diff --git a/lib/db_base.cpp b/lib/db_base.cpp
index 31b5e644..185773c8 100644
--- a/lib/db_base.cpp
+++ b/lib/db_base.cpp
@@ -525,6 +525,9 @@ QVariant db_base::data(const QModelIndex &index, int role) const
 				return QVariant(QFont("Monospace"));
 			return QVariant(QApplication::font());
 		}
+		case Qt::BackgroundRole: {
+			return item->bg_color(hd);
+		}
 	}
 	return QVariant();
 }
diff --git a/lib/pki_base.h b/lib/pki_base.h
index ec747886..a694c128 100644
--- a/lib/pki_base.h
+++ b/lib/pki_base.h
@@ -102,6 +102,10 @@ class pki_base : public QObject
 			return NULL;
 		}
 		void fwrite_ba(FILE *fp, QByteArray ba, QString fname);
+		virtual QVariant bg_color(dbheader *hd)
+		{
+			return QVariant();
+		}
 };
 
 #endif
diff --git a/lib/pki_x509.cpp b/lib/pki_x509.cpp
index 06a49ab7..a5ac3e78 100644
--- a/lib/pki_x509.cpp
+++ b/lib/pki_x509.cpp
@@ -866,6 +866,50 @@ const EVP_MD *pki_x509::getDigest()
 	return EVP_get_digestbyobj(cert->sig_alg->algorithm);
 }
 
+QVariant pki_x509::bg_color(dbheader *hd)
+{
+#define BG_RED     QBrush(QColor(255,  0,  0))
+#define BG_YELLOW  QBrush(QColor(255,255,  0))
+#define BG_CYAN    QBrush(QColor(127,255,212))
+
+	QDateTime nb, na, now, certwarn;
+
+	nb = getNotBefore().qDateTime();
+	na = getNotAfter().qDateTime();
+
+	int lifetime = nb.secsTo(na);
+
+	now = QDateTime::currentDateTimeUtc();
+
+	/* warn after 4/5 certificate lifetime */
+	certwarn = na.addSecs(- lifetime /5);
+
+	switch (hd->id) {
+		case HD_cert_notBefore:
+			if (nb > now)
+				return QVariant(BG_RED);
+			break;
+		case HD_cert_notAfter: {
+			if (na < now)
+				return QVariant(BG_RED);
+			if (certwarn < now)
+				return QVariant(BG_YELLOW);
+			break;
+		}
+		case HD_cert_revokation:
+			if (canSign()) {
+				QDateTime crlwarn, crlex;
+				crlex = crlExpiry.qDateTime();
+				crlwarn = crlex.addSecs(-2 *60*60*24);
+				if (crlex < now)
+					return QVariant(BG_RED);
+				if (crlwarn < now)
+					return QVariant(BG_YELLOW);
+			}
+	}
+	return QVariant();
+}
+
 void pki_x509::oldFromData(unsigned char *p, int size)
 {
 	int version, sRev, sLastCrl;
diff --git a/lib/pki_x509.h b/lib/pki_x509.h
index 11bcf3a7..6c23e591 100644
--- a/lib/pki_x509.h
+++ b/lib/pki_x509.h
@@ -150,6 +150,7 @@ class pki_x509 : public pki_x509super
 		virtual QString getMsg(msg_type msg);
 		virtual int renameOnToken(slotid slot, QString name);
 		BIO *pem(BIO *);
+		virtual QVariant bg_color(dbheader *hd);
 };
 
 #endif