&gt;  You could turn the URL red for a week and then after that do a popup etc.<p>And what does this buy you? Nothing, honestly.  It just means that the expiration date is a week in the future from the date on the certificate. _You aren&#x27;t actually changing the problem, just renaming it._ We could show red a week before the certificate is set to expire _now_; what does a grace period buy anyone?<p>Also, there are still have users that don&#x27;t understand how to check if you have an SSLed connection, and you expect them to make a judgment on if an expired certificate is safe?<p>&gt;  hell you could setup a browser to ignore expiration dates with minimal impact.<p>No, no you couldn&#x27;t.  This means that if an old key, or one you&#x27;ve lost, is compromised, someone would be able to impersonate you, and you may be _unable_ to revoke a certificate. At least now, there is a definite amount of time that a scenario like that could happen for, you&#x27;re proposing it happen indefinitely.<p>Moreover, it also becomes a forced upgrade requirement, viz sha2 certs currently. Sure, some longer-lived certificates may not have been updated (or supported currently), but they&#x27;re not the rule. Most sites updated though a matter of course and never realized the security implications.<p>Additionally, the revocation status of expired certificates isn&#x27;t currently published. Granted, this is a bureaucratic decision, it keeps the CRL size much smaller than it would be otherwise. (And again, it assumes you still have the keys to revoke an old certificate!)<p>&gt; Your stuck in binary terms which are useless from a security standpoint.<p>Right, security isn&#x27;t a binary thing. However, it is often based upon binary things, as they are easy to check, understand, and present. I also resent you calling me &quot;stuck&quot; when you&#x27;re essentially asking for the exact same thing, just differently.