diff --git a/build/build-dist.sh b/build/build-dist.sh
index 5bc91e5..70c13f0 100755
--- a/build/build-dist.sh
+++ b/build/build-dist.sh
@@ -78,6 +78,8 @@ stage_unix() {
 	
 	cp -R "$SRC_ROOT/doc" "$DIST_ROOT/unix/$PV/" || die "failed to copy unix doc"
 
+	sed -i -e "s/~~~/$VERSION/" "$DIST_ROOT/unix/$PV/easyrsa"
+
 	# files not included
 	rm -rf "$DIST_ROOT/unix/$PV/doc/TODO" || die "failed rm TODO"
 }
@@ -92,6 +94,7 @@ stage_win() {
 	for f in $SRC_ROOT/doc/*.md;
 	do
 		fname=$(basename "$f" .md)
+		sed -i -e "s/~~~/$VERSION/" "$SRC_ROOT/$f"
 		python -m markdown "$f" > "$DIST_ROOT/windows/$PV/doc/$fname.html"
 	done
 	
diff --git a/easyrsa3/easyrsa b/easyrsa3/easyrsa
index 5f79bd5..16b219e 100755
--- a/easyrsa3/easyrsa
+++ b/easyrsa3/easyrsa
@@ -1169,10 +1169,10 @@ Note: using Easy-RSA configuration from: $vars"
 	set_var EASYRSA_CURVE		secp384r1
 	set_var EASYRSA_EC_DIR		"$EASYRSA_PKI/ecparams"
 	set_var EASYRSA_CA_EXPIRE	3650
-	set_var EASYRSA_CERT_EXPIRE	3650
+	set_var EASYRSA_CERT_EXPIRE	1080 # new default of 36 months
 	set_var EASYRSA_CRL_DAYS	180
 	set_var EASYRSA_NS_SUPPORT	no
-	set_var EASYRSA_NS_COMMENT	"Easy-RSA Generated Certificate"
+	set_var EASYRSA_NS_COMMENT	"Easy-RSA (~~~) Generated Certificate"
 	set_var EASYRSA_TEMP_CONF	"$EASYRSA_PKI/openssl-easyrsa.temp"
 	set_var EASYRSA_TEMP_EXT	"$EASYRSA_PKI/extensions.temp"
 	set_var EASYRSA_TEMP_FILE_2	""