Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I recently discovered that if Windows AD LDS services are bound to a self signed certificate, that processes will continue to trust the cert even if it's expired. My guess is this is because the cert is in the trusted root of the machine making the requests.
What I don't know is, if that same cert is used to bind to an IIS site, will a browser give users error messages and ask them to proceed anyway?
That depends on the browser, the TLS implementation and the settings that influence certificate validation.
Every TLS implementation should not (from a better-security point of view) trust expired certificates, but the default behavior differs and is configurable.
