allow asn1 times of 1950-01-01 and later. (#4728)

* allow asn1 times of 1950-01-01 and later.

* add a test

* pretty up the test

2 files changed, 20 insertions, 20 deletions

diff --git a/src/cryptography/x509/base.py b/src/cryptography/x509/base.py
index a3b334a1..63c2e3c6 100644
--- a/src/cryptography/x509/base.py
+++ b/src/cryptography/x509/base.py
@@ -17,7 +17,7 @@ from cryptography.x509.extensions import Extension, ExtensionType
 from cryptography.x509.name import Name
 
 
-_UNIX_EPOCH = datetime.datetime(1970, 1, 1)
+_EARLIEST_UTC_TIME = datetime.datetime(1950, 1, 1)
 
 
 def _reject_duplicate_extension(extension, extensions):
@@ -516,9 +516,9 @@ class CertificateBuilder(object):
         if self._not_valid_before is not None:
             raise ValueError('The not valid before may only be set once.')
         time = _convert_to_naive_utc_time(time)
-        if time <= _UNIX_EPOCH:
-            raise ValueError('The not valid before date must be after the unix'
-                             ' epoch (1970 January 1).')
+        if time < _EARLIEST_UTC_TIME:
+            raise ValueError('The not valid before date must be on or after'
+                             ' 1950 January 1).')
         if self._not_valid_after is not None and time > self._not_valid_after:
             raise ValueError(
                 'The not valid before date must be before the not valid after '
@@ -539,9 +539,9 @@ class CertificateBuilder(object):
         if self._not_valid_after is not None:
             raise ValueError('The not valid after may only be set once.')
         time = _convert_to_naive_utc_time(time)
-        if time <= _UNIX_EPOCH:
-            raise ValueError('The not valid after date must be after the unix'
-                             ' epoch (1970 January 1).')
+        if time < _EARLIEST_UTC_TIME:
+            raise ValueError('The not valid after date must be on or after'
+                             ' 1950 January 1.')
         if (self._not_valid_before is not None and
                 time < self._not_valid_before):
             raise ValueError(
@@ -620,9 +620,9 @@ class CertificateRevocationListBuilder(object):
         if self._last_update is not None:
             raise ValueError('Last update may only be set once.')
         last_update = _convert_to_naive_utc_time(last_update)
-        if last_update <= _UNIX_EPOCH:
-            raise ValueError('The last update date must be after the unix'
-                             ' epoch (1970 January 1).')
+        if last_update < _EARLIEST_UTC_TIME:
+            raise ValueError('The last update date must be on or after'
+                             ' 1950 January 1.')
         if self._next_update is not None and last_update > self._next_update:
             raise ValueError(
                 'The last update date must be before the next update date.'
@@ -638,9 +638,9 @@ class CertificateRevocationListBuilder(object):
         if self._next_update is not None:
             raise ValueError('Last update may only be set once.')
         next_update = _convert_to_naive_utc_time(next_update)
-        if next_update <= _UNIX_EPOCH:
-            raise ValueError('The last update date must be after the unix'
-                             ' epoch (1970 January 1).')
+        if next_update < _EARLIEST_UTC_TIME:
+            raise ValueError('The last update date must be on or after'
+                             ' 1950 January 1.')
         if self._last_update is not None and next_update < self._last_update:
             raise ValueError(
                 'The next update date must be after the last update date.'
@@ -720,9 +720,9 @@ class RevokedCertificateBuilder(object):
         if self._revocation_date is not None:
             raise ValueError('The revocation date may only be set once.')
         time = _convert_to_naive_utc_time(time)
-        if time <= _UNIX_EPOCH:
-            raise ValueError('The revocation date must be after the unix'
-                             ' epoch (1970 January 1).')
+        if time < _EARLIEST_UTC_TIME:
+            raise ValueError('The revocation date must be on or after'
+                             ' 1950 January 1.')
         return RevokedCertificateBuilder(
             self._serial_number, time, self._extensions
         )
diff --git a/src/cryptography/x509/ocsp.py b/src/cryptography/x509/ocsp.py
index 97933b1f..aae9b626 100644
--- a/src/cryptography/x509/ocsp.py
+++ b/src/cryptography/x509/ocsp.py
@@ -13,7 +13,7 @@ import six
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes
 from cryptography.x509.base import (
-    _UNIX_EPOCH, _convert_to_naive_utc_time, _reject_duplicate_extension
+    _EARLIEST_UTC_TIME, _convert_to_naive_utc_time, _reject_duplicate_extension
 )
 
 
@@ -154,9 +154,9 @@ class _SingleResponse(object):
                 raise TypeError("revocation_time must be a datetime object")
 
             revocation_time = _convert_to_naive_utc_time(revocation_time)
-            if revocation_time <= _UNIX_EPOCH:
-                raise ValueError('The revocation_time must be after the unix'
-                                 ' epoch (1970 January 1).')
+            if revocation_time < _EARLIEST_UTC_TIME:
+                raise ValueError('The revocation_time must be on or after'
+                                 ' 1950 January 1.')
 
             if (
                 revocation_reason is not None and