I recently discovered that if Windows AD LDS services are bound to a self signed certificate, that processes will continue to trust the cert even if it's expired. My guess is this is because the cert is in the trusted root of the machine making the requests.

What I don't know is, if that same cert is used to bind to an IIS site, will a browser give users error messages and ask them to proceed anyway?

1 Answer 1


That depends on the browser, the TLS implementation and the settings that influence certificate validation.

Every TLS implementation should not (from a better-security point of view) trust expired certificates, but the default behavior differs and is configurable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .