Mark SHA-1 as deprecated

net/cert/cert_verify_proc.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include "base/basictypes.h"
 #include "base/metrics/histogram.h"
 #include "base/sha1.h"
 #include "base/strings/stringprintf.h"
@@ skipping 244 matching lines @@
   // Flag certificates using weak signature algorithms.
   if (verify_result->has_md5) {
     verify_result->cert_status |= CERT_STATUS_WEAK_SIGNATURE_ALGORITHM;
     // Avoid replacing a more serious error, such as an OS/library failure,
     // by ensuring that if verification failed, it failed with a certificate
     // error.
     if (rv == OK || IsCertificateError(rv))
       rv = MapCertStatusToNetError(verify_result->cert_status);
   }
 
+  // The date to begin warning about SHA-1 deprecation
+  // 2016-01-01 00:00:00 UTC
+  static const int64_t kSHA1DeprecationDate = INT64_C(13096080000000000);
+  if (verify_result->has_sha1 &&
+      verify_result->verified_cert->valid_expiry() >
+          base::Time::FromInternalValue(kSHA1DeprecationDate)) {
+    // The leaf certificate has a validity period beyond the (soft) SHA-1
+    // sunset date of 2016/1/1 and the (hard) SHA-1 sunset date of 2017/1/1,
+    // and SHA-1 appears in the chain. As such, flag it as deprecated.
+    //
+    // Note: Only the leaf validity period is checked, as it's expected that
+    // nearly all intermediates will exceed the 2016/2017 validity range. The
+    // purpose of this check is to discourage NEW SHA-1 certificates, which is
+    // why it's only necessary to check the leaf.
+    verify_result->cert_status |= CERT_STATUS_DEPRECATED_SIGNATURE_ALGORITHM;
+  }
+
   // Flag certificates from publicly-trusted CAs that are issued to intranet
   // hosts. While the CA/Browser Forum Baseline Requirements (v1.1) permit
   // these to be issued until 1 November 2015, they represent a real risk for
   // the deployment of gTLDs and are being phased out ahead of the hard
   // deadline.
   if (verify_result->is_issued_by_known_root && IsHostnameNonUnique(hostname)) {
     verify_result->cert_status |= CERT_STATUS_NON_UNIQUE_NAME;
     // CERT_STATUS_NON_UNIQUE_NAME will eventually become a hard error. For
     // now treat it as a warning and do not map it to an error return value.
   }
@@ skipping 327 matching lines @@
             return true;
         }
       }
     }
   }
 
   return false;
 }
 
 }  // namespace net