Remove the check for the obsolete CERT_TRUST_IS_NOT_TIME_NESTED...

net/base/x509_certificate_win.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include "base/crypto/scoped_capi_types.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/pickle.h"
@@ skipping 75 matching lines @@
       LOG(WARNING) << "Unknown error " << err << " mapped to net::ERR_FAILED";
       return ERR_FAILED;
   }
 }
 
 // Map the errors in the chain_context->TrustStatus.dwErrorStatus returned by
 // CertGetCertificateChain to our certificate status flags.
 int MapCertChainErrorStatusToCertStatus(DWORD error_status) {
   int cert_status = 0;
 
-  // CERT_TRUST_IS_NOT_TIME_NESTED means a subject certificate's time validity
-  // does not nest correctly within its issuer's time validity.
+  // CERT_TRUST_IS_NOT_TIME_NESTED is obsolete, but we don't consider it an

[agl, 2011/01/21 16:47:47]

This would make me look for it in the code. Maybe

"We don't include CERT_TRUST_IS_NOT_TIME_NESTED because it's obsolete and we
wouldn't consider it an error anyway".

+  // error anyway.
   const DWORD kDateInvalidErrors = CERT_TRUST_IS_NOT_TIME_VALID |
-                                   CERT_TRUST_IS_NOT_TIME_NESTED |
                                    CERT_TRUST_CTL_IS_NOT_TIME_VALID;
   if (error_status & kDateInvalidErrors)
     cert_status |= CERT_STATUS_DATE_INVALID;
 
   const DWORD kAuthorityInvalidErrors = CERT_TRUST_IS_UNTRUSTED_ROOT |
                                         CERT_TRUST_IS_EXPLICIT_DISTRUST |
                                         CERT_TRUST_IS_PARTIAL_CHAIN;
   if (error_status & kAuthorityInvalidErrors)
     cert_status |= CERT_STATUS_AUTHORITY_INVALID;
 
@@ skipping 777 matching lines @@
   DWORD sha1_size = sizeof(sha1.data);
   rv = CryptHashCertificate(NULL, CALG_SHA1, 0, cert->pbCertEncoded,
                             cert->cbCertEncoded, sha1.data, &sha1_size);
   DCHECK(rv && sha1_size == sizeof(sha1.data));
   if (!rv)
     memset(sha1.data, 0, sizeof(sha1.data));
   return sha1;
 }
 
 }  // namespace net