```release-note:improvement
secret/pki: Support revoking expired certificates with the `allow_expired_cert_revocation` CRL configuration.
```
