That’s not true. The encryption still works as well as it did 3 days ago, and doesn’t care if the certificate is expired.
It's true that the expiration doesn't mean the encryption no longer works, but if the user is under a MITM attack and is presented by their browser with a warning that the certificate is invalid, then the encryption will still work but the encrypted communication will be happening with the wrong party.
I don't trust the average user to inspect the certificate and understand the reason for the browser's rejection.
This is an infohazard. True information that can cause harm or enable some agent to cause harm.
Telling people not to worry about expired cert warnings makes them vulnerable to a variety of attacks.
I think they mean that a non-observant visitor cannot tell the difference between both situations
If you're ignoring certificate warnings, then you'll ignore mismatching domain warnings.
More over, if your org's browser setting allow you to override the warnings, thast also pretty bad for anything other than a small subset of your team.
That's not what man in the middle attacks are about.. it's not about the encryption, it's about verifying that you really know who you're talking to.
I think the argument would go that if people are clicking through certificate errors and you're in a position to MITM their traffic, you can just serve them a different certificate and they'll click through the error without noticing or understanding the specifics.