That brings up an interesting question I'd never thought to ask before. Is there a standard in what order the attributes of a cert are checked for correctness?

That brings up an interesting question I'd never thought to ask before. Is there a standard in what order the attributes of a cert are checked for correctness? Say I present a self-signed, expired certificate with a bad signature and the wrong domain name. Which one does the user get warned about? This has important practical concerns. A cert being T+1 second expired is irrelevant from a security standpoint, but if that short-circuits all the other checks...