Digital signature failing when certificate expired

Question

I have recently encountered something pretty much confusing to me.

I don't know if this is a "problem" of Outlook, or it's by design and, in that case, my understanding of digital certificates is wrong.

I am using S/MIME for digital signing of my outgoing e-mails with Outlook. I have an S-MIME cert. from trusted authority and everything is OK.

Few weeks ago, my cert has expired (it has had one-year validity) so my CA issued me another one. However, now all e-mails that have been sent by me and signed using the old now-expired certificate, are being marked as "Invalid signature" stating that the certificate has expired.

This behaviour would be completely OK, if I now tried to send new e-mails using that old certificate. But those e-mails have been sent in the past, when the cert. was still valid. Shouldn't Outlook check for sending time for that e-mail, rather than current system time?

Answer 1

If the signature was not timestamped, there's no way to know when the message was signed (message time can be forged).

Consequently, the mailer shows such signed messages as having an invalid signature.