tests: use a fixed SystemTime for certificate validation

[cpu]

Fixing the SystemTime that we pass to the certificate verifier for the real world and mock verification tests will ensure that the tests don't start to fail just because the vendored certificates have expired.

Suggested by @complexspaces in #46

[complexspaces]

There's two other items that should be fixed/acknowledged here as well:

• This comment block should be deleted because its no longer accurate.
• We should see if the OSCP stapling test can be uncommented finally. If it doesn't work right away or needs medium effort to revive it can be punted to a followup issue.

[cpu]

We should see if the OSCP stapling test can be uncommented finally. If it doesn't work right away or needs medium effort to revive it can be punted to a followup issue.

let me see if I can get it working. I think at a minimum we'll need to refresh the vendored OCSP resp. The one in-repo expired in 2021:

$ openssl ocsp --respin rustls-platform-verifier/src/tests/verification_real_world/revoked_badssl_com_1.ocsp -noverify -text | grep "Next Update"
    Next Update: Dec  9 01:24:01 2021 GMT

[cpu]

The one in-repo expired in 2021:

Oh, well the revoked.badssl.com endpoint is also serving an expired cert (which I suppose makes sense, they aren't going to re-issue and re-revoke certs to keep the expiry up-to-date). I think we'll need to switch to using a fixed time per testcase for this.

[cpu]

This comment block should be deleted because its no longer accurate.

Fixed.

We should see if the OSCP stapling test can be uncommented finally. If it doesn't work right away or needs medium effort to revive it can be punted to a followup issue.

I started on this, but surprisingly the Windows verifier seems to be returning Ok(()) when I would have expected it to honour the stapled OCSP response and return revoked. This will need more investigation so I've pushed the rest of the feedback in the meantime.

[cpu]

I started on this, but surprisingly the Windows verifier seems to be returning Ok(()) when I would have expected it to honour the stapled OCSP response and return revoked.

Conditionally adding CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY when we have an OCSP staple doesn't seem to do the trick either. I'm stumped (and tired of iterating in CI 😅) so I'm going to pause on this for now. I'll file an issue for follow-up (edit: #51).

[complexspaces]

Thanks for jumping on that followup issue quick!