Don't expire certs used as channel IDs.

net/socket/ssl_client_socket_nss.cc

Index: net/socket/ssl_client_socket_nss.cc
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index c762e9350adc2539c7d3263728ced8c5a1af2e98..fd6b6b4349db8d85e06522aa0f2c20ba17310207 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -998,8 +998,6 @@ bool SSLClientSocketNSS::Core::Init(PRFileDesc* socket,
       DVLOG(1) << "NULL server_bound_cert_service_, not enabling channel ID.";
     } else if (!crypto::ECPrivateKey::IsSupported()) {
       DVLOG(1) << "Elliptic Curve not supported, not enabling channel ID.";
-    } else if (!server_bound_cert_service_->IsSystemTimeValid()) {
-      DVLOG(1) << "System time is weird, not enabling channel ID.";

[mattm, 2013/03/29 02:59:48]

Can not remove this (and associated stuff), since the code still uses the system
time when creating the cert in server_bound_cert_service.cc:GenerateCert.

[thaidn_google, 2013/03/29 18:48:01]

Done.

     } else {
       rv = SSL_SetClientChannelIDCallback(
           nss_fd_, SSLClientSocketNSS::Core::ClientChannelIDHandler, this);
@@ -2543,8 +2541,7 @@ void SSLClientSocketNSS::Core::RecordChannelIDSupport() const {
     CLIENT_ONLY = 1,
     CLIENT_AND_SERVER = 2,
     CLIENT_NO_ECC = 3,
-    CLIENT_BAD_SYSTEM_TIME = 4,
-    CLIENT_NO_SERVER_BOUND_CERT_SERVICE = 5,
+    CLIENT_NO_SERVER_BOUND_CERT_SERVICE = 4,

[mattm, 2013/03/29 02:59:48]

see comment above ("Since this enum is used for a histogram, do not change or
re-use values.")

[thaidn_google, 2013/03/29 18:48:01]

Done.

     DOMAIN_BOUND_CERT_USAGE_MAX
   } supported = DISABLED;
   if (channel_id_xtn_negotiated_) {
@@ -2554,8 +2551,6 @@ void SSLClientSocketNSS::Core::RecordChannelIDSupport() const {
       supported = CLIENT_NO_SERVER_BOUND_CERT_SERVICE;
     else if (!crypto::ECPrivateKey::IsSupported())
       supported = CLIENT_NO_ECC;
-    else if (!server_bound_cert_service_->IsSystemTimeValid())
-      supported = CLIENT_BAD_SYSTEM_TIME;
     else
       supported = CLIENT_ONLY;
   }