}

+	if o.ExpireDays <= 0 {

+		return errors.New("expire-days must be valid number of days")

+	}

 	if len(o.User) == 0 {

 		return errors.New("user must be provided")

 	}

@@ -60,9 +65,9 @@ func (o CreateClientCertOptions) CreateClientCert() (*crypto.TLSCertificateConfi

 	written := true

 	userInfo := &user.DefaultInfo{Name: o.User, Groups: o.Groups}

 	if o.Overwrite {

-		cert, err = signerCert.MakeClientCertificate(o.CertFile, o.KeyFile, userInfo)

+		cert, err = signerCert.MakeClientCertificate(o.CertFile, o.KeyFile, userInfo, o.ExpireDays)

 	} else {

-		cert, written, err = signerCert.EnsureClientCertificate(o.CertFile, o.KeyFile, userInfo)

+		cert, written, err = signerCert.EnsureClientCertificate(o.CertFile, o.KeyFile, userInfo, o.ExpireDays)

 	}

 	if written {

 		glog.V(3).Infof("Generated new client cert as %s and key as %s\n", o.CertFile, o.KeyFile)

@@ -14,9 +14,10 @@ import (

 	kapi "k8s.io/kubernetes/pkg/api"

 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"

-	"k8s.io/kubernetes/pkg/util/crypto"

+	kcrypto "k8s.io/kubernetes/pkg/util/crypto"

 	utilerrors "k8s.io/kubernetes/pkg/util/errors"

+	"github.com/openshift/origin/pkg/cmd/server/crypto"

 	"github.com/openshift/origin/pkg/cmd/templates"

 	"github.com/openshift/origin/pkg/util/parallel"

 )

@@ -72,6 +73,9 @@ type CreateMasterCertsOptions struct {

 	CertDir    string

 	SignerName string

+	ExpireDays       int

+	SignerExpireDays int

+

 	APIServerCAFiles []string

 	CABundleFile     string

@@ -85,7 +89,11 @@ type CreateMasterCertsOptions struct {

 }

 func NewCommandCreateMasterCerts(commandName string, fullName string, out io.Writer) *cobra.Command {

-	options := &CreateMasterCertsOptions{Output: out}

+	options := &CreateMasterCertsOptions{

+		ExpireDays:       crypto.DefaultCertificateLifetimeInDays,

+		SignerExpireDays: crypto.DefaultCACertificateLifetimeInDays,

+		Output:           out,

+	}

 	cmd := &cobra.Command{

 		Use:   commandName,

@@ -113,6 +121,9 @@ func NewCommandCreateMasterCerts(commandName string, fullName string, out io.Wri

 	flags.StringSliceVar(&options.Hostnames, "hostnames", options.Hostnames, "Every hostname or IP that server certs should be valid for (comma-delimited list)")

 	flags.BoolVar(&options.Overwrite, "overwrite", false, "Overwrite all existing cert/key/config files (WARNING: includes signer/CA)")

+	flags.IntVar(&options.ExpireDays, "expire-days", options.ExpireDays, "Validity of the certificates in days (defaults to 2 years). WARNING: extending this above default value is highly discouraged.")

+	flags.IntVar(&options.SignerExpireDays, "signer-expire-days", options.SignerExpireDays, "Validity of the CA certificate in days (defaults to 5 years). WARNING: extending this above default value is highly discouraged.")

+

 	// set dynamic value annotation - allows man pages  to be generated and verified

 	flags.SetAnnotation("signer-name", "manpage-def-value", []string{"openshift-signer@<current_timestamp>"})

@@ -136,6 +147,12 @@ func (o CreateMasterCertsOptions) Validate(args []string) error {

 	if len(o.SignerName) == 0 {

 		return errors.New("signer-name must be provided")

 	}

+	if o.ExpireDays <= 0 {

+		return errors.New("expire-days must be valid number of days")

+	}

+	if o.SignerExpireDays <= 0 {

+		return errors.New("signer-expire-days must be valid number of days")

+	}

 	if len(o.APIServerURL) == 0 {

 		return errors.New("master must be provided")

 	} else if u, err := url.Parse(o.APIServerURL); err != nil {

@@ -153,7 +170,7 @@ func (o CreateMasterCertsOptions) Validate(args []string) error {

 	}

 	for _, caFile := range o.APIServerCAFiles {

-		if _, err := crypto.CertPoolFromFile(caFile); err != nil {

+		if _, err := kcrypto.CertPoolFromFile(caFile); err != nil {

 			return fmt.Errorf("certificate authority must be a valid certificate file: %v", err)

 		}

 	}

@@ -168,6 +185,7 @@ func (o CreateMasterCertsOptions) CreateMasterCerts() error {

 		CertFile:   DefaultCertFilename(o.CertDir, CAFilePrefix),

 		KeyFile:    DefaultKeyFilename(o.CertDir, CAFilePrefix),

 		SerialFile: DefaultSerialFilename(o.CertDir, CAFilePrefix),

+		ExpireDays: o.SignerExpireDays,

 		Name:       o.SignerName,

 		Overwrite:  o.Overwrite,

 		Output:     o.Output,

@@ -261,11 +279,16 @@ func (o CreateMasterCertsOptions) createClientCert(clientCertInfo ClientCertInfo

