1. Home
  2. CWE Database
  3. CWE-298
Variant · Low-Medium

CWE-298: Improper Validation of Certificate Expiration

A certificate expiration is not validated or is incorrectly validated.

CWE-298 · Variant Level ·4 CVEs ·2 Mitigations

Description

A certificate expiration is not validated or is incorrectly validated.

Potential Impact

Integrity, Other

Other

Authentication, Other

Other

Demonstrative Examples

The following OpenSSL code ensures that there is a certificate and allows the use of expired certificates.
Bad
if (cert = SSL_get_peer(certificate(ssl)) {
                        foo=SSL_get_verify_result(ssl);if ((X509_V_OK==foo) || (X509_V_ERR_CERT_HAS_EXPIRED==foo))
                              
                                 
                                 //do stuff
If the call to SSL_get_verify_result() returns X509_V_ERR_CERT_HAS_EXPIRED, this means that the certificate has expired. As time goes on, there is an increasing chance for attackers to compromise the certificate.

Mitigations & Prevention

Architecture and Design

Check for expired certificates and provide the user with adequate information about the nature of the problem and how to proceed.

Implementation

If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the expiration.

Real-World CVE Examples

CVE IDDescription
CVE-2025-4384product does not verify that a certificate has expired
CVE-2007-3564web library product does not verify that a certificate has expired
CVE-2007-6746IRC product does not check the expiration date of the X.509 certificate
CVE-2007-6746library for SSL and TLS does not check the activation or expiration dates of CA certificates

CWE-295: Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

CWE-672: Operation on a Resource after Expiration or Release

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revok...

Taxonomy Mappings

  • CLASP: — Failure to validate certificate expiration

Frequently Asked Questions

What is CWE-298?

CWE-298 (Improper Validation of Certificate Expiration) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Variant-level weakness. A certificate expiration is not validated or is incorrectly validated.

How can CWE-298 be exploited?

Attackers can exploit CWE-298 (Improper Validation of Certificate Expiration) to other. This weakness is typically introduced during the Implementation, Implementation phase of software development.

How do I prevent CWE-298?

Key mitigations include: Check for expired certificates and provide the user with adequate information about the nature of the problem and how to proceed.

What is the severity of CWE-298?

CWE-298 is classified as a Variant-level weakness (Low-Medium abstraction). It has been observed in 4 real-world CVEs.