Fix the "certificate is not yet valid" error for server certificates

net/base/x509_certificate.cc

Index: net/base/x509_certificate.cc
===================================================================
--- net/base/x509_certificate.cc	(revision 107789)
+++ net/base/x509_certificate.cc	(working copy)
@@ -232,7 +232,7 @@
     return false;
 
   SHA1FingerprintLessThan fingerprint_functor;
-  return fingerprint_functor(lhs->fingerprint_, rhs->fingerprint_);
+  return fingerprint_functor(lhs->chain_fingerprint_, rhs->chain_fingerprint_);

[wtc, 2011/10/28 23:21:37]

This LessThan operator is what made me calculate the chain
fingerprint for every X509Certificate.

The LessThan operator needs to take intermediate_ca_certs_
into account.  Do you have any suggestion?

Perhaps we can just do pointer comparison on the
intermediate CA cert handles, because of the OSCertHandle
cache?

[Ryan Sleevi, 2011/10/28 23:32:43]

The only instance I see using this is the content/browser/cert_store.h
(previously it was also used by the old cache).

Perhaps I'm over-thinking it, but it would seem that it's possible to just
update the CertStore to use the ChainFingerprint() as the key, since it doesn't
need to look up the actual |X509Certificate*|.

Then we could remove this functor entirely.

So this would make it most likely just two calls (the first time during the
CertVerifier cache lookup, the second time during the CertStore lookup).

I know without metrics, it's hard to judge which is worse, but considering
you've expressed concerns with just the |fingerprint_| in the past, and based on
how widely we use X509Certificate for things other than CertVerifier/CertStore,
my gut is that as-is will end up calculating fingerprints more often than just
updating those two.

 }
 
 X509Certificate::X509Certificate(const std::string& subject,
@@ -245,6 +245,7 @@
       valid_expiry_(expiration_date),
       cert_handle_(NULL) {
   memset(fingerprint_.data, 0, sizeof(fingerprint_.data));
+  memset(chain_fingerprint_.data, 0, sizeof(chain_fingerprint_.data));
 }
 
 // static