code: def _validate_cert_chain(self, cert_chain):
          # type: (Certificate) -> None
          
          now = datetime.utcnow()
          if not (cert_chain.not_valid_before <= now <=
                  cert_chain.not_valid_after):
              raise VerificationException("Signing Certificate expired")
  
          ext = cert_chain.extensions.get_extension_for_oid(
              ExtensionOID.SUBJECT_ALTERNATIVE_NAME)
          if CERT_CHAIN_DOMAIN not in ext.value.get_values_for_type(
                  DNSName):
              raise VerificationException(
                  "{} domain missing in Signature Certificate Chain".format(
                      CERT_CHAIN_DOMAIN))
docs: Validate the certificate chain.
  
          This method checks if the passed in certificate chain is valid,
          i.e it is not expired and the Alexa domain is present in the
          SAN extensions of the certificate chain. A
          :py:class:`VerificationException` is raised if the certificate
          chain is not valid.
  
          :param cert_chain: Certificate chain to be validated
          :type cert_chain: cryptography.x509.Certificate
          :return: None
          :raises: :py:class:`VerificationException` if certificated is
              not valid