There are at least 2 modem manufacturer certificates expiring this year, the first one next month
Motorola Cert:
Serial: 437498F09A7DCBC1FA7AA101FE976E40
Expires: Jul 10 23:59:59 2021 GMT
Subject: /C=US/O=Motorola Corporation/ST=California/L=San Diego/OU=DOCSIS/OU=ASG/CN=Motorola Corporation Cable Modem Root Certificate Authority
Certificate in Hex: 30820400308202E8A0030201020210437498F09A7DCBC1FA7AA101FE976E40300D06092A864886F70D0101050500308197310B300906035504061302555331393037060355040A133044617461204F766572204361626C65205365727669636520496E746572666163652053706563696669636174696F6E7331153013060355040B130C4361626C65204D6F64656D73313630340603550403132D444F43534953204361626C65204D6F64656D20526F6F7420436572746966696361746520417574686F72697479301E170D3031303731313030303030305A170D3231303731303233353935395A3081BA310B3009060355040613025553311D301B060355040A13144D6F746F726F6C6120436F72706F726174696F6E311330110603550408130A43616C69666F726E6961311230100603550407130953616E20446965676F310F300D060355040B1306444F43534953310C300A060355040B1303415347314430420603550403133B4D6F746F726F6C6120436F72706F726174696F6E204361626C65204D6F64656D20526F6F7420436572746966696361746520417574686F7269747930820122300D06092A864886F70D01010105000382010F003082010A0282010100B512BAC55D88251FC8EC46D77F63B1A6C998D479BC65E5F8A394E97C38DD60FEF99E09D93343452A4244DE89A2AD9BBB1A7242A553DA3D879C78429CC33DE17A771D5E334FC2FB166737CF9A865A4F3A9B6ACF31093CB6E1A44696E4EACA64E01C0C40F4B7831E8536E67756E7F92A16C9C18B09F031D02D9DF3E2A7A176DB7F2B7268747C8135AFF1DFB57DAADEC04C0FC77E70D487FE85CD2DEED6278F5F43CCDCC7F1E4566F4072815962B3FDFFA2DC1A333E53DA712C37CDB822C072D97E4A62AD667CD671C90DC0E80DF79E042F9EE8EEA41C956081B1005E8030301ACDFEBBCA2A6EFF527281B8FBBAE979CDF5EEC3C16A3710BB964923F6D8C5764FEB0203010001A323302130120603551D130101FF040830060101FF020100300B0603551D0F040403020106300D06092A864886F70D01010505000382010100210681900017EF1583D4CAFE32CC89007526774C050CE442782F1BBE4FBED68CC6E7D30B868799BA30E898A2BABA22412776BED99FB2895C075E5E3DFE7D1106A87C5A26B65CDD073B5AC32EEDB564BE41D15CEAF4DEE46EB5AD3B073F7D60F6BD9F9F4794D4A5AB81F6100146FEDC0AA11A5B38603B970BBE12441B10E3B5D63C055C84902C78A6DF5D2FA0F5AC6F4FC4D6C5C55615448D55573FE86E55214664503B0F2D3178AC240C3F9C2E1E3362EA17E6DB47A95905BAD91B118BA9D82621F141EBC48790652D233808319C7416300518D2895E9B2113E3E96AF93B595EE2050E89E59D2A40C29B4F211F1BB72C13193D56AB4B09A91E625CEEC0D2BA2D
Arris Cert:
Serial: 45529C2654797E1623C6E723180A9E9C
Expires: Sep 11 23:59:59 2021 GMT
Subject: /C=US/O=Arris Interactive, L.L.C./OU=DOCSIS/OU=Suwanee, Georgia/CN=Arris Cable Modem Root Certificate Authority
Certificate in Hex: 308203DA308202C2A003020102021045529C2654797E1623C6E723180A9E9C300D06092A864886F70D0101050500308197310B300906035504061302555331393037060355040A133044617461204F766572204361626C65205365727669636520496E746572666163652053706563696669636174696F6E7331153013060355040B130C4361626C65204D6F64656D73313630340603550403132D444F43534953204361626C65204D6F64656D20526F6F7420436572746966696361746520417574686F72697479301E170D3031303931323030303030305A170D3231303931313233353935395A308194310B300906035504061302555331223020060355040A1319417272697320496E7465726163746976652C204C2E4C2E432E310F300D060355040B1306444F4353495331193017060355040B1310537577616E65652C2047656F72676961313530330603550403132C4172726973204361626C65204D6F64656D20526F6F7420436572746966696361746520417574686F7269747930820122300D06092A864886F70D01010105000382010F003082010A0282010100DBC20E773C2BAA6C4CC6CA4EB1C1F6C56EA5BC2AFD2DE0E72112A94FF8A139F71E5D820BF70399B685C332F2E645BFF11E906F5DF9A65ACD8A4BF4F8147EB79DEDB35EB196F53CF6453A21BB5F16F82D46333C21220EDAE7D7A7DB6A527E6938BA18D0C2F8A9B31509C0B145EF72C1A8B89FB531DBCDA0626BDB2D6D54D225C4F43D2EC7E51AF53AD2155C64811B6598C7A67887B3396432B87D0F864E4E7C9D5E7EC6B1AE6056ABF38B7EAE7B0A616F96AEEDDF79A6C724E7D5E5699E419FD5FA959AC053E4964671423C4DC43902C1F5850ED818D9140FB0D543C9FF5CE3337B68B8999DAE9DD2014F4EFC1B66B5015E7F97FD14A59F29A75FF0248832A4B10203010001A323302130120603551D130101FF040830060101FF020100300B0603551D0F040403020106300D06092A864886F70D010105050003820101002BF8353648712EA4F27F61F1FC8EF6E0AEE5ED10A7D9C08E745430A5EF8D31C78C50EEBCBE9D14E58C525C08360ECCF1BB1E124AFEB436790D020299195C778806F07A7AF34484EA7B8BC135CB1DC18AD415BB296F740D9CF9E1ABF8061B74D36BA62F902B7B683E6776F99B56FCA85DB5968F0C07FDED5CF696E2B061F7B1825FFDB4FDCC2CCB13E7E52911E41BF1908EDA72B9EF53C819DF8048DD3076E3E606C904384132A766BED02DDFF865281A1AFF2CDD78839AF19AFB7B1A5F8D8294927103F49678943C715382F6F168123DD439FD7221D1C76414D77218C47934BE7CC151821B88FCC717D79EA522C993C239E5E31305288E5D0946DC378FFCA694
Please Add any others you know of expiring this year
On a casa CMTS you would use the command
cable privacy add-certificate manufacturer HEX_CONTENT_OF_CERTIFICATE
to explicitly trust the individual certificates that are expiring
i.e. for these two certs:
cable privacy add-certificate manufacturer 30820400308202E8A0030201020210437498F09A7DCBC1FA7AA101FE976E40300D06092A864886F70D0101050500308197310B300906035504061302555331393037060355040A133044617461204F766572204361626C65205365727669636520496E746572666163652053706563696669636174696F6E7331153013060355040B130C4361626C65204D6F64656D73313630340603550403132D444F43534953204361626C65204D6F64656D20526F6F7420436572746966696361746520417574686F72697479301E170D3031303731313030303030305A170D3231303731303233353935395A3081BA310B3009060355040613025553311D301B060355040A13144D6F746F726F6C6120436F72706F726174696F6E311330110603550408130A43616C69666F726E6961311230100603550407130953616E20446965676F310F300D060355040B1306444F43534953310C300A060355040B1303415347314430420603550403133B4D6F746F726F6C6120436F72706F726174696F6E204361626C65204D6F64656D20526F6F7420436572746966696361746520417574686F7269747930820122300D06092A864886F70D01010105000382010F003082010A0282010100B512BAC55D88251FC8EC46D77F63B1A6C998D479BC65E5F8A394E97C38DD60FEF99E09D93343452A4244DE89A2AD9BBB1A7242A553DA3D879C78429CC33DE17A771D5E334FC2FB166737CF9A865A4F3A9B6ACF31093CB6E1A44696E4EACA64E01C0C40F4B7831E8536E67756E7F92A16C9C18B09F031D02D9DF3E2A7A176DB7F2B7268747C8135AFF1DFB57DAADEC04C0FC77E70D487FE85CD2DEED6278F5F43CCDCC7F1E4566F4072815962B3FDFFA2DC1A333E53DA712C37CDB822C072D97E4A62AD667CD671C90DC0E80DF79E042F9EE8EEA41C956081B1005E8