pfSense

Sounds like a y2k38 issue (32-bit timestamp rollover), though in this case it's a PHP or OpenSSL bug. We pass the lifetime to the OpenSSL create function specified in days, not a timestamp. The PHP OpenSSL module does the real calculations internally.

This would need to be reported upstream to PHP, unless it also happens when making a certificate with OpenSSL directly, in which case it should be reported to OpenSSL.

Unfortunately there's nothing we can do about it. Just use a duration that would end before the rollover date (03:14:08 UTC on 19 January 2038)