There is no need for enforced expiry of certificates, especially here where there are used internally on a controlled network. If there is a requirement or goo

There is no need for enforced expiry of certificates, especially here where there are used internally on a controlled network. If there is a requirement or good practice to periodically replace key-pairs then it should be a network management operation. Equipment should never stop working because it decided that a key-pair had expired. X509 certificates are not technically optimal in many situations and, let's face it, the main driver for expiry dates is that certificate vendors want to sell more certificates...