diff --git a/endpoints/key_server.py b/endpoints/key_server.py
index 6ea3839c9..62adcb0d4 100644
--- a/endpoints/key_server.py
+++ b/endpoints/key_server.py
@@ -88,6 +88,9 @@ def get_service_key(service, kid):
   if key.approval is None:
     abort(409)
 
+  if key.expiration_date <= datetime.utcnow():
+    abort(403)
+
   resp = jsonify(key.jwk)
 
   lifetime = timedelta(days=365)