@CaffeineAddiction agree... sites with a valid CA, valid hostname but expired should be allowed, it's not the same as self-signed certificates, or signed with an untrusted CA
an expired certificate was valid until recently (or not so recently) but self signed or issued by a random CA wasn't ever trusted...
