I have the following scenario:

When the leaf certificate expires, the intermediate certificate is checked and if the intermediate is not expired, the application will keep running and will not be affected, while the leaf is getting updated.

It is like adding a condition to check the validity of the intermediate certificate in the step of checking the validity of the leaf certificate.

Is something like this possible? If so, will there be any security problems with doing this?

  • or, just get more lenient with how long the leaf cert can be expired for ...
    – schroeder
    Aug 23, 2022 at 11:16
  • 1
    Why check the intermediate at all? What benefit do you perceive by doing that?
    – schroeder
    Aug 23, 2022 at 11:43
  • I thought that by doing so, the users would not be affected by the expiry of leaf, and after the adding new leaf, they would not need to update the app immediately.
    – ishi
    Aug 23, 2022 at 11:54

2 Answers 2


What you're asking is basically "is it safe to ignore leaf expiry". Officially, the answer is "probably not". For example, the reason that I have to get Let's Encrypt to re-certify my web server's keypair every 90 days is that revocation infrastructure/process is generally abysmal, even for applications that do attempt to implement it. Clients' refusal to respect long-lived leaf keys is a "stop-gap" mitigation of this.

If your server's TLS private key ever gets compromised, configuring your client applications to ignore leaf expiry like you're proposing would basically change the attacker's window of usefulness from ≤90d to up to 5 years, assuming (and I think this likely) you don't have any serious process in place for getting revocation notices of compromised keys' certificates to the clients.


Is something like this possible?

In your application you can implement any logic you want. But you should understand the consequences. The traffic of your application will not be secure.

Expiration date is needed to reduce the probability of certificate compromising. If the certificate is expired, the application cannot know if a new certificate is ordered. If certificate is expired, how long do you want your application to trust it? A minute, an hour, a year, 10 years?

The proper way to avoid downtime because of expired certificates is to order the next certificate in advance. Its validity period should begin when the old one ends, or usually a few days earlier. You install new certificate and remove the old one. Thus you avoid an TLS downtime.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .