Certificate Already Expired and Not Revoked but Certificate Still Active

[alandrma]

Hello @primetomas ,

I want to ask about certificate statuses refering this https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/end-entities-overview/certificate-statuses

There are several digital certificates that have passed their active period, which means they have expired and when I checked on the database side or on the RA web certificate side the status was still 20 instead of 60.

What I want to ask is why this happens and is there any issue with this?

i'm using EJBCA v7.4.3.2

[primetomas]

That is expected and not a problem. It is active because you have not revoked it. Something that is normal, you don't need to revoke expired certificates. They can't be used anyhow because....it's expired.
There is nothing called "active period" (i.e. terminology) I would say. The "validity period" of the certificate is decoupled from the state changes active->revoke. The state change you may see is a move to archived if the certificate had been revoked, when expired (and revoked) certificates have been included in a CRL for the last time. I.e. this is to comply with RFC5280 requirements that expired and revoked certificates should not be included in a CRL (they are included one last time after expiration).

[alandrma]

Dear @primetomas

If it is separated between active certificates that have expired and certificates that have been revoked.

I have tried to revoke a certificate that has expired and it still doesn't change the certificate status from 20 to 60. The certificate status changes to 40

[primetomas]

Yes, 40 means revoked so...

60 is set by CRL generation. But this certificate has never been revoked when active so will never appear on a CRL. You do not need certificates to be in state 60, there is no technical need for that.

Also why would you revoke an expired certificate?