How can mTLS be implemented in FastAPI with a strategy where the server certificate expires after 10 years, and the client certificates imported in the web browser expire after one year?

Currently, both certificates expire on the same day since PKCS#12 does not have a flag for specifying different expiration durations.

openssl genpkey -algorithm RSA -out server-key.pem
openssl req -new -key server-key.pem -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey server-key.pem -out server-cert.pem

openssl pkcs12 -export -out client.p12 -inkey server-key.pem -in server-cert.pem