When signing or generating certificates, you can now set the certificate time to live, either with a command line option or by specifying the key directly in the HTTP API. The time unit defaults to seconds, but you can specify a different time unit with any of time unit markers accepted in Puppet configuration.

The puppetserver ca sign and puppetserver ca generate commands accept a --ttl flag to set certificate time to live. This setting determines how long the resulting certificate is valid for.