&gt; <i>If you download a signed executable, but the signing certificate expired a while ago, does that mean you don&#x27;t trust the executable?</i><p>Indeed, no you don&#x27;t---not on the basis of cryptographic reasoning, at least.<p>Certificates expire for a reason. That reason is the assumption that they are being actively cracked, and so have a limited shelf life. You can trust a 2005 certificate only to the extent that you bank on the underlying private key not to have been cracked.<p>If the key is cracked, then the attackers can create a brand new file, and make it look like its existence had been certified in 2005.<p>Old stuff that still matters has to be re-certified with new certificates in the face the impending expiry of the old ones.