IMHO host mismatch is more serious than expired cert and browsers should treat it as such