tree f3f7436abbdf024f58591cfc5df16c3b49a57765
parent 03de6813d8992a649092b4874ef0ebc022e2f58a
author Jesse Selover <jselover@google.com> 1529357499 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1529949273 +0000

Make X509 time validation stricter.

Copy of OpenSSL change
https://github.com/openssl/openssl/commit/80770da39ebba0101079477611b7ce2f426653c5.

This additionally fixes some bugs which causes time validation to
fail when the current time and certificate timestamp are near the
2050 UTCTime/GeneralizedTime cut-off.

Update-Note: Some invalid X.509 timestamps will be newly rejected.

Change-Id: Ie131c61b6840c85bed974101f0a3188e7649059b
Reviewed-on: https://boringssl-review.googlesource.com/29125
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>