title: Should I Set "CertificateNotAfter" when Specifying KeyGenParameterSpec
body: <p>In Android, I'm trying to generate an AES key which I will store within AndroidKeystore. The key itself will be used to encrypt some data at rest.</p>
  <p>I'm following this github snippet as reference :
  <a href="https://github.com/charanolati/Android-encryption-sample/blob/master/app/src/main/java/co/tob/encryption/AES_KeystoreWrapper.kt" rel="nofollow noreferrer">
  Android-encryption-sample</a></p>
  <pre><code>val keyGenParameterSpec = KeyGenParameterSpec.Builder(
                  KEY_ALIAS,
                  KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
                  .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                  .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                  //.setUserAuthenticationRequired(true) //  requires lock screen, invalidated if lock screen is disabled
                  //.setUserAuthenticationValidityDurationSeconds(120) // only available x seconds from password authentication. -1 requires finger print - every time
      //            .setKeySize(256) // Set key size
                  //To Set Certificate Values instead of maual initialization of certificate
      //            .setCertificateNotBefore(startDate) // By default, this date is Jan 1 1970.
      //            .setCertificateNotAfter(endDate) // By default, this date is Jan 1 2048.
      //            .setCertificateSerialNumber(number) // By default, the serial number is 1.
      //            .setCertificateSubject(x500Principal) // By default, the subject is CN=fake.
  
                  .setRandomizedEncryptionRequired(true) // 4 different ciphertext for same plaintext on each call
                  .build()
  </code></pre>
  <p>The code of interest is shown in the previous code block. As we can see, there is a &quot;setCertificateNotAfter()&quot; method which can be called on the builder function. From what I know is that it sets the expiry date for the certificate.</p>
  <p>My question is, for my use case, is it important to provide an expiry date? What will happen after the expiry date is exceeded? Will I be unable to encrypt/decrypt with the key anymore?</p>
  <p>Thanks.</p>