Technically I think one must be clear. The cert (client and ca) all have dates and that you are right. But what your miss is that the revocation measure is th

Technically I think one must be clear. The cert (client and ca) all have dates and that you are right. But what your miss is that the revocation measure is the key here. It is not just sign it for the period. The CA and the root CA list has to maintain those cert and revoke them. You should not just trust the date and signature. The revocation list is key. In other words you check everytime you use it basically. That is how stolen Microsoft cert stopped. All old app are checked for validity. It is not as you implied.