In RevokeCertificate.tsx:67-83,193, the lookup only special-cases status === 'revoked'; any other status (including expired or frozen) falls into the preview branch, which unconditionally renders <span ...>Active</span>. An expired or frozen certificate is therefore mislabeled "Active" and offered up for revocation. Fix: render the badge from certificate.status and block/adjust the revoke flow for non-active statuses.
In
RevokeCertificate.tsx:67-83,193, the lookup only special-casesstatus === 'revoked'; any other status (includingexpiredorfrozen) falls into the preview branch, which unconditionally renders<span ...>Active</span>. An expired or frozen certificate is therefore mislabeled "Active" and offered up for revocation. Fix: render the badge fromcertificate.statusand block/adjust the revoke flow for non-active statuses.