This is a specific sub-check within mutual authentication: when enabled, the switch will additionally verify that the upstream server's certificate's validity timestamp is current (not expired or not-yet-valid) as part of confirming that server's identity during EAP-TLS mutual authentication. An admin would enable this for a stricter security posture, catching a case where an otherwise trusted certificate chain has simply expired, which a basic identity check alone might miss. For example, an admin renewing certificate infrastructure would want this enabled so that if the upstream authentication server's certificate is accidentally left unrenewed past its expiry, the switch's own supplicant authentication would fail closed rather than silently accepting an expired cert.