diff --git a/src/ca-module.cpp b/src/ca-module.cpp
index ef41efc..be197d6 100644
--- a/src/ca-module.cpp
+++ b/src/ca-module.cpp
@@ -478,12 +478,13 @@
   certName.append("NDNCERT").appendVersion();
   newCert.setName(certName);
   newCert.setContent(requestState.cert.getContent());
+  newCert.setFreshnessPeriod(1_h);
   NDN_LOG_TRACE("cert request content " << requestState.cert);
   SignatureInfo signatureInfo;
   signatureInfo.setValidityPeriod(period);
   ndn::security::SigningInfo signingInfo(ndn::security::SigningInfo::SIGNER_TYPE_ID,
                                          m_config.caProfile.caPrefix, signatureInfo);
-
+  // Note: we should use KeyChain::makeCertificate() in future.
   m_keyChain.sign(newCert, signingInfo);
   NDN_LOG_TRACE("new cert got signed" << newCert);
   return newCert;
diff --git a/tests/unit-tests/ca-module.t.cpp b/tests/unit-tests/ca-module.t.cpp
index b0d4955..00a3f58 100644
--- a/tests/unit-tests/ca-module.t.cpp
+++ b/tests/unit-tests/ca-module.t.cpp
@@ -476,6 +476,12 @@
       BOOST_CHECK(state.m_status == Status::SUCCESS);
     }
   });
+  ca.setStatusUpdateCallback([](const RequestState& request) {
+    if (request.status == Status::SUCCESS && request.requestType == RequestType::NEW) {
+      BOOST_REQUIRE_NO_THROW(Certificate{request.cert});
+      BOOST_CHECK(Certificate(request.cert).isValid());
+    }
+  });
 
   face.receive(*newInterest);
   advanceClocks(time::milliseconds(20), 60);