I have two machines running windows OS with IIS and window OS with MS SQL. In the production web.config file I configure the IIS to use a user name and password when connecting to the DB and then I encrypt it with a key using RSA. The key will be generated using aspnet_regiis and exported into all IIS Machines. Each production server holds only the encrypted web.config file (and an imported key in the secured in the IIS).

The other approach will be to define in the web.config a connection using windows authentication. This will be a lot less work on my side.

Which practice is better ? Which is safer? 

When a certificate is expired, its revocation status is no longer published. That is, the certificate might have been revoked long ago, but it will no longer be included in the CRL. Certificate expiration date is the cut-off date for CRL inclusion. That's the official reason why certificates expire: to keep CRL size bounded.

(The unofficial reason is to make certificate owners pay an annual fee.)

So you cannot trust an expired certificate because you cannot check its revocation status. It might have been revoked months ago, and you would not know it.
