Currently the node only checks the validity of a certificate during the TLS handshake.
Connections are never re-authenticated or closed as long as both nodes are online. This means that a connection could easily last for another week/month if one of the involved certificates is revoked.
gRPC adds a bit of complexity here, since it does not provide a way to close inbound connections. See #1945 for a possible direction for this issue.