diff --git a/Makefile b/Makefile
index e1f3d2b..fda2966 100644
--- a/Makefile
+++ b/Makefile
@@ -7,6 +7,9 @@
 #
 # NOTE: This makefile makes heavy use of Automatic Variables
 #   https://www.gnu.org/software/make/manual/html_node/Automatic-Variables.html
+#  and order-only prerequisites
+#   https://www.gnu.org/software/make/manual/html_node/Prerequisite-Types.html
+#  Please review and understand this documentation before making changes
 
 SHELL = bash -eu -o pipefail
 
@@ -28,6 +31,7 @@
 ROOT_CA_NAME          ?= root_ca
 ROOT_CA_PASSPHRASE    ?= "TestingRootCAPassPhrase"
 ROOT_CA_SUBJECT       ?= /C=US/ST=California/L=Menlo Park/O=ONF/OU=Infra/CN=ONF Test Root CA
+ROOT_EXPIRATION_DAYS  ?= 1825
 
 # intermediate CA
 IM_CA_NAME            ?= im_ca
@@ -38,7 +42,7 @@
 
 # leaf certs
 LEAF_EXPIRATION_DAYS  ?= 730
-LEAF_PURPOSE          ?= server_cert_ext  # alternatively, use client_cert_ext
+LEAF_PURPOSE          ?= server_cert_ext  # alternatively, use client_cert_ext for client certs
 LEAF_SUBJECT_PARTIAL  ?= /C=US/ST=California/L=Menlo Park/O=ONF/OU=Infra/CN=
 LEAF_KEYPAIR          ?= core
 LEAF_SAN              ?= DNS:core.example.com,DNS:core.example.net
@@ -128,13 +132,13 @@
 	  -passout file:$(BASE_DIR)/$(ROOT_CA_NAME)/private/ca_passphrase \
 	  -out $@ $(KEY_SIZE)
 
-# validity time on root CA is set in the .cnf file
-$(BASE_DIR)/$(ROOT_CA_NAME)/ca.pem: $(BASE_DIR)/$(ROOT_CA_NAME)/private/ca_key.pem
+$(BASE_DIR)/$(ROOT_CA_NAME)/ca.pem: | $(BASE_DIR)/$(ROOT_CA_NAME)/private/ca_key.pem
 	@echo "## Creating self-signed root CA cert: $@"
 	BASE_DIR=$(BASE_DIR) CA_NAME=$(ROOT_CA_NAME) openssl req -config $(OPENSSL_CNF) \
 	  -extensions root_ca_ext \
 	  -new -x509 -sha256 \
-	  -key $< \
+	  -days $(ROOT_EXPIRATION_DAYS) \
+	  -key $(@D)/private/ca_key.pem \
 	  -passin file:$(BASE_DIR)/$(ROOT_CA_NAME)/private/ca_passphrase \
 	  -subj "$(ROOT_CA_SUBJECT)" \
 	  -out $@
@@ -148,29 +152,29 @@
 $(BASE_DIR)/$(IM_CA_NAME)/private/ca_passphrase: | $(BASE_DIR)/$(IM_CA_NAME)
 	@echo $(IM_CA_PASSPHRASE) > $@
 
-$(BASE_DIR)/$(IM_CA_NAME)/private/ca_key.pem: $(BASE_DIR)/$(IM_CA_NAME)/private/ca_passphrase
+$(BASE_DIR)/$(IM_CA_NAME)/private/ca_key.pem: | $(BASE_DIR)/$(IM_CA_NAME)/private/ca_passphrase
 	@echo "## Creating intermediate CA private key: $@"
 	BASE_DIR=$(BASE_DIR) CA_NAME=$(IM_CA_NAME) openssl genrsa -aes256 \
 	  -passout file:$(@D)/ca_passphrase \
 	  -out $@ $(KEY_SIZE)
 
