What's wrong with this entry?
Anonymous. No account, no email.
When building the TLS trust bundle from the system certificate store, expired certificates are now silently dropped and the count is logged.
Details
- The
kqu()filter runs inside the lazy-initialised TLS trust-bundle builder (kje), which is invoked once and cached - For each PEM certificate in the bundle,
new X509Certificate(s)is constructed and itsvalidTofield parsed vianew Date(...).getTime(); if the resulting timestamp is in the past relative toDate.now()at load time, the cert is dropped and a counter incremented - Certs that throw during
new X509Certificate(s)construction (malformed DER/PEM) are retained rather than dropped — only cleanly-parsed, definitively-expired certs are removed - Certs whose
validToparses toNaN(unrecognised date format) are also retained - The log line is only emitted when at least one cert was dropped:
"CA certs: Dropped ${r} expired certificate(s) from system store"(no message when the count is zero)
Evidence
kqu() function log (search for "CA certs: Dropped"); filter logic new Date(i.validTo).getTime() and catch { return !0 } retain-on-error branch
Strings lifted out of the shipped bundle, so the claim above can be checked against them.