title: Is an expired X509 certificate on a website a security issue?
body: <p>Scenario 1: If you are using a self-signed certificate on an internal website, you are still using encryption. The biggest security issue (that I am aware of) is the fact that your browser won't recognize the cert as trusted, and when you tell your browser to trust it, most people won't verify that the certificate you are trusting is actually the certificate on the web server, and not a man-in-the-middle system that replaced your certificate with their own. So the security issue here is clear.</p>
  <p>Scenario 2: With a valid X509 certificate from an actual, globally-trusted CA, when the certificate expires, if you choose to bypass your browser's warning and use the website to login, what is the security issue? You're still using encryption. The private key is still secure on the web server. If a man-in-the-middle system tries to replace the certificate, you'll presumably get a browser warning about the certificate being invalid, rather than a warning about it being expired.</p>
  <p>PS. There's an entire article about the <a href="https://www.globalsign.com/en/ssl-information-center/dangers-expired-ssl-certificates" rel="nofollow noreferrer">Dangers of SSL Certificate Expiration</a>, but all it does is mention the business downsides (not technical downsides) that only apply to public websites (not internal websites), and mention a generic statement like &quot;Personal information at risk from man-in-the-middle attacks&quot; with zero explanation for why they think that is the case. I'm not sure they even know. I feel like most websites on the internet do this for a complex topic like this - they say a generic statement that they assume is true, but don't know why.</p>