Really interesting point. I've worked with CAs and TLS certs for 20+ years and this never even occurred to me. The UX is horrible, considering how many regular

Really interesting point. I've worked with CAs and TLS certs for 20+ years and this never even occurred to me. The UX is horrible, considering how many regular non-tech people an expired cert can affect. Imho the browser should continue showing its big full-page warning, but there should still be a way to proceed to the site. What if a cert expires on a life-saving service? And now the user can't even reach the site just because the time is wrong.