For example, you could have a parameter on the cert that caused clients to probabilistically reject it 1&#x2F;10000&#x27;th of the time when in the last month of the cert&#x27;s lifetime (so there are really two deadlines, the probabilistic-failure one and the total-failure one). That would give you the same warning about the coming total failure, without hindring as many users.