It was noticed that the default
java implementation of
PKIX trust manager algorithm (
X509ExtendedTrustManager) doesn't really check the expiration date of a client's certificate during SSL authentication.
This could be easily checked: configure
Apache Tomcat 7.x with SSL client auth. Put in the trust store an expired client certificate. On the client side set the system time to a past time, when the certificate was not expired. Voila, the client can successfully authenticate on the web server.
The question is: is such a behaviour correct and appropriate to RFC 3280, or it is a bug?