The issue was that they let their own intermediate certificate expire, even though the leaf certificate for smtp.gmail.com was still valid: http://www.securityw

The issue was that they let their own intermediate certificate expire, even though the leaf certificate for smtp.gmail.com was still valid: http://www.securityweek.com/google-lets-smtp-certificate-expire http://www.securityweek.com/google-lets-smtp-certificate-exp... It's good to note that many expiration checkers (e.g. for Nagios/Icinga) only check the expiration date of the leaf certificate, so you'll be in trouble if the intermediate certificate expires. However, I don't think any commercial CA will give out certificates with an expiration date longer than their own intermediate or root.