Reject certificates that are valid for too long.

net/cert/cert_verify_proc_unittest.cc

Index: net/cert/cert_verify_proc_unittest.cc
diff --git a/net/cert/cert_verify_proc_unittest.cc b/net/cert/cert_verify_proc_unittest.cc
index 10a880b42ccc3f7b111f256c65c85e2ea5016f7f..6715950e8fa24f2d6339160ec1a0b40a6cbc2aaa 100644
--- a/net/cert/cert_verify_proc_unittest.cc
+++ b/net/cert/cert_verify_proc_unittest.cc
@@ -615,6 +615,18 @@ TEST_F(CertVerifyProcTest, NameConstraintsFailure) {
             verify_result.cert_status & CERT_STATUS_NAME_CONSTRAINT_VIOLATION);
 }
 
+TEST_F(CertVerifyProcTest, TestHasTooLongValidity) {
+  base::FilePath certs_dir = GetTestCertsDirectory();
+  scoped_refptr<X509Certificate> ok_cert =
+      ImportCertFromFile(certs_dir, "ok_cert.pem");
+  EXPECT_TRUE(CertVerifyProc::HasTooLongValidity(*ok_cert));
+
+  scoped_refptr<X509Certificate> compliant_cert =
+      ImportCertFromFile(certs_dir, "br-compliant-validity.pem");
+  EXPECT_FALSE(CertVerifyProc::HasTooLongValidity(*compliant_cert));
+}
+
+// The certse.pem certificate has been revoked. crbug.com/259723.
 TEST_F(CertVerifyProcTest, TestKnownRoot) {
   if (!SupportsDetectingKnownRoots()) {
     LOG(INFO) << "Skipping this test in this platform.";