NSURLErrorClientCertificateRejected when only matching client certificate is expired in WebKit
When a TLS server requests a client certificate during mutual authentication, WebKit's NSURLSession presents identities from the Keychain that match the server's trusted CA list. If the only matching certificate has expired, the authentication challenge fails with NSURLErrorClientCertificateRejected (-1205) and no system-provided fallback UI appears to let t