Reject certificates that are valid for too long.

net/data/ssl/certificates/start_after_expiry.pem

Index: net/data/ssl/certificates/start_after_expiry.pem
diff --git a/net/data/ssl/certificates/start_after_expiry.pem b/net/data/ssl/certificates/start_after_expiry.pem
new file mode 100644
index 0000000000000000000000000000000000000000..7498654f32baac88dee7d100e6853f117cf7a469
--- /dev/null
+++ b/net/data/ssl/certificates/start_after_expiry.pem
@@ -0,0 +1,82 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 8 (0x8)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Test Root CA
+        Validity
+            Not Before: Sep  1 00:00:00 2018 GMT
+            Not After : Apr  2 00:00:00 2015 GMT
+        Subject: C=US, ST=California, L=Mountain View, O=Test CA, CN=127.0.0.1
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c4:54:f5:42:22:fc:43:f4:68:f9:15:c3:cf:a1:
+                    88:35:58:a3:30:cc:eb:df:54:5c:d7:a0:19:00:7b:
+                    f4:65:6a:68:52:db:a6:52:48:26:ca:86:29:de:5e:
+                    7b:81:60:fb:ee:7d:11:58:38:48:61:1b:36:2b:41:
+                    8e:7a:99:b3:4e:5d:95:7a:4c:14:04:b4:92:ca:a3:
+                    75:41:bf:a9:91:3c:32:b4:02:1c:d3:86:29:b1:b0:
+                    02:ad:08:a9:72:13:79:95:fa:3c:c1:01:8b:e4:76:
+                    1f:21:ed:98:2b:63:07:7a:ce:6b:59:1c:92:5f:d8:
+                    cb:e0:f1:a5:37:74:17:c5:56:f3:34:7f:1b:62:f9:
+                    7a:38:ca:9d:98:c5:e1:de:b3:68:85:92:1c:ef:16:
+                    51:95:b2:18:a9:8b:40:5d:ff:a0:89:2b:20:e6:7d:
+                    64:5c:8b:96:66:eb:b8:c8:7c:f7:7b:74:c8:9c:d2:
+                    3d:8e:c3:d6:94:cc:45:6b:5f:5a:9e:59:94:73:14:
+                    c0:aa:1b:f6:8c:f5:6b:e3:dc:60:bb:b3:d8:05:74:
+                    94:ac:4d:42:1d:8a:d0:da:21:fe:19:49:af:2f:ca:
+                    d1:97:b8:85:a2:07:b4:64:23:3e:48:60:22:36:d5:
+                    f0:71:43:3a:76:47:db:c6:23:88:e8:9e:44:14:05:
+                    44:d3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                98:54:9A:FE:46:04:8F:0F:3A:D6:86:26:71:05:70:71:B1:31:34:4C
+            X509v3 Authority Key Identifier: 
+                keyid:BB:9E:AC:B3:7A:32:BA:83:21:C8:AC:02:95:09:0B:CA:68:03:EC:DB
+
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Subject Alternative Name: 
+                IP Address:127.0.0.1
+    Signature Algorithm: sha256WithRSAEncryption
+         09:7d:90:8a:cc:84:00:38:f8:a8:90:48:d3:7e:f0:58:37:dc:
+         ad:1b:87:a9:ef:de:f8:53:a9:23:73:57:10:c9:0c:6b:c4:fd:
+         0b:e6:96:7d:d5:87:a6:f5:45:6e:5b:62:aa:d0:55:58:7f:59:
+         a7:ba:28:22:2a:9d:ea:f7:9a:4b:f7:6b:f9:f1:65:56:d9:ef:
+         5c:9c:b6:45:3d:15:8f:83:d5:b4:cf:78:7e:8e:b6:8a:b7:c5:
+         33:99:1c:8b:49:51:81:d1:eb:01:1c:e5:49:69:2b:99:ad:9f:
+         5f:31:02:3a:f6:41:27:68:2f:2c:08:cd:89:91:86:5b:03:44:
+         d6:51:29:84:58:bc:a7:94:6e:59:b9:dd:0b:20:8e:c7:5c:4e:
+         88:38:77:16:59:59:e4:10:ee:27:9e:aa:dd:c3:fc:2c:a6:96:
+         95:7e:8f:6c:e2:97:f9:80:d3:92:f4:4d:31:2b:bf:76:dc:2e:
+         c1:1e:9b:53:e7:4d:6f:36:08:8e:75:a9:e3:07:46:c4:b5:e3:
+         97:0d:c6:d6:f3:10:36:aa:08:c0:76:1b:90:b8:97:b3:9f:d5:
+         42:c0:59:75:96:50:4c:d5:31:58:61:96:e3:62:da:e9:9f:ec:
+         9f:77:81:13:55:03:e4:fa:b3:93:0d:3a:78:db:7d:d1:dd:26:
+         ad:7e:5f:11
+-----BEGIN CERTIFICATE-----
+MIIDczCCAlugAwIBAgIBCDANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxUZXN0
+IFJvb3QgQ0EwHhcNMTgwOTAxMDAwMDAwWhcNMTUwNDAyMDAwMDAwWjBgMQswCQYD
+VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4g
+VmlldzEQMA4GA1UECgwHVGVzdCBDQTESMBAGA1UEAwwJMTI3LjAuMC4xMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxFT1QiL8Q/Ro+RXDz6GINVijMMzr
+31Rc16AZAHv0ZWpoUtumUkgmyoYp3l57gWD77n0RWDhIYRs2K0GOepmzTl2VekwU
+BLSSyqN1Qb+pkTwytAIc04YpsbACrQipchN5lfo8wQGL5HYfIe2YK2MHes5rWRyS
+X9jL4PGlN3QXxVbzNH8bYvl6OMqdmMXh3rNohZIc7xZRlbIYqYtAXf+giSsg5n1k
+XIuWZuu4yHz3e3TInNI9jsPWlMxFa19anlmUcxTAqhv2jPVr49xgu7PYBXSUrE1C
+HYrQ2iH+GUmvL8rRl7iFoge0ZCM+SGAiNtXwcUM6dkfbxiOI6J5EFAVE0wIDAQAB
+o4GAMH4wDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUmFSa/kYEjw861oYmcQVwcbEx
+NEwwHwYDVR0jBBgwFoAUu56ss3oyuoMhyKwClQkLymgD7NswHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEQQIMAaHBH8AAAEwDQYJKoZIhvcNAQEL
+BQADggEBAAl9kIrMhAA4+KiQSNN+8Fg33K0bh6nv3vhTqSNzVxDJDGvE/Qvmln3V
+h6b1RW5bYqrQVVh/Wae6KCIqner3mkv3a/nxZVbZ71yctkU9FY+D1bTPeH6Otoq3
+xTOZHItJUYHR6wEc5UlpK5mtn18xAjr2QSdoLywIzYmRhlsDRNZRKYRYvKeUblm5
+3QsgjsdcTog4dxZZWeQQ7ieeqt3D/CymlpV+j2zil/mA05L0TTErv3bcLsEem1Pn
+TW82CI51qeMHRsS145cNxtbzEDaqCMB2G5C4l7Of1ULAWXWWUEzVMVhhluNi2umf
+7J93gRNVA+T6s5MNOnjbfdHdJq1+XxE=
+-----END CERTIFICATE-----