It looks like we need to restrict the validity period of the mitmproxy CA:
https://groups.google.com/forum/#!topic/mitmproxy/22Wk9aKORJg
https://code.google.com/p/chromium/issues/detail?id=475745