 		CertFile: clientCertInfo.CertLocation.CertFile,

 		KeyFile:  clientCertInfo.CertLocation.KeyFile,

+		ExpireDays: o.ExpireDays,

+

 		User:      clientCertInfo.User,

 		Groups:    clientCertInfo.Groups.List(),

 		Overwrite: o.Overwrite,

 		Output:    o.Output,

 	}

+	if err := clientCertOptions.Validate(nil); err != nil {

+		return err

+	}

 	if _, err := clientCertOptions.CreateClientCert(); err != nil {

 		return err

 	}

@@ -295,6 +318,8 @@ func (o CreateMasterCertsOptions) createServerCerts(getSignerCertOptions *Signer

 			CertFile: serverCertInfo.CertFile,

 			KeyFile:  serverCertInfo.KeyFile,

+			ExpireDays: o.ExpireDays,

+

 			Hostnames: o.Hostnames,

 			Overwrite: o.Overwrite,

 			Output:    o.Output,

@@ -333,6 +358,7 @@ func (o CreateMasterCertsOptions) createServiceSigningCA(getSignerCertOptions *S

 		CertFile:   caInfo.CertFile,

 		KeyFile:    caInfo.KeyFile,

 		SerialFile: "", // we want the random cert serial for this one

+		ExpireDays: o.SignerExpireDays,

 		Name:       DefaultServiceServingCertSignerName(),

 		Output:     o.Output,

@@ -18,11 +18,12 @@ import (

 	kcmdutil "k8s.io/kubernetes/pkg/kubectl/cmd/util"

 	"k8s.io/kubernetes/pkg/master/ports"

 	"k8s.io/kubernetes/pkg/runtime"

-	"k8s.io/kubernetes/pkg/util/crypto"

+	kcrypto "k8s.io/kubernetes/pkg/util/crypto"

 	"github.com/openshift/origin/pkg/cmd/flagtypes"

 	configapi "github.com/openshift/origin/pkg/cmd/server/api"

 	latestconfigapi "github.com/openshift/origin/pkg/cmd/server/api/latest"

+	"github.com/openshift/origin/pkg/cmd/server/crypto"

 	cmdutil "github.com/openshift/origin/pkg/cmd/util"

 	"github.com/openshift/origin/pkg/cmd/util/variable"

 )

@@ -47,6 +48,7 @@ type CreateNodeConfigOptions struct {

 	ClientKeyFile     string

 	ServerCertFile    string

 	ServerKeyFile     string

+	ExpireDays        int

 	NodeClientCAFile  string

 	APIServerCAFiles  []string

 	APIServerURL      string

@@ -92,6 +94,7 @@ func NewCommandNodeConfig(commandName string, fullName string, out io.Writer) *c

 	flags.StringVar(&options.ClientKeyFile, "client-key", "", "The client key file for the node to contact the API.")

 	flags.StringVar(&options.ServerCertFile, "server-certificate", "", "The server cert file for the node to serve secure traffic.")

 	flags.StringVar(&options.ServerKeyFile, "server-key", "", "The server key file for the node to serve secure traffic.")

+	flags.IntVar(&options.ExpireDays, "expire-days", options.ExpireDays, "Validity of the certificates in days (defaults to 2 years). WARNING: extending this above default value is highly discouraged.")

 	flags.StringVar(&options.NodeClientCAFile, "node-client-certificate-authority", options.NodeClientCAFile, "The file containing signing authorities to use to verify requests to the node. If empty, all requests will be allowed.")

 	flags.StringVar(&options.APIServerURL, "master", options.APIServerURL, "The API server's URL.")

 	flags.StringSliceVar(&options.APIServerCAFiles, "certificate-authority", options.APIServerCAFiles, "Files containing signing authorities to use to verify the API server's serving certificate.")

@@ -111,7 +114,10 @@ func NewCommandNodeConfig(commandName string, fullName string, out io.Writer) *c

 }

 func NewDefaultCreateNodeConfigOptions() *CreateNodeConfigOptions {

-	options := &CreateNodeConfigOptions{SignerCertOptions: NewDefaultSignerCertOptions()}

+	options := &CreateNodeConfigOptions{

+		SignerCertOptions: NewDefaultSignerCertOptions(),

+		ExpireDays:        crypto.DefaultCertificateLifetimeInDays,

+	}

 	options.VolumeDir = "openshift.local.volumes"

 	// TODO: replace me with a proper round trip of config options through decode

 	options.DNSDomain = "cluster.local"

@@ -160,7 +166,7 @@ func (o CreateNodeConfigOptions) Validate(args []string) error {

 		return fmt.Errorf("--certificate-authority must be a valid certificate file")

 	} else {

 		for _, caFile := range o.APIServerCAFiles {

-			if _, err := crypto.CertPoolFromFile(caFile); err != nil {

+			if _, err := kcrypto.CertPoolFromFile(caFile); err != nil {

 				return fmt.Errorf("--certificate-authority must be a valid certificate file: %v", err)

