Revert "Reject certificates that are valid for too long."

net/cert/cert_verify_proc.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
-#include <stdint.h>
-
 #include "base/basictypes.h"
 #include "base/metrics/histogram.h"
 #include "base/sha1.h"
 #include "base/strings/stringprintf.h"
-#include "base/time/time.h"
 #include "build/build_config.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_util.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/crl_set.h"
 #include "net/cert/x509_certificate.h"
 #include "url/url_canon.h"
 
 #if defined(USE_NSS) || defined(OS_IOS)
 #include "net/cert/cert_verify_proc_nss.h"
 #elif defined(USE_OPENSSL_CERTS) && !defined(OS_ANDROID)
 #include "net/cert/cert_verify_proc_openssl.h"
 #elif defined(OS_ANDROID)
 #include "net/cert/cert_verify_proc_android.h"
 #elif defined(OS_MACOSX)
 #include "net/cert/cert_verify_proc_mac.h"
 #elif defined(OS_WIN)
 #include "net/cert/cert_verify_proc_win.h"
 #else
 #error Implement certificate verification.
 #endif
 
+
 namespace net {
 
 namespace {
 
 // Constants used to build histogram names
 const char kLeafCert[] = "Leaf";
 const char kIntermediateCert[] = "Intermediate";
 const char kRootCert[] = "Root";
 // Matches the order of X509Certificate::PublicKeyType
 const char* const kCertTypeStrings[] = {
@@ skipping 222 matching lines @@
   // hosts. While the CA/Browser Forum Baseline Requirements (v1.1) permit
   // these to be issued until 1 November 2015, they represent a real risk for
   // the deployment of gTLDs and are being phased out ahead of the hard
   // deadline.
   if (verify_result->is_issued_by_known_root && IsHostnameNonUnique(hostname)) {
     verify_result->cert_status |= CERT_STATUS_NON_UNIQUE_NAME;
     // CERT_STATUS_NON_UNIQUE_NAME will eventually become a hard error. For
     // now treat it as a warning and do not map it to an error return value.
   }
 
-  // Flag certificates using too long validity periods.
-  if (verify_result->is_issued_by_known_root && HasTooLongValidity(*cert)) {
-    verify_result->cert_status |= CERT_STATUS_VALIDITY_TOO_LONG;
-    if (rv == OK)
-      rv = MapCertStatusToNetError(verify_result->cert_status);
-  }
-
   return rv;
 }
 
 // static
 bool CertVerifyProc::IsBlacklisted(X509Certificate* cert) {
   static const unsigned kComodoSerialBytes = 16;
   static const uint8 kComodoSerials[][kComodoSerialBytes] = {
     // Not a real certificate. For testing only.
     {0x07,0x7a,0x59,0xbc,0xd5,0x34,0x59,0x60,0x1c,0xa6,0x90,0x72,0x67,0xa6,0xdd,0x1c},
 
@@ skipping 318 matching lines @@
           if (!CheckNameConstraints(dns_names, kLimits[i].domains))
             return true;
         }
       }
     }
   }
 
   return false;
 }
 
-// static
-bool CertVerifyProc::HasTooLongValidity(const X509Certificate& cert) {
-  const base::Time& start = cert.valid_start();
-  const base::Time& expiry = cert.valid_expiry();
-  if (start.is_max() || start.is_null() || expiry.is_max() ||
-      expiry.is_null() || start > expiry) {
-    return true;
-  }
-
-  base::Time::Exploded exploded_start;
-  base::Time::Exploded exploded_expiry;
-  cert.valid_start().UTCExplode(&exploded_start);
-  cert.valid_expiry().UTCExplode(&exploded_expiry);
-
-  if (exploded_expiry.year - exploded_start.year > 10)
-    return true;
-  int month_diff = (exploded_expiry.year - exploded_start.year) * 12 +
-                   (exploded_expiry.month - exploded_start.month);
-
-  // Add any remainder as a full month.
-  if (exploded_expiry.day_of_month > exploded_start.day_of_month)
-    ++month_diff;
-
-  static const base::Time time_2015_04_01 =
-      base::Time::FromInternalValue(INT64_C(1427871600));
-  static const base::Time time_2012_07_01 =
-      base::Time::FromInternalValue(INT64_C(1341126000));
-  static const base::Time time_2019_07_01 =
-      base::Time::FromInternalValue(INT64_C(1561964400));
-
-  if (start >= time_2015_04_01)
-    return month_diff > 39;
-  if (start >= time_2012_07_01)
-    return month_diff > 60;
-  return month_diff > 120 || expiry > time_2019_07_01;
-}
-
 }  // namespace net