Reject certificates that are valid for too long.

net/cert/cert_verify_proc_unittest.cc

Index: net/cert/cert_verify_proc_unittest.cc
diff --git a/net/cert/cert_verify_proc_unittest.cc b/net/cert/cert_verify_proc_unittest.cc
index 9d7e7503ba4d62ed1c79cf1b741a88d0d9674c5b..7325a9d5792424414bce5e9bf1edead3cd4055db 100644
--- a/net/cert/cert_verify_proc_unittest.cc
+++ b/net/cert/cert_verify_proc_unittest.cc
@@ -613,6 +613,18 @@ TEST_F(CertVerifyProcTest, NameConstraintsFailure) {
             verify_result.cert_status & CERT_STATUS_NAME_CONSTRAINT_VIOLATION);
 }
 
+TEST_F(CertVerifyProcTest, TestHasTooLongValidity) {
+  base::FilePath certs_dir = GetTestCertsDirectory();
+  scoped_refptr<X509Certificate> ok_cert =
+      ImportCertFromFile(certs_dir, "ok_cert.pem");
+  EXPECT_TRUE(CertVerifyProc::HasTooLongValidity(*ok_cert));
+
+  scoped_refptr<X509Certificate> compliant_cert =
+      ImportCertFromFile(certs_dir, "br-compliant-validity.pem");
+  EXPECT_FALSE(CertVerifyProc::HasTooLongValidity(*compliant_cert));
+}
+
+// The certse.pem certificate has been revoked. crbug.com/259723.
 TEST_F(CertVerifyProcTest, TestKnownRoot) {
   if (!SupportsDetectingKnownRoots()) {
     LOG(INFO) << "Skipping this test in this platform.";