In our environment, we provide user certificates to sign or encrypt emails. This is an internal setting, meaning the CA is internal to our organization (not a public CA) and handled by our Active Directory PKI.
User certificates are emitted with a duration of one year and automatically renewed by the PKI.
There is however a side effect in Outlook: Whenever a user open an email that was signed or encrypted by a certificate that has since expired, Outlook do not check to see if said certificate has been renewed and issue a warning message stating that the certificate is invalid requiring the user to force the displaying of the message and ignore the warnings.
This is a very bad thing for user education and awareness ("ignore Outlook certificate warnings...")
Given I did not found a way for Outlook to behave properly, I am considering an alternate solution: Issue certificates with unlimited (very long) duration, this way a user certificate will become invalid only after revocation by the PKI (when the user leaves the organization).
This looks like an appropriate policy, but are there any side effects? I did not found any recommendations / best practices by Microsoft so I am wondering if others have experience with this setting and if it is useful to set expiry date for internal user certificates.