[prolurker]

Correct, but, even if not explicitly said, the cached entries should be associated to the certificate's fingerprint and immediately discarded once the certificate expires or is changed.

[rav]

Certificates often change for legitimate reasons, e.g. Let's Encrypt certificates which must be changed every 3 months.

[geon]

That would be ok.