As Admiral Piett said, &quot;It&#x27;s an older code, sir, but it checks out.&quot;<p>Without expiry dates on certificates, we&#x27;re stuck with trusting whatever we&#x27;ve issued forever.  Lists of revoked certificates would grow forever, and work even worse than they do today.  At least now, we can stop worrying about ancient certificates after they&#x27;re expired.<p>Having certs expire and be reissued also ensures there&#x27;s a continual path to upgrade to newer certificates: I suspect you&#x27;d have a much harder time retiring SHA-1 certificates if nobody had any regular-interval incentive to replace their certs.