diff --git a/metropolis/pkg/pki/ca.go b/metropolis/pkg/pki/ca.go
index 4931b5e..7c03f9f 100644
--- a/metropolis/pkg/pki/ca.go
+++ b/metropolis/pkg/pki/ca.go
@@ -60,7 +60,7 @@
 
 	req.Template.SerialNumber = serialNumber
 	req.Template.NotBefore = time.Now()
-	req.Template.NotAfter = unknownNotAfter
+	req.Template.NotAfter = UnknownNotAfter
 	req.Template.BasicConstraintsValid = true
 	req.Template.SubjectKeyId = skid
 
diff --git a/metropolis/pkg/pki/x509.go b/metropolis/pkg/pki/x509.go
index e198902..40e7a08 100644
--- a/metropolis/pkg/pki/x509.go
+++ b/metropolis/pkg/pki/x509.go
@@ -27,7 +27,7 @@
 
 var (
 	// From RFC 5280 Section 4.1.2.5
-	unknownNotAfter = time.Unix(253402300799, 0)
+	UnknownNotAfter = time.Unix(253402300799, 0)
 )
 
 // Workaround for https://github.com/golang/go/issues/26676 in Go's