Although the certificate has a finite validity period it can be revoked at any time. The act of revocation places the serial number of that certificate into a certificate revocation list (CRL). Each certificate will include a link to a location where the latest CRL has been published by the issuer of that certificate. This means that if a certificate is no longer needed or becomes compromised the bearer or subject of that certificate can request that it be revoked. During the validation of a certificate chain all certificates are checked to see if they have been revoked. If the certificate appears on the list it cannot be trusted.
Certificates have a validity period for a number of reasons. Firstly, key length. The validity period is set so that the key length of the certificate will not be "theoretically" broken during the validity period of that certificate. Also, keys should be re-generated, rather than re-issued. This can be enforced by using the private key usage X.509 extension.
Secondly, in a certificate chain the most trusted certificate will have the longest key length. Look at root certificates and you will find that these normally have at least 4096 bit RSA keys. The validity period of the certificate will also be longer. For a root certificate it will be between 10 and 20 years. This depends greatly on the hierarchy of the PKI. PKI hierarchies will usually be 2 or 3 tiers. E.G. RootCA->PolicyCA->IssuanceCA or RootCA->IssuanceCA. The private key of the CA should only be used for half the length of the validity of the certificate. If we take a 3 tier hierarchy, the validity periods of the certificates will be something like:
Root CA (20 years) -> Policy CA (10 years) -> Issuing CA (5 years) -> End Entity (2 years max).
The private key usage period for the CA will be:
Root CA (10 years) -> Policy CA (5 years) -> Issuing CA (2 years max).
The reason for doing this is so that no certificate issued under the root CA will every become invalid because it parent certificate has become invalid.
In the above example the 2nd certificate for the policy CA will be issued under the 2nd key of the root CA, even though the first certificate is of the root CA is still valid. The second certificate of the root CA will be issued after 10 years, just before the 2nd certificate of the policy CA.