When building the TLS trust bundle from the system certificate store, expired certificates are now silently dropped and the count is logged.
Details
- The
kqu()filter runs inside the lazy-initialised TLS trust-bundle builder (kje), which is invoked once and cached - For each PEM certificate in the bundle,
new X509Certificate(s)is constructed and itsvalidTofield parsed vianew Date(...).getTime(); if the resulting timestamp is in the past relative toDate.now()at load time, the cert is dropped and a counter incremented - Certs that throw during
new X509Certificate(s)construction (malformed DER/PEM) are retained rather than dropped — only cleanly-parsed, definitively-expired certs are removed - Certs whose
validToparses toNaN(unrecognised date format) are also retained - The log line is only emitted when at least one cert was dropped:
"CA certs: Dropped ${r} expired certificate(s) from system store"(no message when the count is zero)
Evidence
kqu() function log (search for "CA certs: Dropped"); filter logic new Date(i.validTo).getTime() and catch { return !0 } retain-on-error branch
Strings lifted out of the shipped bundle, so the claim above can be checked against them.