add option to control the expiration period of CA