{"version":"2.1.198","anchor":"expired-ca-certificates-auto-removed","canonical_anchor":"expired-ca-certificates-auto-removed","heading":"Expired CA Certificates Auto-Removed","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.198\/e\/expired-ca-certificates-auto-removed","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.198","markdown":"### Expired CA Certificates Auto-Removed\n\nWhen building the TLS trust bundle from the system certificate store, expired certificates are now silently dropped and the count is logged.\n\n**Details**\n\n- The `kqu()` filter runs inside the lazy-initialised TLS trust-bundle builder (`kje`), which is invoked once and cached\n- For each PEM certificate in the bundle, `new X509Certificate(s)` is constructed and its `validTo` field parsed via `new Date(...).getTime()`; if the resulting timestamp is in the past relative to `Date.now()` at load time, the cert is dropped and a counter incremented\n- Certs that throw during `new X509Certificate(s)` construction (malformed DER\/PEM) are **retained** rather than dropped \u2014 only cleanly-parsed, definitively-expired certs are removed\n- Certs whose `validTo` parses to `NaN` (unrecognised date format) are also retained\n- The log line is only emitted when at least one cert was dropped: `\"CA certs: Dropped ${r} expired certificate(s) from system store\"` (no message when the count is zero)\n\n**Evidence**\n\n`kqu()` function log (search for `\"CA certs: Dropped\"`); filter logic `new Date(i.validTo).getTime()` and `catch { return !0 }` retain-on-error branch"}