decrypt secrets encrypted with custom TLS certificate of expired validity about sealed-secrets HOT 1 CLOSED

If someone is interested, I have performed the tests for the scenarios described above. The answers are:

Will sealed-secrets controller still be able to decrypt the secrets encrypted with the old certificate after the certificate expiration?

No, it will throw an error: "error: failed to encrypt using an expired certificate"

How to add the new TLS key/pair while still keeping the old key/pair in the controller to decrypt the old secrets?

Create a new TLS key/pair and reference it in secretName of the Helm release, update the Helm release.

To decrypt the secrets with the old expired certificate, do not remove the old certificate from the cluster and keep sealedsecrets.bitnami.com/sealed-secrets-key: active label on it. The sealed-secret-controller will continue to decrypt the secrets encrypted with the expired certificate, although it's not directly referenced in the Helm release.

from sealed-secrets.