As Admiral Piett said, "It's an older code, sir, but it checks out." Without expiry dates on certificates, we're stuck with trusting whatever we've issued fore

As Admiral Piett said, "It's an older code, sir, but it checks out." Without expiry dates on certificates, we're stuck with trusting whatever we've issued forever. Lists of revoked certificates would grow forever, and work even worse than they do today. At least now, we can stop worrying about ancient certificates after they're expired. Having certs expire and be reissued also ensures there's a continual path to upgrade to newer certificates: I suspect you'd have a much harder time retiring SHA-1 certificates if nobody had any regular-interval incentive to replace their certs.