This is the current verification feedback of detached and embedded smime signatures with expired certificates:
It should be simliar to the verification feedback for an expired pgp signature:
Logs:
Testdata:
Note: To generate new signature files (system time needs to be between the expire date of the user cert and valid from date of the root cert) :
>gpgsm --faked-system-time 1787919771 --default-key alice+expired --detach-sign test.pdf > detached.p7s gpgsm: WARNING: running with faked system time: 2026-08-28 12:22:51 gpgsm: DBG: adding certificates at level -2 gpgsm: signature created >gpgsm --status-fd 2 --verify detached.p7s test.pdf [GNUPG:] NEWSIG gpgsm: Signature made 2026-08-28 12:22:51 UTC gpgsm: using rsa4096 key F9AAFDC6628657B337097C28486F2CA7E8D37C8E gpgsm: certificate has expired gpgsm: (expired at 2026-08-28 12:22:51) [GNUPG:] EXPKEYSIG F9AAFDC6628657B337097C28486F2CA7E8D37C8E /CN=Alice expired/O=QA/L=Erkrath/ST=NRW/C=DE/EMail=alice+expired@gnupg.test [GNUPG:] VALIDSIG F9AAFDC6628657B337097C28486F2CA7E8D37C8E 2026-08-28 20260828T122251 20260828T122251 0 0 1 8 00 gpgsm: Good signature from "/CN=Alice expired/O=QA/L=Erkrath/ST=NRW/C=DE/EMail=alice+expired@gnupg.test" [GNUPG:] TRUST_FULLY 0 shell