-$(BASE_DIR)/$(IM_CA_NAME)/private/im_ca.csr: $(BASE_DIR)/$(IM_CA_NAME)/private/ca_key.pem
+$(BASE_DIR)/$(IM_CA_NAME)/private/im_ca.csr: | $(BASE_DIR)/$(IM_CA_NAME)/private/ca_key.pem
 	@echo "## Creating intermediate CA signing request $@ from $<"
 	BASE_DIR=$(BASE_DIR) CA_NAME=$(IM_CA_NAME) openssl req -config $(OPENSSL_CNF) \
 	  -new -sha256 \
-	  -key $< \
+	  -key $(@D)/ca_key.pem \
 	  -passin file:$(@D)/ca_passphrase \
 	  -subj "$(IM_CA_SUBJECT)" \
 	  -out $@
 
-$(BASE_DIR)/$(IM_CA_NAME)/ca.pem: $(BASE_DIR)/$(IM_CA_NAME)/private/im_ca.csr | $(BASE_DIR)/$(ROOT_CA_NAME)/ca.pem
+$(BASE_DIR)/$(IM_CA_NAME)/ca.pem: | $(BASE_DIR)/$(IM_CA_NAME)/private/im_ca.csr $(BASE_DIR)/$(ROOT_CA_NAME)/ca.pem
 	@echo "## Signing $< with root CA key to create intermediate CA cert: $@"
 	BASE_DIR=$(BASE_DIR) CA_NAME=$(ROOT_CA_NAME) openssl ca -config $(OPENSSL_CNF) \
 	  -extensions im_ca_ext \
 	  -notext -batch -md sha256 \
 	  -days $(IM_EXPIRATION_DAYS) \
 	  -passin file:$(BASE_DIR)/$(ROOT_CA_NAME)/private/ca_passphrase \
-	  -in $< \
+	  -in $(@D)/private/im_ca.csr \
 	  -out $@
 	@echo "## Creating chain with Root CA and IM CA: $@"
 	  cat $@ $(BASE_DIR)/$(ROOT_CA_NAME)/ca.pem > $(@D)/chain.pem
@@ -185,20 +189,20 @@
 $(BASE_DIR)/certout:
 	mkdir -p $@
 
-$(BASE_DIR)/certout/%.key: $(BASE_DIR)/certout
+$(BASE_DIR)/certout/%.key: | $(BASE_DIR)/certout
 	@echo "## Creating leaf private key: $@"
 	openssl genrsa -out $@ $(KEY_SIZE)
 
-$(BASE_DIR)/certout/%.csr: $(BASE_DIR)/certout/%.key
+$(BASE_DIR)/certout/%.csr: | $(BASE_DIR)/certout/%.key
 	@echo "## Creating signing request $@ from $<"
 	BASE_DIR=$(BASE_DIR) CA_NAME=$(IM_CA_NAME) openssl req -config $(OPENSSL_CNF) \
 	  -new -sha256 \
-	  -key $< \
+	  -key $(@D)/$(*F).key \
 	  -subj "$(LEAF_SUBJECT_PARTIAL)$*" \
 	  -addext "subjectAltName = $(LEAF_SAN)" \
 	  -out $@
 
-$(BASE_DIR)/certout/%.pem: $(BASE_DIR)/certout/%.csr | $(BASE_DIR)/$(IM_CA_NAME)/ca.pem
+$(BASE_DIR)/certout/%.pem: | $(BASE_DIR)/certout/%.csr $(BASE_DIR)/$(IM_CA_NAME)/ca.pem
 	@echo "## Signing $< with IM CA key to create signed leaf cert: $@"
 	BASE_DIR=$(BASE_DIR) CA_NAME=$(IM_CA_NAME) openssl ca -config $(OPENSSL_CNF) \
 	  -extensions $(LEAF_PURPOSE) \
@@ -206,7 +210,7 @@
 	  -notext -batch -md sha256 \
 	  -days $(LEAF_EXPIRATION_DAYS) \
 	  -passin file:$(BASE_DIR)/$(IM_CA_NAME)/private/ca_passphrase \
-	  -in $< \
+	  -in $(@D)/$(*F).csr \
 	  -out $@
 	@echo "## Creating bundle with IM CA and Leaf: $(basename $@)_bundle.pem"
 	  cat $@ $(BASE_DIR)/$(IM_CA_NAME)/ca.pem > $(basename $@)_bundle.pem