 			}

 		}

@@ -197,6 +203,10 @@ func (o CreateNodeConfigOptions) Validate(args []string) error {

 		}

 	}

+	if o.ExpireDays < 0 {

+		return errors.New("expire-days must be valid number of days")

+	}

+

 	return nil

 }

@@ -285,6 +295,8 @@ func (o CreateNodeConfigOptions) MakeClientCert(clientCertFile, clientKeyFile st

 			CertFile: clientCertFile,

 			KeyFile:  clientKeyFile,

+			ExpireDays: o.ExpireDays,

+

 			User:   "system:node:" + o.NodeName,

 			Groups: []string{bootstrappolicy.NodesGroup},

 			Output: o.Output,

@@ -317,6 +329,8 @@ func (o CreateNodeConfigOptions) MakeAndWriteServerCert(serverCertFile, serverKe

 			CertFile: serverCertFile,

 			KeyFile:  serverKeyFile,

+			ExpireDays: o.ExpireDays,

+

 			Hostnames: o.Hostnames,

 			Output:    o.Output,

 		}

@@ -75,6 +75,7 @@ func makeSignerCert(t *testing.T) (string, string, string) {

 		CertFile:   certFile.Name(),

 		KeyFile:    keyFile.Name(),

 		SerialFile: serialFile.Name(),

+		ExpireDays: 365,

 		Name:       "unit-test-signer",

 		Overwrite:  true,

 	}

@@ -23,6 +23,8 @@ type CreateServerCertOptions struct {

 	CertFile string

 	KeyFile  string

+	ExpireDays int

+

 	Hostnames []string

 	Overwrite bool

 	Output    io.Writer

@@ -46,7 +48,11 @@ var createServerLong = templates.LongDesc(`

 	`)

 func NewCommandCreateServerCert(commandName string, fullName string, out io.Writer) *cobra.Command {

-	options := &CreateServerCertOptions{SignerCertOptions: NewDefaultSignerCertOptions(), Output: out}

+	options := &CreateServerCertOptions{

+		SignerCertOptions: NewDefaultSignerCertOptions(),

+		ExpireDays:        crypto.DefaultCertificateLifetimeInDays,

+		Output:            out,

+	}

 	cmd := &cobra.Command{

 		Use:   commandName,

@@ -72,6 +78,8 @@ func NewCommandCreateServerCert(commandName string, fullName string, out io.Writ

 	flags.StringSliceVar(&options.Hostnames, "hostnames", options.Hostnames, "Every hostname or IP you want server certs to be valid for. Comma delimited list")

 	flags.BoolVar(&options.Overwrite, "overwrite", true, "Overwrite existing cert files if found.  If false, any existing file will be left as-is.")

+	flags.IntVar(&options.ExpireDays, "expire-days", options.ExpireDays, "Validity of the certificate in days (defaults to 2 years). WARNING: extending this above default value is highly discouraged.")

+

 	// autocompletion hints

 	cmd.MarkFlagFilename("cert")

 	cmd.MarkFlagFilename("key")

@@ -93,6 +101,10 @@ func (o CreateServerCertOptions) Validate(args []string) error {

 		return errors.New("key must be provided")

 	}

+	if o.ExpireDays <= 0 {

+		return errors.New("expire-days must be valid number of days")

+	}

+

 	if o.SignerCertOptions == nil {

 		return errors.New("signer options are required")

 	}

@@ -114,9 +126,9 @@ func (o CreateServerCertOptions) CreateServerCert() (*crypto.TLSCertificateConfi

 	var ca *crypto.TLSCertificateConfig

 	written := true

 	if o.Overwrite {

-		ca, err = signerCert.MakeAndWriteServerCert(o.CertFile, o.KeyFile, sets.NewString([]string(o.Hostnames)...))

+		ca, err = signerCert.MakeAndWriteServerCert(o.CertFile, o.KeyFile, sets.NewString([]string(o.Hostnames)...), o.ExpireDays)

 	} else {

-		ca, written, err = signerCert.EnsureServerCert(o.CertFile, o.KeyFile, sets.NewString([]string(o.Hostnames)...))

+		ca, written, err = signerCert.EnsureServerCert(o.CertFile, o.KeyFile, sets.NewString([]string(o.Hostnames)...), o.ExpireDays)

 	}

 	if written {

 		glog.V(3).Infof("Generated new server certificate as %s, key as %s\n", o.CertFile, o.KeyFile)

@@ -20,6 +20,7 @@ type CreateSignerCertOptions struct {

 	CertFile   string

 	KeyFile    string

 	SerialFile string

+	ExpireDays int

 	Name       string

 	Output     io.Writer

@@ -33,6 +34,8 @@ func BindCreateSignerCertOptions(options *CreateSignerCertOptions, flags *pflag.

 	flags.StringVar(&options.Name, prefix+"name", DefaultSignerName(), "The name of the signer.")

 	flags.BoolVar(&options.Overwrite, prefix+"overwrite", options.Overwrite, "Overwrite existing cert files if found.  If false, any existing file will be left as-is.")

+	flags.IntVar(&options.ExpireDays, "expire-days", options.ExpireDays, "Validity of the certificate in days (defaults to 5 years). WARNING: extending this above default value is highly discouraged.")

