IPsec tunnels remain up although the corresponding local certificate has expired.

root@srx> show security pki local-certificate certificate-id test
Feb 01 09:12:02
LSYS: root-logical-system
Certificate identifier: test
...
  Validity:
    Not before: 01-31-2022 00:53 UTC
    Not after: 02- 1-2024 00:53 UTC   <<<<< Certificate has expired
  Public key algorithm: rsaEncryption(2048 bits)
  Keypair Location: Keypair generated locally

root@srx> request security pki local-certificate verify certificate-id test
Feb 01 09:12:11
local certificate test verification failed. local cert has expired

However, ike and ipsec SAs are UP:

root@srx> show security ipsec sa
Feb 01 09:12:20
  Total active tunnels: 1     Total Ipsec sas: 1
  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway
  <131073 ESP:aes-gcm-256/None 1874f5ec 1710/ unlim - root 500 192.168.1.2
  >131073 ESP:aes-gcm-256/None bb66b0f3 1710/ unlim - root 500 192.168.1.2

root@srx> show security ike sa
Feb 01 09:12:51
Index   State  Initiator cookie  Responder cookie  Mode           Remote Address
1734459 UP     5244031ec2fe1626  9bf2179b23ec45c5  IKEv2          192.168.1.2

For IKEv2 certificate will be checked only during reauthentication process, "reauth-frequency" is not applied by default, so certificates are not checked at each rekey.
To force SRX to check certificates, "reauth-frequency" has to be configured under ike policy. More information can be found here: https://www.juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/topic-map/security-ipsecvpns-for-ikev2.html#id-understanding-ikev2-reauthentication