030301ACDFEBBCA2A6EFF527281B8FBBAE979CDF5EEC3C16A3710BB964923F6D8C5764FEB0203010001A323302130120603551D130101FF040830060101FF020100300B0603551D0F040403020106300D06092A864886F70D01010505000382010100210681900017EF1583D4CAFE32CC89007526774C050CE442782F1BBE4FBED68CC6E7D30B868799BA30E898A2BABA22412776BED99FB2895C075E5E3DFE7D1106A87C5A26B65CDD073B5AC32EEDB564BE41D15CEAF4DEE46EB5AD3B073F7D60F6BD9F9F4794D4A5AB81F6100146FEDC0AA11A5B38603B970BBE12441B10E3B5D63C055C84902C78A6DF5D2FA0F5AC6F4FC4D6C5C55615448D55573FE86E55214664503B0F2D3178AC240C3F9C2E1E3362EA17E6DB47A95905BAD91B118BA9D82621F141EBC48790652D233808319C7416300518D2895E9B2113E3E96AF93B595EE2050E89E59D2A40C29B4F211F1BB72C13193D56AB4B09A91E625CEEC0D2BA2D
cable privacy add-certificate manufacturer 308203DA308202C2A003020102021045529C2654797E1623C6E723180A9E9C300D06092A864886F70D0101050500308197310B300906035504061302555331393037060355040A133044617461204F766572204361626C65205365727669636520496E746572666163652053706563696669636174696F6E7331153013060355040B130C4361626C65204D6F64656D73313630340603550403132D444F43534953204361626C65204D6F64656D20526F6F7420436572746966696361746520417574686F72697479301E170D3031303931323030303030305A170D3231303931313233353935395A308194310B300906035504061302555331223020060355040A1319417272697320496E7465726163746976652C204C2E4C2E432E310F300D060355040B1306444F4353495331193017060355040B1310537577616E65652C2047656F72676961313530330603550403132C4172726973204361626C65204D6F64656D20526F6F7420436572746966696361746520417574686F7269747930820122300D06092A864886F70D01010105000382010F003082010A0282010100DBC20E773C2BAA6C4CC6CA4EB1C1F6C56EA5BC2AFD2DE0E72112A94FF8A139F71E5D820BF70399B685C332F2E645BFF11E906F5DF9A65ACD8A4BF4F8147EB79DEDB35EB196F53CF6453A21BB5F16F82D46333C21220EDAE7D7A7DB6A527E6938BA18D0C2F8A9B31509C0B145EF72C1A8B89FB531DBCDA0626BDB2D6D54D225C4F43D2EC7E51AF53AD2155C64811B6598C7A67887B3396432B87D0F864E4E7C9D5E7EC6B1AE6056ABF38B7EAE7B0A616F96AEEDDF79A6C724E7D5E5699E419FD5FA959AC053E4964671423C4DC43902C1F5850ED818D9140FB0D543C9FF5CE3337B68B8999DAE9DD2014F4EFC1B66B5015E7F97FD14A59F29A75FF0248832A4B10203010001A323302130120603551D130101FF040830060101FF020100300B0603551D0F040403020106300D06092A864886F70D010105050003820101002BF8353648712EA4F27F61F1FC8EF6E0AEE5ED10A7D9C08E745430A5EF8D31C78C50EEBCBE9D14E58C525C08360ECCF1BB1E124AFEB436790D020299195C778806F07A7AF34484EA7B8BC135CB1DC18AD415BB296F740D9CF9E1ABF8061B74D36BA62F902B7B683E6776F99B56FCA85DB5968F0C07FDED5CF696E2B061F7B1825FFDB4FDCC2CCB13E7E52911E41BF1908EDA72B9EF53C819DF8048DD3076E3E606C904384132A766BED02DDFF865281A1AFF2CDD78839AF19AFB7B1A5F8D8294927103F49678943C715382F6F168123DD439FD7221D1C76414D77218C47934BE7CC151821B88FCC717D79EA522C993C239E5E31305288E5D0946DC378FFCA694
Please Note: you need to either write config and reboot, or change docsBpi2CmtsCACertTrust via SNMP for the appropriate cert to trusted(1) to make the command take effect
or conversely if you prefer and have a new enough software version you can add
no cable privacy valid-period-check
to each interface docsis-mac to disable all validity checking on the CMTS (disable checking the expiration date)