Reject certificates that are valid for too long.

net/cert/cert_status_flags.cc

Index: net/cert/cert_status_flags.cc
diff --git a/net/cert/cert_status_flags.cc b/net/cert/cert_status_flags.cc
index 06ecddc04bf5a99487b3a3d1ee9084b6c3f95fdb..840741fc164aa5fcb3ed0844deb4696fd8fc600f 100644
--- a/net/cert/cert_status_flags.cc
+++ b/net/cert/cert_status_flags.cc
@@ -51,6 +51,8 @@ CertStatus MapNetErrorToCertStatus(int error) {
       return CERT_STATUS_WEAK_DH_KEY;
     case ERR_CERT_NAME_CONSTRAINT_VIOLATION:
       return CERT_STATUS_NAME_CONSTRAINT_VIOLATION;
+    case ERR_CERT_TOO_LONG_VALIDITY:
+      return CERT_STATUS_TOO_LONG_VALIDITY;
     default:
       return 0;
   }
@@ -85,6 +87,8 @@ int MapCertStatusToNetError(CertStatus cert_status) {
     return ERR_CERT_WEAK_KEY;
   if (cert_status & CERT_STATUS_DATE_INVALID)
     return ERR_CERT_DATE_INVALID;
+  if (cert_status & CERT_STATUS_TOO_LONG_VALIDITY)
+    return ERR_CERT_TOO_LONG_VALIDITY;
 
   // Unknown status.  Give it the benefit of the doubt.
   if (cert_status & CERT_STATUS_UNABLE_TO_CHECK_REVOCATION)