1.  Oh, I guessed you were talking about certs.   If you called it 'cookie_duration' I wouldn't have had to ask
2.  Reasonable defaults should be the default :).  I find suffixes helpful for time periods.
3.  I don't care which we use.  Snake case for config files is what we do.  Consistency is good. Lets go shopping?