Will SSL handshake work when a JKS keystore have an expired self-signed certificate and a valid CA signed certificate?

Question

The self-signed certificate in a JKS keystore.jks has validity of only around 4 months, whereas the CA signed certificate will have validity of around 2 years, so when the self-signed certificate expires, will it not create any problem in SSL handshake?

Answer 1

If the certificate is added to the truststore that the socket uses (creating an array of TrustManagers and passing that to an SSLContext), then the SSLSocket seems to treat it as valid. Testing this using a dummy certificate that expires 1 second after creation, this seems to be correct; the client connects without exceptions or issues and can send messages.

Therefore, if the client in question explicitly trusts the certificate, the client should be able to connect.

However, if another implementation is being used that rejects expired certificates, the client will most likely throw an exception.