diff --git a/cmd/principal/main.go b/cmd/principal/main.go
index b14da0e..f2a3de6 100644
--- a/cmd/principal/main.go
+++ b/cmd/principal/main.go
@@ -127,7 +127,12 @@
 			if err != nil {
 				return fmt.Errorf("failed to decode certificate chains: %v", err)
 			}
-			fmt.Printf("Blessings          : %v\n", blessings)
+			// If the Blessings are expired, print a message saying so.
+			expiredMessage := ""
+			if exp := blessings.Expiry(); !exp.IsZero() && exp.Before(time.Now()) {
+				expiredMessage = " [EXPIRED]"
+			}
+			fmt.Printf("Blessings          : %v%s\n", blessings, expiredMessage)
 			fmt.Printf("PublicKey          : %v\n", blessings.PublicKey())
 			fmt.Printf("Certificate chains : %d\n", len(wire.CertificateChains))
 			for idx, chain := range wire.CertificateChains {
@@ -1206,7 +1211,7 @@
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse caveats: %v", err)
 	}
-	if expiry > 0 {
+	if expiry != 0 {
 		ecav, err := security.NewExpiryCaveat(time.Now().Add(expiry))
 		if err != nil {
 			return nil, fmt.Errorf("failed to create expiration caveat: %v", err)
diff --git a/cmd/principal/principal_v23_test.go b/cmd/principal/principal_v23_test.go
index 4a4f686..734b4d1 100644
--- a/cmd/principal/principal_v23_test.go
+++ b/cmd/principal/principal_v23_test.go
@@ -536,6 +536,22 @@
 		}
 	}
 	{
+		// If the Blessings are expired, dumpBlessings should print so.
+		redirect(t, bin.Start("bless", "--for=-1s", bobDir, "friend"), tmpfile)
+		got := removeCaveats(removePublicKeys(bin.Start("dumpblessings", tmpfile).Output()))
+		want := `Blessings          : alice/friend [EXPIRED]
+PublicKey          : XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
+Certificate chains : 1
+Chain #0 (2 certificates). Root certificate public key: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
+  Certificate #0: alice with 0 caveats
+  Certificate #1: friend with 1 caveat
+    (0) ExpiryCaveat
+`
+		if got != want {
+			t.Errorf("Got\n%vWant\n%v", got, want)
+		}
+	}
+	{
 		// But not if --for=0
 		var buf bytes.Buffer
 		if err := bin.Start("bless", "--for=0", bobDir, "friend").Wait(os.Stdout, &buf); err == nil {