Don't expire certs used as channel IDs.

net/ssl/server_bound_cert_service.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SERVER_BOUND_CERT_SERVICE_H_
 #define NET_SSL_SERVER_BOUND_CERT_SERVICE_H_
 
 #include <map>
 #include <string>
 #include <vector>
@@ skipping 11 matching lines @@
 namespace base {
 class TaskRunner;
 }
 
 namespace net {
 
 class ServerBoundCertServiceJob;
 class ServerBoundCertServiceRequest;
 class ServerBoundCertServiceWorker;
 
-// A class for creating and fetching server bound certs.
+// A class for creating and fetching server bound certs. These certs are used
+// to identify users' machines; their public keys are used as channel IDs in
+// http://tools.ietf.org/html/draft-balfanz-tls-channelid-00.
+// As a result although certs are set to be invalid after one year, we don't
+// actually expire them. Once generated, certs are valid as long as the users
+// want. Users can delete existing certs, and new certs will be generated
+// automatically.
+
 // Inherits from NonThreadSafe in order to use the function
 // |CalledOnValidThread|.
 class NET_EXPORT ServerBoundCertService
     : NON_EXPORTED_BASE(public base::NonThreadSafe) {
  public:
   class NET_EXPORT RequestHandle {
    public:
     RequestHandle();
     ~RequestHandle();
 
@@ skipping 113 matching lines @@
   uint64 inflight_joins_;
 
   bool is_system_time_valid_;
 
   DISALLOW_COPY_AND_ASSIGN(ServerBoundCertService);
 };
 
 }  // namespace net
 
 #endif  // NET_SSL_SERVER_BOUND_CERT_SERVICE_H_