Index: java/net/deterlab/abac/Credential.java
===================================================================
--- java/net/deterlab/abac/Credential.java	(revision 7f614c15cc77b4a8d54a9633b446742d7450c7ee)
+++ java/net/deterlab/abac/Credential.java	(revision 675770e9a85c4288e78c6408dc507581b393454a)
@@ -24,4 +24,6 @@
  */
 public abstract class Credential implements Comparable {
+    /** Default validity period (in seconds) */
+    static public long defaultValidity = 3600L * 24L * 365L;
     /** The role at the head */
     protected Role m_head
@@ -107,9 +109,19 @@
     }
 
-
-    /**
-     * Create a certificate from this credential issued by the given identity.
-     * Note that catching java.security.GeneralSecurityException catches most
-     * of the exceptions this throws.
+    /**
+     * Create a certificate from this credential issued by the given identity,
+     * valid for the given time.
+     * @param i the Identity that will issue the certificate
+     * @param validity a long holding the number of seconds that the credential
+     * is valid for.
+     * @throws ABACException for Credential-specific errors
+     * @throws MissingIssuerException the identity is invalid
+     * @throws BadSignatureException if the signature creation fails
+     */
+    public abstract void make_cert(Identity i, long validity) 
+	    throws ABACException;
+    /**
+     * Create a certificate from this credential issued by the given identity,
+     * valid for the default interval.
      * @param i the Identity that will issue the certificate
      * @throws ABACException for Credential-specific errors
Index: java/net/deterlab/abac/GENICredential.java
===================================================================
--- java/net/deterlab/abac/GENICredential.java	(revision 7f614c15cc77b4a8d54a9633b446742d7450c7ee)
+++ java/net/deterlab/abac/GENICredential.java	(revision 675770e9a85c4288e78c6408dc507581b393454a)
@@ -389,10 +389,12 @@
 
     /**
-     * Encode the abac credential's XML.  This is straight line code that
-     * directly builds the credential.
+     * Encode the abac credential's XML and set the validity.  This is straight
+     * line code that directly builds the credential.
+     * @param validity a long holding the number of seconds that the credential
+     * is valid for.
      * @return a Node, the place to attach signatures
      * @throws ABACException if any of the XML construction fails
      */
-    protected Node make_rt0_content() throws ABACException {
+    protected Node make_rt0_content(long validity) throws ABACException {
 	DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
 	DocumentBuilder db = null;
@@ -437,9 +439,8 @@
 	cred.appendChild(e);
 
-	/* XXX: pass in valid time */
+	m_expiration = new Date(System.currentTimeMillis() + 
+		(1000L * validity ));
 	df.setTimeZone(new SimpleTimeZone(0, "Z"));
-	df.format(new Date(System.currentTimeMillis() + 
-		    (3600L * 1000L * 24L * 365L)),
-		expBuf, new FieldPosition(0));
+	df.format(m_expiration, expBuf, new FieldPosition(0));
 	e = doc.createElement("expires");
 	text = doc.createTextNode(expBuf.toString());
@@ -462,12 +463,15 @@
 
     /**
-     * Create a certificate from this credential issued by the given identity.
-     * This is the signed XML ABAC credential.
+     * Create a certificate from this credential issued by the given identity
+     * valid for the given time (in seconds).  This is the signed XML ABAC
+     * credential.
      * @param i the Identity that will issue the certificate
+     * @param validity a long holding the number of seconds that the credential
+     * is valid for.
      * @throws ABACException if xml creation fails
      * @throws MissingIssuerException if the issuer is bad
      * @throws BadSignatureException if the signature creation fails
      */
-    public void make_cert(Identity i) 
+    public void make_cert(Identity i, long validity) 
 	    throws ABACException {
 	X509Certificate cert = i.getCertificate();
@@ -511,5 +515,5 @@
 
 	KeyInfo ki = kif.newKeyInfo(keyInfo);
-	Node sig = make_rt0_content();
+	Node sig = make_rt0_content(validity);
 
 	try {
@@ -536,4 +540,18 @@
 	}
 
+    }
+
+    /**
+     * Create a certificate from this credential issued by the given identity
+     * valid for the default validity period.  This is the signed XML ABAC
+     * credential.
+     * @param i the Identity that will issue the certificate
+     * @throws ABACException if xml creation fails
+     * @throws MissingIssuerException if the issuer is bad
+     * @throws BadSignatureException if the signature creation fails
+     */
+    public void make_cert(Identity i) 
+	    throws ABACException {
+	make_cert(i, defaultValidity);
     }
 
