def _get_cert_expiration_time(headers):
<EOL>cache_control = headers.get('<STR_LIT>', '<STR_LIT>')<EOL>for entry in cache_control.split('<STR_LIT:U+002C>'):<EOL><INDENT>match = _MAX_AGE_REGEX.match(entry)<EOL>if match:<EOL><INDENT>cache_time_seconds = int(match.group(<NUM_LIT:1>))<EOL>break<EOL><DEDENT><DEDENT>else:<EOL><INDENT>return <NUM_LIT:0><EOL><DEDENT>age = headers.get('<STR_LIT>')<EOL>if age is not None:<EOL><INDENT>try:<EOL><INDENT>age = int(age)<EOL><DEDENT>except ValueError:<EOL><INDENT>age = <NUM_LIT:0><EOL><DEDENT>cache_time_seconds -= age<EOL><DEDENT>return max(<NUM_LIT:0>, cache_time_seconds)<EOL>
Get the expiration time for a cert, given the response headers.

    Get expiration time from the headers in the result.  If we can't get
    a time from the headers, this returns 0, indicating that the cert
    shouldn't be cached.

    Args:
      headers: A dict containing the response headers from the request to get
        certs.

    Returns:
      An integer with the number of seconds the cert should be cached.  This
      value is guaranteed to be >= 0.