I noticed that, while browsing through many bug bounty and vulnerability disclosure programs, they don't accept issues that are related to TLS/SSL, which includes expired security certificates.
Why are companies so unwilling to accept expired certificates, which can easily be fixed?
Why are companies so unwilling to accept expired certificates, which can easily be fixed?
With proper certificate validation a client will not connect to a server which provides an expired certificate. This means that no data will be exchanged over the improperly secured connection. This also means that there is no actual security problem - only an availability problem.
Sure, there are clients which might ignore that the certificate is expired or users which skip browsers warnings. But in this case the real issue is improper certificate validation at the client side, not the expired certificate.
Other answers here have addressed the security side of expired certificates. I am going to address the bug bounty side of the question.
If the company's main/live domain(s) has an expired certificate; they sure know about it. Their tech support switchboard has just lit up with all these calls about an 'insecure site'.
If there is an expired cert (or even a self-signed cert) on one of their domains it is likely abandoned, or for internal use only.
Publishing a bug bounty scheme implies that the company is going to pay money for bug reports.
By being up front about excluding this sort of thing they stop low-effort scanners going over their domains and submitting bug reports. This has a dual effect of not wasting the company's time and preventing the negative publicity on social media when the person submitting the report doesn't get a payout.
Update:
As bta points out in their excellent comment, it would also be trivial to scan domains, save the current expiry date and revisit them again at that time in the hope of getting a bug report out of this.
I would also think that the restriction is merely a type of gatekeeping. If a seasoned security researcher spotted an actual problem; say a % of a company's application servers used an out of date version of - for example - OpenSSL that allowed downgrade attacks, that researcher would know enough about the situation to submit a report anyway. My guess is that such a report would be paid on, whatever the policy says.
SSL certificate expiration is a low-effort "just in case" measure against a possible SSL private key leak which theoretically allows to perform a MiTM attack which is not a small feat at all nowadays considering things like DoT/DoH/DNSSec. Serious hostile actors can hack people while being on the same LAN as them or by hacking any intermediate Internet provider/network which many (if not most) governments can do.
So, unless a SSL private key has been leaked, there's no vulnerability at all. In all honesty if your clients can stomach the "certificate has expired" warning, it's all good and secure.
TLDR: bug bountys are to tell me something that I don't know.
Expired SSL certs are an annoyance that can be automatically detected. there is no point to pay a human operator for something that can be monitored and predicted using automated software, or even a calendar.
Revoked certs are another matter these certs may indicate an actual risk, but these are still detectable by automated means.
Nevertheless in both cases if they are not detected by IT staff they will likely be reported by users almost immediately when they cease to work, so bug bounty reports will only be duplicating something that is already known.
