Fix the "certificate is not yet valid" error for server certificates

net/base/x509_certificate.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <map>
@@ skipping 214 matching lines @@
 #endif
 
 }  // namespace
 
 bool X509Certificate::LessThan::operator()(X509Certificate* lhs,
                                            X509Certificate* rhs) const {
   if (lhs == rhs)
     return false;
 
   SHA1FingerprintLessThan fingerprint_functor;
-  return fingerprint_functor(lhs->fingerprint_, rhs->fingerprint_);
+  return fingerprint_functor(lhs->chain_fingerprint_, rhs->chain_fingerprint_);

[wtc, 2011/10/28 23:21:37]

This LessThan operator is what made me calculate the chain
fingerprint for every X509Certificate.

The LessThan operator needs to take intermediate_ca_certs_
into account.  Do you have any suggestion?

Perhaps we can just do pointer comparison on the
intermediate CA cert handles, because of the OSCertHandle
cache?

[Ryan Sleevi, 2011/10/28 23:32:43]

The only instance I see using this is the content/browser/cert_store.h
(previously it was also used by the old cache).

Perhaps I'm over-thinking it, but it would seem that it's possible to just
update the CertStore to use the ChainFingerprint() as the key, since it doesn't
need to look up the actual |X509Certificate*|.

Then we could remove this functor entirely.

So this would make it most likely just two calls (the first time during the
CertVerifier cache lookup, the second time during the CertStore lookup).

I know without metrics, it's hard to judge which is worse, but considering
you've expressed concerns with just the |fingerprint_| in the past, and based on
how widely we use X509Certificate for things other than CertVerifier/CertStore,
my gut is that as-is will end up calculating fingerprints more often than just
updating those two.

 }
 
 X509Certificate::X509Certificate(const std::string& subject,
                                  const std::string& issuer,
                                  base::Time start_date,
                                  base::Time expiration_date)
     : subject_(subject),
       issuer_(issuer),
       valid_start_(start_date),
       valid_expiry_(expiration_date),
       cert_handle_(NULL) {
   memset(fingerprint_.data, 0, sizeof(fingerprint_.data));
+  memset(chain_fingerprint_.data, 0, sizeof(chain_fingerprint_.data));
 }
 
 // static
 X509Certificate* X509Certificate::CreateFromHandle(
     OSCertHandle cert_handle,
     const OSCertHandles& intermediates) {
   DCHECK(cert_handle);
   return new X509Certificate(cert_handle, intermediates);
 }
 
@@ skipping 766 matching lines @@
 bool X509Certificate::IsSHA1HashInSortedArray(const SHA1Fingerprint& hash,
                                               const uint8* array,
                                               size_t array_byte_len) {
   DCHECK_EQ(0u, array_byte_len % base::kSHA1Length);
   const size_t arraylen = array_byte_len / base::kSHA1Length;
   return NULL != bsearch(hash.data, array, arraylen, base::kSHA1Length,
                          CompareSHA1Hashes);
 }
 
 }  // namespace net