Should we factor out this max-certificate-duration value to a module-level constant and/or configuration value?