Index: java/net/deterlab/abac/GENIPrivCredential.java
===================================================================
--- java/net/deterlab/abac/GENIPrivCredential.java	(revision 7f614c15cc77b4a8d54a9633b446742d7450c7ee)
+++ java/net/deterlab/abac/GENIPrivCredential.java	(revision 675770e9a85c4288e78c6408dc507581b393454a)
@@ -60,8 +60,25 @@
 	m_expiration = e;
     }
-
-    /**
-     * Create a certificate from this credential issued by the given identity.
-     * This is the signed XML ABAC credential.
+    /**
+     * Create a certificate from this credential issued by the given identity
+     * valid for the given period; these credentials cannot be turned into
+     * certificates, so this will always throw an exception.
+     * @param i the Identity that will issue the certificate
+     * @param validity a long holding the number of seconds that the credential
+     * is valid for.
+     * @throws ABACException if xml creation fails
+     * @throws MissingIssuerException if the issuer is bad
+     * @throws BadSignatureException if the signature creation fails
+     */
+    public void make_cert(Identity i, long validity) 
+	    throws ABACException {
+	throw new ABACException("Cannot generate a GENIPrivCredential");
+    }
+
+
+    /**
+     * Create a certificate from this credential issued by the given identity;
+     * these credentials cannot be turned into certificates, so this will
+     * always throw an exception.
      * @param i the Identity that will issue the certificate
      * @throws ABACException if xml creation fails
Index: java/net/deterlab/abac/InternalCredential.java
===================================================================
--- java/net/deterlab/abac/InternalCredential.java	(revision 7f614c15cc77b4a8d54a9633b446742d7450c7ee)
+++ java/net/deterlab/abac/InternalCredential.java	(revision 675770e9a85c4288e78c6408dc507581b393454a)
@@ -36,4 +36,18 @@
      */
     public InternalCredential(Role head, Role tail) {super(head, tail); }
+
+    /**
+     * Create a certificate from this credential issued by the given identity
+     * valid for the given period; this will always fail for an
+     * InternalCredential.
+     * @param i the Identity that will issue the certificate
+     * @param validity a long holding the number of seconds that the credential
+     * is valid for.
+     * @throws ABACException whenever called.
+     */
+    public void make_cert(Identity i, long validity) throws ABACException {
+	throw new ABACException("Cannot create certificate for " +
+		"an InternalCredential");
+    }
 
     /**
Index: java/net/deterlab/abac/X509Credential.java
===================================================================
--- java/net/deterlab/abac/X509Credential.java	(revision 7f614c15cc77b4a8d54a9633b446742d7450c7ee)
+++ java/net/deterlab/abac/X509Credential.java	(revision 675770e9a85c4288e78c6408dc507581b393454a)
@@ -208,13 +208,14 @@
 
     /**
-     * Create a certificate from this credential issued by the given identity.
-     * Note that catching java.security.GeneralSecurityException catches most
-     * of the exceptions this throws.
+     * Create a certificate from this credential issued by the given identity
+     * valid for the given time.
      * @param i the Identity that will issue the certificate
+     * @param validity a long holding the number of seconds that the credential
+     * is valid for.
      * @throws ABACException if xml creation fails
      * @throws MissingIssuerException if the issuer is bad
      * @throws BadSignatureException if the signature creation fails
      */
-    public void make_cert(Identity i) 
+    public void make_cert(Identity i, long validity) 
 	    throws ABACException {
 	PrivateKey key = i.getKeyPair().getPrivate();
@@ -229,6 +230,7 @@
 	    gen.setHolder(new AttributeCertificateHolder(
 			new X500Principal("CN="+m_head.principal())));
-	    gen.setNotAfter(new Date(System.currentTimeMillis() 
-			+ (3600L * 1000L * 24L * 365L)));
+	    m_expiration = new Date(System.currentTimeMillis() 
+		    + (1000L * validity));
+	    gen.setNotAfter(m_expiration);
 	    gen.setNotBefore(new Date(System.currentTimeMillis()));
 	    gen.setSerialNumber(BigInteger.valueOf(System.currentTimeMillis()));
@@ -249,4 +251,16 @@
 	// Create the cert.
 	id = i;
+    }
+
+    /**
+     * Create a certificate from this credential issued by the given identity
+     * valid for the default validity.
+     * @param i the Identity that will issue the certificate
+     * @throws ABACException if xml creation fails
+     * @throws MissingIssuerException if the issuer is bad
+     * @throws BadSignatureException if the signature creation fails
+     */
+    public void make_cert(Identity i) throws ABACException {
+	make_cert(i, defaultValidity);
     }
 
