Expired certificates are not checked for revocation, so it could have been compromised and revoked, but your browser wouldn't block the connection. Unfortunate

Expired certificates are not checked for revocation, so it could have been compromised and revoked, but your browser wouldn't block the connection. Unfortunately in reality very few organisations actually revoke certificates. Revocation doesn't really work anyway (except for EV certs), but even if it did, most organisations still probably wouldn't do it.