A specific example--right now on disasterhousing.gov I get this message in Chrome Your connection is not private Attackers might be trying to steal your

A specific example--right now on disasterhousing.gov I get this message in Chrome Your connection is not private Attackers might be trying to steal your information ... This server could not prove that it is disasterhousing.gov; its security certificate expired 21 days ago. This may be caused by a misconfiguration or an attacker intercepting your connection. The first statement is extremely misleading, your connection is as "private" as it ever was, since the cryptography still works and the issuer never validated the end-to-end privacy of your information server in any way. That last statement is so misleading as to be mostly just wrong. 100% of expired certificate problems in my experience are due to an organization failing to renew because of inattention ("Bob bought the certificate 2 years ago and used an email he set up on gmail because we didn't have our own mail server back then but we do now and so no one ever looks at that email so we never saw the renewal notice"). I am not aware of any attack on SSL that leverages a certificate that is valid in every way except that it has expired, other than the possibility that an old certificate fell into the attacker's hands. However it is also entirely possible for an unexpired certificate to fall into attackers' hands, and because unexpired certificates are more valuable it is more likely that is what attackers actually will steal (or forge). I think users would be better served if certificate expiration was a more subtle warning, that perhaps slowly increases its panic-inducing-messaging over long time frames.