code: def _get_cert_expiration_time(headers):
    
    # Check the max age of the cert.
    cache_control = headers.get('Cache-Control', '')
    # http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 indicates only
    # a comma-separated header is valid, so it should be fine to split this on
    # commas.
    for entry in cache_control.split(','):
      match = _MAX_AGE_REGEX.match(entry)
      if match:
        cache_time_seconds = int(match.group(1))
        break
    else:
      return 0
  
    # Subtract the cert's age.
    age = headers.get('Age')
    if age is not None:
      try:
        age = int(age)
      except ValueError:
        age = 0
      cache_time_seconds -= age
  
    return max(0, cache_time_seconds)
docs: Get the expiration time for a cert, given the response headers.
  
    Get expiration time from the headers in the result.  If we can't get
    a time from the headers, this returns 0, indicating that the cert
    shouldn't be cached.
  
    Args:
      headers: A dict containing the response headers from the request to get
        certs.
  
    Returns:
      An integer with the number of seconds the cert should be cached.  This
      value is guaranteed to be >= 0.