+

 	// set dynamic value annotation - allows man pages  to be generated and verified

 	flags.SetAnnotation(prefix+"name", "manpage-def-value", []string{"openshift-signer@<current_timestamp>"})

@@ -46,7 +49,11 @@ var createSignerLong = templates.LongDesc(`

 	Create a self-signed CA key/cert for signing certificates used by server components.`)

 func NewCommandCreateSignerCert(commandName string, fullName string, out io.Writer) *cobra.Command {

-	options := &CreateSignerCertOptions{Overwrite: true, Output: out}

+	options := &CreateSignerCertOptions{

+		ExpireDays: crypto.DefaultCACertificateLifetimeInDays,

+		Output:     out,

+		Overwrite:  true,

+	}

 	cmd := &cobra.Command{

 		Use:   commandName,

@@ -78,6 +85,9 @@ func (o CreateSignerCertOptions) Validate(args []string) error {

 	if len(o.KeyFile) == 0 {

 		return errors.New("key must be provided")

 	}

+	if o.ExpireDays <= 0 {

+		return errors.New("expire-days must be valid number of days")

+	}

 	if len(o.Name) == 0 {

 		return errors.New("name must be provided")

 	}

@@ -91,9 +101,9 @@ func (o CreateSignerCertOptions) CreateSignerCert() (*crypto.CA, error) {

 	var err error

 	written := true

 	if o.Overwrite {

-		ca, err = crypto.MakeCA(o.CertFile, o.KeyFile, o.SerialFile, o.Name)

+		ca, err = crypto.MakeCA(o.CertFile, o.KeyFile, o.SerialFile, o.Name, o.ExpireDays)

 	} else {

-		ca, written, err = crypto.EnsureCA(o.CertFile, o.KeyFile, o.SerialFile, o.Name)

+		ca, written, err = crypto.EnsureCA(o.CertFile, o.KeyFile, o.SerialFile, o.Name, o.ExpireDays)

 	}

 	if written {

 		glog.V(3).Infof("Generated new CA for %s: cert in %s and key in %s\n", o.Name, o.CertFile, o.KeyFile)

@@ -174,12 +174,9 @@ func GetTLSCertificateConfig(certFile, keyFile string) (*TLSCertificateConfig, e

 	return &TLSCertificateConfig{certs, key}, nil

 }

-var (

-	// Default ca certs to be long-lived

-	caLifetime = time.Hour * 24 * 365 * 5

-

-	// Default templates to last for two years

-	lifetime = time.Hour * 24 * 365 * 2

+const (

+	DefaultCertificateLifetimeInDays   = 365 * 2 // 2 years

+	DefaultCACertificateLifetimeInDays = 365 * 5 // 5 years

 	// Default keys are 2048 bits

 	keyBits = 2048

@@ -261,11 +258,11 @@ func (s *RandomSerialGenerator) Next(template *x509.Certificate) (int64, error)

 // EnsureCA returns a CA, whether it was created (as opposed to pre-existing), and any error

 // if serialFile is empty, a RandomSerialGenerator will be used

-func EnsureCA(certFile, keyFile, serialFile, name string) (*CA, bool, error) {

+func EnsureCA(certFile, keyFile, serialFile, name string, expireDays int) (*CA, bool, error) {

 	if ca, err := GetCA(certFile, keyFile, serialFile); err == nil {

 		return ca, false, err

 	}

-	ca, err := MakeCA(certFile, keyFile, serialFile, name)

+	ca, err := MakeCA(certFile, keyFile, serialFile, name, expireDays)

 	return ca, true, err

 }

@@ -293,17 +290,14 @@ func GetCA(certFile, keyFile, serialFile string) (*CA, error) {

 }

 // if serialFile is empty, a RandomSerialGenerator will be used

-func MakeCA(certFile, keyFile, serialFile, name string) (*CA, error) {

+func MakeCA(certFile, keyFile, serialFile, name string, expireDays int) (*CA, error) {

 	glog.V(2).Infof("Generating new CA for %s cert, and key in %s, %s", name, certFile, keyFile)

 	// Create CA cert

 	rootcaPublicKey, rootcaPrivateKey, err := NewKeyPair()

 	if err != nil {

 		return nil, err

 	}

-	rootcaTemplate, err := newSigningCertificateTemplate(pkix.Name{CommonName: name})

-	if err != nil {

-		return nil, err

-	}

+	rootcaTemplate := newSigningCertificateTemplate(pkix.Name{CommonName: name}, expireDays, time.Now)

 	rootcaCert, err := signCertificate(rootcaTemplate, rootcaPublicKey, rootcaTemplate, rootcaPrivateKey)

 	if err != nil {

 		return nil, err

@@ -335,10 +329,10 @@ func MakeCA(certFile, keyFile, serialFile, name string) (*CA, error) {

 	}, nil

 }

-func (ca *CA) EnsureServerCert(certFile, keyFile string, hostnames sets.String) (*TLSCertificateConfig, bool, error) {

