Here is the HowTO for ZCM 10 Using an External Certificate Authority.

[HamboneNovell]

From my limited experience the Expiry Date on a certificate is set by the certificate authority but requested by the CSR.

When generating the certificate request you can ask for a different expiry ( usually by indicating the number of days that the certificate will last for ).

Then, depending on the Certificate Authority used ( MS CA Ent will accept this parameter and if missing defaults to 2 yrs. MS CA Std will not accept this parameter and will default to 1yr. ).