Handle Origin Bound Certificate expiration.

net/base/x509_util.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_UTIL_H_
 #define NET_BASE_X509_UTIL_H_
 #pragma once
 
 #include <string>
 
 #include "base/time.h"
 #include "net/base/net_export.h"
 
 namespace crypto {
 class ECPrivateKey;
 class RSAPrivateKey;
 }
 
 namespace net {
 
 namespace x509_util {
 
 // Creates an origin bound certificate containing the public key in |key|.
 // Web origin, serial number and validity period are given as

[wtc, 2011/12/15 03:18:51]

"validity period" in this comment may need to be updated.

It may make sense for these two functions to have both
a not_valid_before and not_valid_after parameter, so that
these two functions don't need to call PR_Now().

[mattm, 2011/12/20 00:28:38]

I think with the following change, "validity period" still describes the given
params.
done

 // parameters. The certificate is signed by the private key in |key|.
 // The hashing algorithm for the signature is SHA-1.
 //
 // See Internet Draft draft-balfanz-tls-obc-00 for more details:
 // http://tools.ietf.org/html/draft-balfanz-tls-obc-00
 bool NET_EXPORT_PRIVATE CreateOriginBoundCertRSA(crypto::RSAPrivateKey* key,
                                                  const std::string& origin,
                                                  uint32 serial_number,
-                                                 base::TimeDelta valid_duration,
+                                                 base::Time not_valid_after,
                                                  std::string* der_cert);
 bool NET_EXPORT_PRIVATE CreateOriginBoundCertEC(crypto::ECPrivateKey* key,
                                                 const std::string& origin,
                                                 uint32 serial_number,
-                                                base::TimeDelta valid_duration,
+                                                base::Time not_valid_after,
                                                 std::string* der_cert);
 
 } // namespace x509_util
 
 } // namespace net
 
 #endif  // NET_BASE_X509_UTIL_H_