Fix the "certificate is not yet valid" error for server certificates

net/base/x509_certificate_mac.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 #include <time.h>
@@ skipping 522 matching lines @@
   status = SecCertificateGetIssuer(cert_handle_, &name);
   if (!status)
     issuer_.Parse(name);
 
   GetCertDateForOID(cert_handle_, CSSMOID_X509V1ValidityNotBefore,
                     &valid_start_);
   GetCertDateForOID(cert_handle_, CSSMOID_X509V1ValidityNotAfter,
                     &valid_expiry_);
 
   fingerprint_ = CalculateFingerprint(cert_handle_);
+  chain_fingerprint_ = CalculateChainFingerprint();
   serial_number_ = GetCertSerialNumber(cert_handle_);
 }
 
 // IsIssuedByKnownRoot returns true if the given chain is rooted at a root CA
 // that we recognise as a standard root.
 // static
 bool X509Certificate::IsIssuedByKnownRoot(CFArrayRef chain) {
   int n = CFArrayGetCount(chain);
   if (n < 1)
     return false;
@@ skipping 509 matching lines @@
     return sha1;
 
   DCHECK(cert_data.Data);
   DCHECK_NE(cert_data.Length, 0U);
 
   CC_SHA1(cert_data.Data, cert_data.Length, sha1.data);
 
   return sha1;
 }
 
+SHA1Fingerprint X509Certificate::CalculateChainFingerprint() const {
+  SHA1Fingerprint sha1;
+  memset(sha1.data, 0, sizeof(sha1.data));
+
+  // The CC_SHA(3cc) man page says all CC_SHA1_xxx routines return 1, so
+  // we don't check their return values.
+  CC_SHA1_CTX sha1_ctx;
+  CC_SHA1_Init(&sha1_ctx);
+  CSSM_DATA cert_data;
+  OSStatus status = SecCertificateGetData(cert_handle_, &cert_data);
+  if (status)
+    return sha1;
+  CC_SHA1_Update(&sha1_ctx, cert_data.Data, cert_data.Length);
+  for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) {
+    status = SecCertificateGetData(intermediate_ca_certs_[i], &cert_data);
+    if (status)
+      return sha1;
+    CC_SHA1_Update(&sha1_ctx, cert_data.Data, cert_data.Length);
+  }
+  CC_SHA1_Final(sha1.data, &sha1_ctx);
+
+  return sha1;
+}
+
 bool X509Certificate::SupportsSSLClientAuth() const {
   CSSMFields fields;
   if (GetCertFields(cert_handle_, &fields) != noErr)
     return false;
 
   // Gather the extensions we care about. We do not support
   // CSSMOID_NetscapeCertType on OS X.
   const CE_ExtendedKeyUsage* ext_key_usage = NULL;
   const CE_KeyUsage* key_usage = NULL;
   for (unsigned f = 0; f < fields.num_of_fields; ++f) {
@@ skipping 258 matching lines @@
   CSSM_DATA cert_data;
   OSStatus status = SecCertificateGetData(cert_handle, &cert_data);
   if (status)
     return false;
 
   return pickle->WriteData(reinterpret_cast<char*>(cert_data.Data),
                            cert_data.Length);
 }
 
 }  // namespace net