I noticed that there is one expired certificate in ca-certificates:

   $ cat test
   now=$(date -u)
   date -d "$now"
   now="$(date -d "$now" +%s)"
   for f in /usr/share/ca-certificates/mozilla/* ; do
    date="$(openssl x509 -enddate -noout -in "$f" | cut -d= -f2)"
    d="$(date -d "$date" +%s)"
    if [ $((d<=now)) -eq 1 ] ; then
     echo Expired: $f $date $d $now
    fi
   done
   $ sh test
   Mon 05 Feb 2024 10:13:46 AWST
   Expired: /usr/share/ca-certificates/mozilla/Security_Communication_Root_CA.crt Sep 30 04:20:49 2023 GMT 1696047649 1707099226

It might be a good idea to add an autopkgtest to check them.

Control: severity -1 minor
It doesn't actually matter, though, and it'll be gone next time we pull
from mozilla.

Cheers,
Julien

We believe that the bug you reported is fixed in the latest version of
ca-certificates, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1063093@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Julien Cristau <jcristau@debian.org> (supplier of updated ca-certificates package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 23 Dec 2024 12:53:45 +0100
Source: ca-certificates
Architecture: source
Version: 20241223
Distribution: unstable
Urgency: medium
Maintainer: Julien Cristau <jcristau@debian.org>
Changed-By: Julien Cristau <jcristau@debian.org>
Closes: 1031490 1063093 1067042
Changes:
 ca-certificates (20241223) unstable; urgency=medium
 .
   * Update Mozilla certificate authority bundle to version 2.70.
     The following certificate authorities were added (+):
     + Telekom Security TLS ECC Root 2020
     + Telekom Security TLS RSA Root 2023
     + FIRMAPROFESIONAL CA ROOT-A WEB
     + TWCA CYBER Root CA
     + SecureSign Root CA12
     + SecureSign Root CA14
     + SecureSign Root CA15
     The following certificate authorities were removed (-):
     - Security Communication Root CA (closes: #1063093)
   * Add Romanian debconf translation, thanks to Remus-Gabriel Chelu.
     Closes: #1067042, #1031490.
Checksums-Sha1:
 1a07197c509b3da142acf3c4fef467a73bb8101b 1766 ca-certificates_20241223.dsc
 bd874001edadfc4bf6d59e73dbbc73d358035c20 278044 ca-certificates_20241223.tar.xz
Checksums-Sha256:
 8b17779dedec18ad64b97ec99dd3b8f10ec06698e73242dbe7b8d992bd803a55 1766 ca-certificates_20241223.dsc
 dd8286d0a9dd35c756fea5f1df3fed1510fb891f376903891b003cd9b1ad7e03 278044 ca-certificates_20241223.tar.xz
Files:
 ef9142247825ce4e79a83c95bc1f34b0 1766 misc optional ca-certificates_20241223.dsc
 fe4ae74dd9fc7b13bd98b7ec2d1696a1 278044 misc optional ca-certificates_20241223.tar.xz
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEVXgdqzTmGgnvuIvhnbAjVVb4z60FAmdpT9kUHGpjcmlzdGF1
QGRlYmlhbi5vcmcACgkQnbAjVVb4z61KTQ//e1iF8rfHDWZ8Upy6uRff4zuYITCz
Er6k5dUl2/xkiEvrQaEP8em9TmtrG7fb2iVzpr+f3DkXXS4VkbLALKRT5wHhfFZg
Io8ypGp/uggLmA0oUjyht5RafXS7pd2bgxLbGbL1F3kFqG0YJVOrk8yTRUZva8xk
Wo3chEV+bYmD984ty7rgF4orQpsSLMkWc5DGKiYdVEWG/N/9AqNZd2ECZdWoglf4
woXWl8SrFzugVitnciXG1HdTYqNZ5hmFjiRtEOc5nZg3oQ7KkpV+dpAtx0JVej1H
/Bhh1x0z+wgVihDS9UEupxL4pAtq3xqAtN2rZ/THhJoq43UgOORl2eY75Z+iDlMZ
PcxtD8HD5N+Z0oLYhqYpaFRGjSf28rcT0+bsGce811P0bdMw5P9Goaw8/SDuTnbQ
k3yHRS/Xfiif0WjAM16ejYIjtkRFzoC+4Ce28GKCvBoeQ4bX74xrGQtrzH5EMoP7
Zad1SEt5b75IZYA0F/guZmX2aTpODaAbtbUfZ5efDoE7Y9toodt+4zXNHyj2Wv2w
z5nnHx7q0+D6Cjy0Bk7s4S3DsGj9y7agEX0NDmwhwoa2nYn5CGX1ZT22/7pAnIjZ
41rpO1CerhPaykKM6kL2w8aKMUzp3sZdMQd5POYsxoA2+vWvlNXfPMI96wsUI9uZ
uxATz6zJBiGYveI=
=ocuk
-----END PGP SIGNATURE-----