[COOK-2737] - fixes from testing

* Set the keyfile separate from the cert.
* Default expiration to 10 years
* Use string instead of integer (for consistency).