Expired SSL Certificates: How a Lapsed Cert Becomes an Attack Vector

The report explains how expired TLS certificates and lapsed domains produce high-impact, low-effort attack opportunities—enabling man-in-the-middle downgrades, brand-impersonation phishing that appears more legitimate than the real site, and critical validation failures such as a WHOIS takeover that could allow issuance of valid TLS certificates for an entire TLD; it cites real-world demonstrations where researchers re-registered expired infrastructure (for ~$20) and thereby could have issued certificates or controlled thousands of compromised hosts.