diff --git a/src/worker-auth.c b/src/worker-auth.c
index 5c7630fb..37ecf1b8 100644
--- a/src/worker-auth.c
+++ b/src/worker-auth.c
@@ -536,7 +536,7 @@ struct cmd_auth_req_st areq;
 	if (ret < 0)
 		return -1;
 
-	ret = tls_printf(ws->session, "Set-Cookie: webvpn=%s\r\n", str_cookie);
+	ret = tls_printf(ws->session, "Set-Cookie: webvpn=%s;Max-Age=%u\r\n", str_cookie, (unsigned)ws->config->cookie_validity);
 	if (ret < 0)
 		return -1;
 
diff --git a/src/worker-vpn.c b/src/worker-vpn.c
index a768d00d..f00355c0 100644
--- a/src/worker-vpn.c
+++ b/src/worker-vpn.c
@@ -634,7 +634,7 @@ unsigned mtu_overhead, dtls_mtu = 0, tls_mtu = 0;
 		ret = tls_printf(ws->session, "X-DTLS-Port: %u\r\n", ws->config->udp_port);
 		SEND_ERR(ret);
 
-		ret = tls_puts(ws->session, "X-DTLS-Rekey-Time: 86400\r\n");
+		ret = tls_printf(ws->session, "X-DTLS-Rekey-Time: %u\r\n", (unsigned)(2*ws->config->cookie_validity)/3);
 		SEND_ERR(ret);
 
 		ret = tls_printf(ws->session, "X-DTLS-Keepalive: %u\r\n", ws->config->keepalive);