CWE-298 covers products that do not check, or check incorrectly, whether a certificate has expired. An expired certificate is one its owner stopped maintaining. Old keys get lost, copied and sold, so trusting them quietly widens who can pose as the server.
How it happens
Expiration checks fail in two common ways. The code verifies the signature and chain but never compares the current time to the validity window. Or it reads the dates and compares them wrongly, for example with the wrong time zone or an inverted comparison.
There is also a lazy path: a developer hits an "expired certificate" error in a test environment and disables date checking to get unblocked.
MITRE lists these observed cases:
- CVE-2025-4384: a product does not verify that a certificate has expired.
- CVE-2007-3564: a web library product does not verify that a certificate has expired.
- CVE-2007-6746: the record lists this ID for an IRC product that does not check the expiration date of the X.509 certificate, and for a library for SSL and TLS that does not check the activation or expiration dates of CA certificates.
What an attacker gains
Data vouched for by an expired certificate may be flawed because of malicious spoofing, and trust may be given to certificates that were abandoned due to age. MITRE lists integrity and authentication as the affected areas.
How to find it
The record has no listed detection methods, but the test is easy to build. Create a certificate that chains to a trusted CA but whose end date is in the past, serve it from a test endpoint, and point your client at it. The connection must fail. Repeat with a certificate whose start date is in the future.
How to fix it
- Check expired certificates and give the user adequate information about the problem and how to proceed, as MITRE advises.
- Use the platform's default TLS validation, which includes date checks, instead of custom verification.
- If you pin certificates, validate all relevant properties before pinning, including the expiration.
- Do not "fix" outages from expired server certificates by loosening the client. Renew the certificate, and automate renewal and monitoring so it does not lapse again.
Quick check
Should clients tolerate a certificate that expired yesterday?
No. A grace period in the client is a hole an attacker can use. Fix renewal on the server side instead.