+func (ca *CA) EnsureServerCert(certFile, keyFile string, hostnames sets.String, expireDays int) (*TLSCertificateConfig, bool, error) {

 	certConfig, err := GetServerCert(certFile, keyFile, hostnames)

 	if err != nil {

-		certConfig, err = ca.MakeAndWriteServerCert(certFile, keyFile, hostnames)

+		certConfig, err = ca.MakeAndWriteServerCert(certFile, keyFile, hostnames, expireDays)

 		return certConfig, true, err

 	}

@@ -363,10 +357,10 @@ func GetServerCert(certFile, keyFile string, hostnames sets.String) (*TLSCertifi

 	return nil, fmt.Errorf("Existing server certificate in %s was missing some hostnames (%v) or IP addresses (%v).", certFile, missingDns, missingIps)

 }

-func (ca *CA) MakeAndWriteServerCert(certFile, keyFile string, hostnames sets.String) (*TLSCertificateConfig, error) {

+func (ca *CA) MakeAndWriteServerCert(certFile, keyFile string, hostnames sets.String, expireDays int) (*TLSCertificateConfig, error) {

 	glog.V(4).Infof("Generating server certificate in %s, key in %s", certFile, keyFile)

-	server, err := ca.MakeServerCert(hostnames)

+	server, err := ca.MakeServerCert(hostnames, expireDays)

 	if err != nil {

 		return nil, err

 	}

@@ -376,9 +370,9 @@ func (ca *CA) MakeAndWriteServerCert(certFile, keyFile string, hostnames sets.St

 	return server, nil

 }

-func (ca *CA) MakeServerCert(hostnames sets.String) (*TLSCertificateConfig, error) {

+func (ca *CA) MakeServerCert(hostnames sets.String, expireDays int) (*TLSCertificateConfig, error) {

 	serverPublicKey, serverPrivateKey, _ := NewKeyPair()

-	serverTemplate, _ := newServerCertificateTemplate(pkix.Name{CommonName: hostnames.List()[0]}, hostnames.List())

+	serverTemplate := newServerCertificateTemplate(pkix.Name{CommonName: hostnames.List()[0]}, hostnames.List(), expireDays, time.Now)

 	serverCrt, err := ca.signCertificate(serverTemplate, serverPublicKey)

 	if err != nil {

 		return nil, err

@@ -390,17 +384,17 @@ func (ca *CA) MakeServerCert(hostnames sets.String) (*TLSCertificateConfig, erro

 	return server, nil

 }

-func (ca *CA) EnsureClientCertificate(certFile, keyFile string, u user.Info) (*TLSCertificateConfig, bool, error) {

+func (ca *CA) EnsureClientCertificate(certFile, keyFile string, u user.Info, expireDays int) (*TLSCertificateConfig, bool, error) {

 	certConfig, err := GetTLSCertificateConfig(certFile, keyFile)

 	if err != nil {

-		certConfig, err = ca.MakeClientCertificate(certFile, keyFile, u)

+		certConfig, err = ca.MakeClientCertificate(certFile, keyFile, u, expireDays)

 		return certConfig, true, err // true indicates we wrote the files.

 	}

 	return certConfig, false, nil

 }

-func (ca *CA) MakeClientCertificate(certFile, keyFile string, u user.Info) (*TLSCertificateConfig, error) {

+func (ca *CA) MakeClientCertificate(certFile, keyFile string, u user.Info, expireDays int) (*TLSCertificateConfig, error) {

 	glog.V(4).Infof("Generating client cert in %s and key in %s", certFile, keyFile)

 	// ensure parent dirs

 	if err := os.MkdirAll(filepath.Dir(certFile), os.FileMode(0755)); err != nil {

@@ -411,7 +405,7 @@ func (ca *CA) MakeClientCertificate(certFile, keyFile string, u user.Info) (*TLS

 	}

 	clientPublicKey, clientPrivateKey, _ := NewKeyPair()

-	clientTemplate, _ := newClientCertificateTemplate(x509request.UserToSubject(u))

+	clientTemplate := newClientCertificateTemplate(x509request.UserToSubject(u), expireDays, time.Now)

 	clientCrt, err := ca.signCertificate(clientTemplate, clientPublicKey)

 	if err != nil {

 		return nil, err

@@ -455,31 +449,53 @@ func NewKeyPair() (crypto.PublicKey, crypto.PrivateKey, error) {

 }

 // Can be used for CA or intermediate signing certs

-func newSigningCertificateTemplate(subject pkix.Name) (*x509.Certificate, error) {

+func newSigningCertificateTemplate(subject pkix.Name, expireDays int, currentTime func() time.Time) *x509.Certificate {

+	var caLifetimeInDays = DefaultCACertificateLifetimeInDays

+	if expireDays > 0 {

+		caLifetimeInDays = expireDays

+	}

+

+	if caLifetimeInDays > DefaultCACertificateLifetimeInDays {

+		warnAboutCertificateLifeTime(subject.CommonName, DefaultCACertificateLifetimeInDays)

