Google Chrome uses old cert for www domain

[_az]

@_az

Alternatively, it might just be that the nature of a PWA just reliably triggers the generic behavior for cached browser responses - if you do not need to revalidate an HTTP resource, avoid opening any SSL connection and show the cached information

I've run a couple of experiments and I'm pretty sure this ^ is the case.

But what matters to you:

@tmtron

Will Chrome and other browsers then still use the old cert and show that it has expired?

I tried this experiment too.

Chrome will show the stale certificate info with the expiration date in the past, but it will not actually perform any validation, and it won't present an error.

And of course, if you force a reload, validation will be performed against the non-stale certificate info.