CAs can revoke certificates, and such revoked certificates do not constitute expiring certificates. In the case of compromised identities, certificates can be revoked, and put into a list called a CRL. It is recommended that any party who wants to verify the identity of any other party's (the subject party) should first refer to the CRL to check whether the party (the subject party's) certificate is included in the revoked list.