Does the X.509 standard claim to check client certificate's expiration date on server side?

Consider an expired client certificate in the trust store of web server. If some client tries to authenticate with an expired certificate, should the server (with trust manager algorithm X.509) reject such authentication and certificate?

Please, in your answers, provide links and sections numbers on official documentation (RFC).


2 Answers 2


I don't think there is a specific standard dealing with client certificates. There is a general mechanism for certificate validation (RFC 5280) and the whole system of CRL assumes that certificates have a limited lifetime, because the CRL is only used for certificates which are not yet expired.

But note that the whole process of validating the trust chain and lifetime is only relevant if validation is done based on a PKI. If the server simply trusts a specific certificate or public key and the client sends exactly this certificate than the server might ignore any additional validations.


In the case presented, the client is the Subscriber who should comply with the Subscriber Agreement published by the Certification Authority, and the server is the Relying Party who should comply with the Relying Party Agreement also published by the CA. Those agreements should (but might not) specify the level of trust expected of the various fields of the certificate.

Like many standards, X.509 and the PKI RFCs specify mechanism but not policy - that is left to the humans using the system to specify and implement.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .