Repository: mitmproxy/mitmproxy

Issue:
Reduce certificate validity for Chrome >= 68
##### Steps to reproduce the problem:

1. Install Chrome 68
2. Start mitmproxy, add mitmproxy-ca to your cert-store
3. Open any site via https
4. Chrome shows NET::ERR_CERT_VALIDITY_TOO_LONG error


##### Any other comments? What have you tried so far?
In #815 the validity of the certificates was reduced to three years which was enough for Chrome's "not valid longer than 39 month". It seems like Chrome 68 changed this to a shorter value though I haven't found any evidence in the code yet.
After tinkering around I found that the value "71107200" (around 27 month) for DEFAULT_EXP is the greatest value that is accepted by Chrome.

I know that I'm not using the most recent version of mitmproxy but the value for DEFAULT_EXP is the same in the current version so I assume the problem is still the same.

Suggesting to just reduce the validity to something really short, like Let's Encrypt's three month. Should not be a problem and saves us from further reduction in Chrome.

##### System information
-> % mitmproxy --version
Mitmproxy: 3.0.3 
Python:    3.6.6
OpenSSL:   OpenSSL 1.1.0h  27 Mar 2018
Platform:  Linux-4.17.8-1-ARCH-x86_64-with-arch


Discussion:
Reducing it to three months means that every mitmproxy user needs to re-install their CA cert very three months.... not very user friendly.

I'm open to reducing it a level that makes it valid in Chrome again, e.g., 24 months or similar.
@mhils @cortesi?
You are absolutely right, my suggestion was not complete: The CA cert can (and should!) have a longer validity. It's the cert for the site that is generated on the fly that should have a shorter validity.

The odd thing is: After digging through Chrome's code I did not find any change in the check for the validity: https://chromium.googlesource.com/chromium/src/+/68.0.3440.85/net/cert/cert_verify_proc.cc#894

But still I'm experiencing this problem. Can someone confirm this behaviour?
Nevermind...it's this part: https://chromium.googlesource.com/chromium/src/+/68.0.3440.85/net/cert/cert_verify_proc.cc#898
```
  // For certificates issued after 1 March 2018: 825 days.
  if (start >= time_2018_03_01 &&
      validity_duration > base::TimeDelta::FromDays(825)) {
    return true;
  }
```

Diff: https://chromium.googlesource.com/chromium/src/+/1f9eb9f1f6345f1992e54346044dc5022ad50c11%5E%21/net/cert/cert_verify_proc.cc
Ballot: https://cabforum.org/2017/03/17/ballot-193-825-day-certificate-lifetimes/
Ok sounds good. Feel free to send a PR that changes the DEFAULT_EXP for issued certs!

Resolving patch:
diff --git a/mitmproxy/certs.py b/mitmproxy/certs.py
--- a/mitmproxy/certs.py
+++ b/mitmproxy/certs.py
@@ -15,6 +15,7 @@
 
 # Default expiry must not be too long: https://github.com/mitmproxy/mitmproxy/issues/815
 DEFAULT_EXP = 94608000  # = 24 * 60 * 60 * 365 * 3
+DEFAULT_EXP_DUMMY_CERT = 63072000  # = 2 years
 
 # Generated with "openssl dhparam". It's too slow to generate this on startup.
 DEFAULT_DHPARAM = b"""
@@ -101,7 +102,7 @@ def dummy_cert(privkey, cacert, commonname, sans):
 
     cert = OpenSSL.crypto.X509()
     cert.gmtime_adj_notBefore(-3600 * 48)
-    cert.gmtime_adj_notAfter(DEFAULT_EXP)
+    cert.gmtime_adj_notAfter(DEFAULT_EXP_DUMMY_CERT)
     cert.set_issuer(cacert.get_subject())
     if commonname is not None and len(commonname) < 64:
         cert.get_subject().CN = commonname


Test patch: