Reject certificates that are valid for too long.

net/data/ssl/scripts/generate-test-certs.sh

 #!/bin/sh
 
 # Copyright 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # This script generates a set of test (end-entity, intermediate, root)
 # certificates that can be used to test fetching of an intermediate via AIA.
 
 try() {
@@ skipping 49 matching lines @@
     -startdate 060101000000Z \
     -enddate 070101000000Z \
     -in out/expired_cert.req \
     -out out/expired_cert.pem \
     -config ca.cnf
 
 CA_COMMON_NAME="Test Root CA" \
   try openssl ca \
     -batch \
     -extensions user_cert \
-    -days 3650 \
+    -days 1000 \

[Ryan Sleevi, 2014/11/04 21:48:27]

Why was this change necessary? Unrelated? Why didn't you change line 80?

Seems like this was unnecessary given your new code to avoid ok_cert

[palmer, 2014/11/07 19:16:14]

Yeah, reverted. I think it was from when I was trying to get ok_cert to work for
me.

     -in out/ok_cert.req \
     -out out/ok_cert.pem \
     -config ca.cnf
 
 CA_COMMON_NAME="Test Root CA" \
   try openssl ca \
     -batch \
     -extensions name_constraint_bad \
     -subj "/CN=Leaf certificate/" \
     -days 3650 \
@@ skipping 36 matching lines @@
 
 ## SubjectAltName parsing
 try openssl req -x509 -days 3650 -extensions req_san_sanity \
     -config ../scripts/ee.cnf -newkey rsa:2048 -text \
     -out ../certificates/subjectAltName_sanity_check.pem
 
 ## Punycode handling
 SUBJECT_NAME="req_punycode_dn" \
   try openssl req -x509 -days 3650 -extensions req_punycode \
     -config ../scripts/ee.cnf -newkey rsa:2048 -text \
-     -out ../certificates/punycodetest.pem
+    -out ../certificates/punycodetest.pem
+
+## Reject intranet hosts

[Ryan Sleevi, 2014/11/04 21:48:27]

Reject intranet hostnames in "publicly" trusted certs

[palmer, 2014/11/07 19:16:14]

Done.

+SUBJECT_NAME="req_dn" \
+  try openssl req -x509 -days $((365 * 3)) \
+    -config ../scripts/ee.cnf -newkey rsa:2048 -text \
+    -out ../certificates/reject_intranet_hosts.pem
+
+## Validity too long
+try openssl req -config ../scripts/ee.cnf \
+  -newkey rsa:2048 -text -out ../certificates/11_year_validity.req
+CA_COMMON_NAME="Test Root CA" \
+  try openssl ca \
+    -batch \
+    -extensions user_cert \
+    -startdate 141030000000Z \
+    -days $((365 * 11)) \

[Ryan Sleevi, 2014/11/04 21:48:27]

ಠ_ಠ

KISS. This is /bin/sh style we're dealing with.

[palmer, 2014/11/07 19:16:14]

Done.

+    -in ../certificates/11_year_validity.req \
+    -out ../certificates/11_year_validity.pem \
+    -config ca.cnf
+try openssl req -config ../scripts/ee.cnf \
+  -newkey rsa:2048 -text -out ../certificates/40_months_after_2015_04.req
+CA_COMMON_NAME="Test Root CA" \
+  try openssl ca \
+    -batch \
+    -extensions user_cert \
+    -startdate 150402000000Z \
+    -enddate 180901000000Z \
+    -in ../certificates/40_months_after_2015_04.req \
+    -out ../certificates/40_months_after_2015_04.pem \
+    -config ca.cnf
+try openssl req -config ../scripts/ee.cnf \
+  -newkey rsa:2048 -text -out ../certificates/61_months_after_2012_07.req
+CA_COMMON_NAME="Test Root CA" \
+  try openssl ca \
+    -batch \
+    -extensions user_cert \
+    -startdate 141030000000Z \
+    -days $((30 * 61)) \

[Ryan Sleevi, 2014/11/04 21:48:27]

Ditto

[palmer, 2014/11/07 19:16:14]

Done and on line 131 too.

+    -in ../certificates/61_months_after_2012_07.req \
+    -out ../certificates/61_months_after_2012_07.pem \
+    -config ca.cnf
 
 # Regenerate CRLSets
 ## Block a leaf cert directly by SPKI
 try python crlsetutil.py -o ../certificates/crlset_by_leaf_spki.raw \
 <<CRLBYLEAFSPKI
 {
   "BlockedBySPKI": ["../certificates/ok_cert.pem"]
 }
 CRLBYLEAFSPKI
 
@@ skipping 11 matching lines @@
 ## Block a leaf cert by issuer-hash-and-serial. However, this will be issued
 ## from an intermediate CA issued underneath a root.
 try python crlsetutil.py -o ../certificates/crlset_by_intermediate_serial.raw \
 <<CRLSETBYINTERMEDIATESERIAL
 {
   "BlockedByHash": {
     "../certificates/quic_intermediate.crt": [3]
   }
 }
 CRLSETBYINTERMEDIATESERIAL