+	}

+

+	caLifetime := time.Duration(caLifetimeInDays) * 24 * time.Hour

+

 	return &x509.Certificate{

 		Subject: subject,

 		SignatureAlgorithm: x509.SHA256WithRSA,

-		NotBefore:    time.Now().Add(-1 * time.Second),

-		NotAfter:     time.Now().Add(caLifetime),

+		NotBefore:    currentTime().Add(-1 * time.Second),

+		NotAfter:     currentTime().Add(caLifetime),

 		SerialNumber: big.NewInt(1),

 		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,

 		BasicConstraintsValid: true,

 		IsCA: true,

-	}, nil

+	}

 }

 // Can be used for ListenAndServeTLS

-func newServerCertificateTemplate(subject pkix.Name, hosts []string) (*x509.Certificate, error) {

+func newServerCertificateTemplate(subject pkix.Name, hosts []string, expireDays int, currentTime func() time.Time) *x509.Certificate {

+	var lifetimeInDays = DefaultCertificateLifetimeInDays

+	if expireDays > 0 {

+		lifetimeInDays = expireDays

+	}

+

+	if lifetimeInDays > DefaultCertificateLifetimeInDays {

+		warnAboutCertificateLifeTime(subject.CommonName, DefaultCertificateLifetimeInDays)

+	}

+

+	lifetime := time.Duration(lifetimeInDays) * 24 * time.Hour

+

 	template := &x509.Certificate{

 		Subject: subject,

 		SignatureAlgorithm: x509.SHA256WithRSA,

-		NotBefore:    time.Now().Add(-1 * time.Second),

-		NotAfter:     time.Now().Add(lifetime),

+		NotBefore:    currentTime().Add(-1 * time.Second),

+		NotAfter:     currentTime().Add(lifetime),

 		SerialNumber: big.NewInt(1),

 		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,

@@ -489,7 +505,7 @@ func newServerCertificateTemplate(subject pkix.Name, hosts []string) (*x509.Cert

 	template.IPAddresses, template.DNSNames = IPAddressesDNSNames(hosts)

-	return template, nil

+	return template

 }

 func IPAddressesDNSNames(hosts []string) ([]net.IP, []string) {

@@ -542,20 +558,37 @@ func CertsFromPEM(pemCerts []byte) ([]*x509.Certificate, error) {

 }

 // Can be used as a certificate in http.Transport TLSClientConfig

-func newClientCertificateTemplate(subject pkix.Name) (*x509.Certificate, error) {

+func newClientCertificateTemplate(subject pkix.Name, expireDays int, currentTime func() time.Time) *x509.Certificate {

+	var lifetimeInDays = DefaultCertificateLifetimeInDays

+	if expireDays > 0 {

+		lifetimeInDays = expireDays

+	}

+

+	if lifetimeInDays > DefaultCertificateLifetimeInDays {

+		warnAboutCertificateLifeTime(subject.CommonName, DefaultCertificateLifetimeInDays)

+	}

+

+	lifetime := time.Duration(lifetimeInDays) * 24 * time.Hour

+

 	return &x509.Certificate{

 		Subject: subject,

 		SignatureAlgorithm: x509.SHA256WithRSA,

-		NotBefore:    time.Now().Add(-1 * time.Second),

-		NotAfter:     time.Now().Add(lifetime),

+		NotBefore:    currentTime().Add(-1 * time.Second),

+		NotAfter:     currentTime().Add(lifetime),

 		SerialNumber: big.NewInt(1),

 		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,

 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},

 		BasicConstraintsValid: true,

-	}, nil

+	}

+}

+

+func warnAboutCertificateLifeTime(name string, defaultLifetimeInDays int) {

+	defaultLifetimeInYears := defaultLifetimeInDays / 365

+	fmt.Fprintf(os.Stderr, "WARNING: Validity period of the certificate for %q is greater than %d years!\n", name, defaultLifetimeInYears)

+	fmt.Fprintln(os.Stderr, "WARNING: By security reasons it is strongly recommended to change this period and make it smaller!")

 }

 func signCertificate(template *x509.Certificate, requestKey crypto.PublicKey, issuer *x509.Certificate, issuerKey crypto.PrivateKey) (*x509.Certificate, error) {

@@ -6,8 +6,11 @@ import (

 	"crypto/x509/pkix"

 	"fmt"

 	"testing"

+	"time"

 )

+const certificateLifetime = 365 * 2

+

 func TestCrypto(t *testing.T) {

 	roots := x509.NewCertPool()

 	intermediates := x509.NewCertPool()

@@ -78,10 +81,7 @@ func buildCA(t *testing.T) (crypto.PrivateKey, *x509.Certificate) {

 	if err != nil {

 		t.Fatalf("Unexpected error: %#v", err)

 	}

-	caTemplate, err := newSigningCertificateTemplate(pkix.Name{CommonName: "CA"})

-	if err != nil {

-		t.Fatalf("Unexpected error: %#v", err)

-	}

+	caTemplate := newSigningCertificateTemplate(pkix.Name{CommonName: "CA"}, certificateLifetime, time.Now)

 	caCrt, err := signCertificate(caTemplate, caPublicKey, caTemplate, caPrivateKey)

 	if err != nil {

 		t.Fatalf("Unexpected error: %#v", err)

