Reject certificates that are valid for too long.

net/cert/cert_status_flags.cc

Index: net/cert/cert_status_flags.cc
diff --git a/net/cert/cert_status_flags.cc b/net/cert/cert_status_flags.cc
index 8cb736c5485bd9ddc81b0784afb89b2e40646938..9c8ad1b1fd00ef47d1f28ef908f582a22b75d630 100644
--- a/net/cert/cert_status_flags.cc
+++ b/net/cert/cert_status_flags.cc
@@ -43,6 +43,8 @@ CertStatus MapNetErrorToCertStatus(int error) {
       return CERT_STATUS_WEAK_SIGNATURE_ALGORITHM;
     case ERR_CERT_WEAK_KEY:
       return CERT_STATUS_WEAK_KEY;
+    case ERR_CERT_TOO_LONG_VALIDITY:
+      return CERT_STATUS_TOO_LONG_VALIDITY;
     default:
       return 0;
   }
@@ -69,6 +71,8 @@ int MapCertStatusToNetError(CertStatus cert_status) {
     return ERR_CERT_WEAK_KEY;
   if (cert_status & CERT_STATUS_DATE_INVALID)
     return ERR_CERT_DATE_INVALID;
+  if (cert_status & CERT_STATUS_TOO_LONG_VALIDITY)
+    return ERR_CERT_TOO_LONG_VALIDITY;
 
   // Unknown status.  Give it the benefit of the doubt.
   if (cert_status & CERT_STATUS_UNABLE_TO_CHECK_REVOCATION)