Private Key JWT Allows Expired Certificate

When configuring Private Key JWT on an Application within the Credentials tab, uploading an expired certificate appears to be allowed, and token requests also succeed with this expired certificate.

• Private Key JSON Web Token (JWT)

It is not possible to upload an expired certificate to be used as a Certificate credential type, but it can be used as a Public Key credential type, as the certificate component in this case is not significant.

• When uploading a certificate file as credential type “Public Key”, the public key contained in the certificate is extracted before being saved. The certificate is essentially a container for uploading the public key. The certificate itself (expiry, etc.) is dismissed, and only the Public Key is used.
• When uploading a certificate as “Certificate (self-signed)” for mTLS, the certificate is validated and used as a certificate. If the certificate is expired, it is invalid, and does not pass validation.