@@ -94,10 +94,7 @@ func buildIntermediate(t *testing.T, signingKey crypto.PrivateKey, signingCrt *x

 	if err != nil {

 		t.Fatalf("Unexpected error: %#v", err)

 	}

-	intermediateTemplate, err := newSigningCertificateTemplate(pkix.Name{CommonName: "Intermediate"})

-	if err != nil {

-		t.Fatalf("Unexpected error: %#v", err)

-	}

+	intermediateTemplate := newSigningCertificateTemplate(pkix.Name{CommonName: "Intermediate"}, certificateLifetime, time.Now)

 	intermediateCrt, err := signCertificate(intermediateTemplate, intermediatePublicKey, signingCrt, signingKey)

 	if err != nil {

 		t.Fatalf("Unexpected error: %#v", err)

@@ -113,10 +110,8 @@ func buildServer(t *testing.T, signingKey crypto.PrivateKey, signingCrt *x509.Ce

 	if err != nil {

 		t.Fatalf("Unexpected error: %#v", err)

 	}

-	serverTemplate, err := newServerCertificateTemplate(pkix.Name{CommonName: "Server"}, []string{"127.0.0.1", "localhost", "www.example.com"})

-	if err != nil {

-		t.Fatalf("Unexpected error: %#v", err)

-	}

+	hosts := []string{"127.0.0.1", "localhost", "www.example.com"}

+	serverTemplate := newServerCertificateTemplate(pkix.Name{CommonName: "Server"}, hosts, certificateLifetime, time.Now)

 	serverCrt, err := signCertificate(serverTemplate, serverPublicKey, signingCrt, signingKey)

 	if err != nil {

 		t.Fatalf("Unexpected error: %#v", err)

@@ -132,10 +127,7 @@ func buildClient(t *testing.T, signingKey crypto.PrivateKey, signingCrt *x509.Ce

 	if err != nil {

 		t.Fatalf("Unexpected error: %#v", err)

 	}

-	clientTemplate, err := newClientCertificateTemplate(pkix.Name{CommonName: "Client"})

-	if err != nil {

-		t.Fatalf("Unexpected error: %#v", err)

-	}

+	clientTemplate := newClientCertificateTemplate(pkix.Name{CommonName: "Client"}, certificateLifetime, time.Now)

 	clientCrt, err := signCertificate(clientTemplate, clientPublicKey, signingCrt, signingKey)

 	if err != nil {

 		t.Fatalf("Unexpected error: %#v", err)

@@ -167,11 +159,118 @@ func TestRandomSerialGenerator(t *testing.T) {

 	generator := &RandomSerialGenerator{}

 	hostnames := []string{"foo", "bar"}

-	template, err := newServerCertificateTemplate(pkix.Name{CommonName: hostnames[0]}, hostnames)

-	if err != nil {

-		t.Fatalf("unexpected error: %v", err)

-	}

+	template := newServerCertificateTemplate(pkix.Name{CommonName: hostnames[0]}, hostnames, certificateLifetime, time.Now)

 	if _, err := generator.Next(template); err != nil {

 		t.Fatalf("unexpected error: %v", err)

 	}

 }

+

+func TestValidityPeriodOfClientCertificate(t *testing.T) {

+	currentTime := time.Now()

+

+	currentFakeTime := func() time.Time {

+		return currentTime

+	}

+

+	tests := []struct {

+		passedExpireDays int

+		realExpireDays   int

+	}{

+		{

+			passedExpireDays: 100,

+			realExpireDays:   100,

+		},

+		{

+			passedExpireDays: 0,

+			realExpireDays:   DefaultCertificateLifetimeInDays,

+		},

+		{

+			passedExpireDays: -1,

+			realExpireDays:   DefaultCertificateLifetimeInDays,

+		},

+	}

+

+	for _, test := range tests {

+		cert := newClientCertificateTemplate(pkix.Name{CommonName: "client"}, test.passedExpireDays, currentFakeTime)

+		expirationDate := cert.NotAfter

+		expectedExpirationDate := currentTime.Add(time.Duration(test.realExpireDays) * 24 * time.Hour)

+		if expectedExpirationDate != expirationDate {

+			t.Errorf("expected that client certificate will expire at %v but found %v", expectedExpirationDate, expirationDate)

+		}

+	}

+}

+

+func TestValidityPeriodOfServerCertificate(t *testing.T) {

+	currentTime := time.Now()

+

+	currentFakeTime := func() time.Time {

+		return currentTime

+	}

+

+	tests := []struct {

+		passedExpireDays int

+		realExpireDays   int

+	}{

+		{

+			passedExpireDays: 100,

+			realExpireDays:   100,

+		},

+		{

+			passedExpireDays: 0,

+			realExpireDays:   DefaultCertificateLifetimeInDays,

+		},

+		{

+			passedExpireDays: -1,

+			realExpireDays:   DefaultCertificateLifetimeInDays,

+		},

+	}

+

+	for _, test := range tests {

+		cert := newServerCertificateTemplate(

+			pkix.Name{CommonName: "server"},

+			[]string{"www.example.com"},

+			test.passedExpireDays,

+			currentFakeTime,

+		)

