I second this. Was doing security scanning on my deployed website and received warnings that the "max-age" was being flagged with a warning that it's too short.
I'm using the popular security scanner, SSL Labs' SSL Server Test:
https://www.ssllabs.com/ssltest/index.html