Treat failure to parse certificates as SSL protocol errors.

net/data/ssl/certificates/README

 This directory contains various certificates for use with SSL-related
 unit tests.
 
 ===== Real-world certificates that need manual updating
 - google.binary.p7b
 - google.chain.pem
 - google.pem_cert.p7b
 - google.pem_pkcs7.p7b
 - google.pkcs7.p7b
 - google.single.der
@@ skipping 111 matching lines @@
 - no_subject_common_name_cert.pem: Used to test the function that generates a
   NSS certificate nickname for a user certificate. This certificate's Subject
   field doesn't have a common name.
 
 - quic_intermediate.crt
 - quic_test_ecc.example.com.crt
 - quic_test.example.com.crt
 - quic_root.crt
      These certificates are used by the ProofVerifier's unit tests of QUIC.
 
+- bad_validity.pem : A certificate with bogus notBefore and notAfter fields.
+     Windows refuses to parse this certificate.

[Ryan Sleevi, 2015/08/12 22:03:19]

It'd be preferable to not manually generate this. Can you add it to one of the
test scripts?

[davidben, 2015/08/12 22:14:05]

This was generated from the Go program attached in the bug. There's no reason to
ever regenerate it since it will never expire. If you give me an OpenSSL
command-line to generate such a certificate, I'll include it, but I as a general
rule try to avoid that tool. :-P Generating certificates with anything but Go is
just a pain.

[Ryan Sleevi, 2015/08/13 22:54:57]

Eh, that's what we said about the certs until we switched SHA-1 to SHA-256 ;)
That may be, but it's also the consistent way that multiple developers can
collaborate (especially developers who hate Go :P). 

Load up net/data/ssl/scripts/generate-test-certs.sh . You can see explicit date
assignment at
https://code.google.com/p/chromium/codesearch#chromium/src/net/data/ssl/scrip...
as an example.

You can see explicit name assignment at
https://code.google.com/p/chromium/codesearch#chromium/src/net/data/ssl/scrip...

It uses ASN1_TIME_set_string, which should handle dates even outside the
representation of a time_t

[davidben, 2015/08/14 22:42:36]

Done. Yeah, I really don't like using openssl x509. It's obnoxious. :-) Used Go
to do CVE-2015-1793 as well.

+
 ===== From net/data/ssl/scripts/generate-test-certs.sh
 - expired_cert.pem
 - ok_cert.pem
 - root_ca_cert.pem
     These certificates are the common certificates used by the Python test
     server for simulating HTTPS connections.
 
 - name_constraint_bad.pem
 - name_constraint_good.pem
     Two certificates used to test the built-in ability to restrict a root to
@@ skipping 124 matching lines @@
 ===== From net/data/ssl/scripts/generate-aia-certs.sh
 - aia-cert.pem
 - aia-intermediate.der
 - aia-root.pem
      A certificate chain which we use to ensure AIA fetching works correctly
      when using NSS to verify certificates (which uses our HTTP stack).
      aia-cert.pem has a caIssuers that points to "aia-test.invalid" as the URL
      containing the intermediate, which can be served via a URLRequestFilter.
      aia-intermediate.der is stored in DER form for convenience, since that is
      the form expected of certificates discovered via AIA.