+		expirationDate := cert.NotAfter

+		expectedExpirationDate := currentTime.Add(time.Duration(test.realExpireDays) * 24 * time.Hour)

+		if expectedExpirationDate != expirationDate {

+			t.Errorf("expected that server certificate will expire at %v but found %v", expectedExpirationDate, expirationDate)

+		}

+	}

+}

+

+func TestValidityPeriodOfSigningCertificate(t *testing.T) {

+	currentTime := time.Now()

+

+	currentFakeTime := func() time.Time {

+		return currentTime

+	}

+

+	tests := []struct {

+		passedExpireDays int

+		realExpireDays   int

+	}{

+		{

+			passedExpireDays: 100,

+			realExpireDays:   100,

+		},

+		{

+			passedExpireDays: 0,

+			realExpireDays:   DefaultCACertificateLifetimeInDays,

+		},

+		{

+			passedExpireDays: -1,

+			realExpireDays:   DefaultCACertificateLifetimeInDays,

+		},

+	}

+

+	for _, test := range tests {

+		cert := newSigningCertificateTemplate(pkix.Name{CommonName: "CA"}, test.passedExpireDays, currentFakeTime)

+		expirationDate := cert.NotAfter

+		expectedExpirationDate := currentTime.Add(time.Duration(test.realExpireDays) * 24 * time.Hour)

+		if expectedExpirationDate != expirationDate {

+			t.Errorf("expected that CA certificate will expire at %v but found %v", expectedExpirationDate, expirationDate)

+		}

+	}

+}

@@ -23,6 +23,7 @@ import (

 	"github.com/openshift/origin/pkg/cmd/server/admin"

 	configapi "github.com/openshift/origin/pkg/cmd/server/api"

+	"github.com/openshift/origin/pkg/cmd/server/crypto"

 	"github.com/openshift/origin/pkg/cmd/server/start/kubernetes"

 	"github.com/openshift/origin/pkg/cmd/templates"

 	cmdutil "github.com/openshift/origin/pkg/cmd/util"

@@ -33,6 +34,8 @@ type AllInOneOptions struct {

 	NodeArgs *NodeArgs

+	ExpireDays         int

+	SignerExpireDays   int

 	ConfigDir          util.StringFlag

 	NodeConfigFile     string

 	PrintIP            bool

@@ -63,7 +66,14 @@ var allInOneLong = templates.LongDesc(`

 // NewCommandStartAllInOne provides a CLI handler for 'start' command

 func NewCommandStartAllInOne(basename string, out, errout io.Writer) (*cobra.Command, *AllInOneOptions) {

-	options := &AllInOneOptions{Output: out, MasterOptions: &MasterOptions{Output: out}}

+	options := &AllInOneOptions{

+		MasterOptions: &MasterOptions{

+			Output: out,

+		},

+		ExpireDays:       crypto.DefaultCertificateLifetimeInDays,

+		SignerExpireDays: crypto.DefaultCACertificateLifetimeInDays,

+		Output:           out,

+	}

 	options.MasterOptions.DefaultsFromName(basename)

 	cmds := &cobra.Command{

@@ -100,6 +110,8 @@ func NewCommandStartAllInOne(basename string, out, errout io.Writer) (*cobra.Com

 	flags.BoolVar(&options.MasterOptions.CreateCertificates, "create-certs", true, "Indicates whether missing certs should be created.")

 	flags.BoolVar(&options.PrintIP, "print-ip", false, "Print the IP that would be used if no master IP is specified and exit.")

 	flags.StringVar(&options.ServiceNetworkCIDR, "portal-net", NewDefaultNetworkArgs().ServiceNetworkCIDR, "The CIDR string representing the network that portal/service IPs will be assigned from. This must not overlap with any IP ranges assigned to nodes for pods.")

+	flags.IntVar(&options.ExpireDays, "expire-days", options.ExpireDays, "Validity of the certificates in days (defaults to 2 years). WARNING: extending this above default value is highly discouraged.")

+	flags.IntVar(&options.SignerExpireDays, "signer-expire-days", options.SignerExpireDays, "Validity of the CA certificate in days (defaults to 5 years). WARNING: extending this above default value is highly discouraged.")

 	masterArgs, nodeArgs, listenArg, imageFormatArgs, _ := GetAllInOneArgs()

 	options.MasterOptions.MasterArgs, options.NodeArgs = masterArgs, nodeArgs

@@ -194,6 +206,13 @@ func (o AllInOneOptions) Validate(args []string) error {

 		return errors.New("all-in-one cannot start with a remote Kubernetes server, start the master instead")

 	}

+	if o.ExpireDays < 0 {

+		return errors.New("expire-days must be valid number of days")

+	}

+	if o.SignerExpireDays < 0 {

+		return errors.New("signer-expire-days must be valid number of days")

+	}

+

 	return nil

 }

@@ -268,11 +287,18 @@ func (o AllInOneOptions) StartAllInOne() error {

 		return nil

 	}

 	masterOptions := *o.MasterOptions

+	masterOptions.ExpireDays = o.ExpireDays

+	masterOptions.SignerExpireDays = o.SignerExpireDays

 	if err := masterOptions.RunMaster(); err != nil {