Add a -days flag to specify the validity period.

The hard-coded default of 2 years, 3 months works for most applications.
However, some applications enforce that the certificate is only valid
for a short period and this default is too long.

For example, WebRTC fingerprinting enforces a max duration of 30 days.
WebTransport is even more extreme and rejects certs valid for more than
14 days. These certificates are meant to be ephemeral.

Fixes FiloSottile#339 FiloSottile#343

cert.go

@@ -158,7 +158,7 @@ func (m *mkcert) makeCert(hosts []string) {
 	// Certificates last for 2 years and 3 months, which is always less than
 	// 825 days, the limit that macOS/iOS apply to all certificates,
 	// including custom roots. See https://support.apple.com/en-us/HT210176.
-	expiration := time.Now().AddDate(2, 3, 0)
+	expiration := time.Now().AddDate(0, 0, m.days)
 
 	tpl := &x509.Certificate{
 		SerialNumber: randomSerialNumber(),
@@ -397,7 +397,7 @@ func (m *mkcert) makeCertFromCSR() {
 	fatalIfErr(err, "failed to parse the CSR")
 	fatalIfErr(csr.CheckSignature(), "invalid CSR signature")
 
-	expiration := time.Now().AddDate(2, 3, 0)
+	expiration := time.Now().AddDate(0, 0, m.days)
 	tpl := &x509.Certificate{
 		SerialNumber:    randomSerialNumber(),
 		Subject:         csr.Subject,

main.go

@@ -70,6 +70,10 @@ const advancedUsage = `Advanced options:
 	-CAROOT
 	    Print the CA certificate and key storage location.
 
+	-days INT
+		Generate a certificate valid for the specified number of days.
+		The default is 810, which is just under the macOS/iOS limit of 825.
+
 	$CAROOT (environment variable)
 	    Set the CA certificate and key storage location. (This allows
 	    maintaining multiple local CAs in parallel.)
@@ -106,7 +110,8 @@ func main() {
 		p12FileFlag   = flag.String("p12-file", "", "")
 		versionFlag   = flag.Bool("version", false, "")
 		//add params of custom cert expiration time
-		certYears   = flag.Int("cert-years", 10, "10")
+		certYears = flag.Int("cert-years", 10, "10")
+		daysFlag  = flag.Int("days", 810, "")
 	)
 	flag.Usage = func() {
 		fmt.Fprint(flag.CommandLine.Output(), shortUsage)
@@ -150,7 +155,8 @@ func main() {
 		installMode: *installFlag, uninstallMode: *uninstallFlag, csrPath: *csrFlag,
 		pkcs12: *pkcs12Flag, ecdsa: *ecdsaFlag, client: *clientFlag,
 		certFile: *certFileFlag, keyFile: *keyFileFlag, p12File: *p12FileFlag,
-		certYears:*certYears,
+		certYears: *certYears,
+		days:      *daysFlag,
 	}).Run(flag.Args())
 }
 
@@ -162,6 +168,7 @@ type mkcert struct {
 	pkcs12, ecdsa, client      bool
 	keyFile, certFile, p12File string
 	csrPath                    string
+	days                       int
 
 	CAROOT string
 	caCert *x509.Certificate
@@ -245,7 +252,7 @@ func (m *mkcert) Run(args []string) {
 
 	//m.makeCert(args)
 	//add params of custom cert expiration time
-	m.makeCertCustom(args,m.certYears)
+	m.makeCertCustom(args, m.certYears)
 }
 
 func getCAROOT() string {