--- a/security/pkix/test/gtest/pkixbuild_tests.cpp
+++ b/security/pkix/test/gtest/pkixbuild_tests.cpp
@@ -303,17 +303,17 @@ TEST_F(pkixbuild, NoRevocationCheckingFo
   ByteString serialNumber(CreateEncodedSerialNumber(100));
   EXPECT_FALSE(ENCODING_FAILED(serialNumber));
   ByteString issuerDER(CNToDERName(rootCN));
   ByteString subjectDER(CNToDERName("Expired End-Entity Cert"));
   ScopedTestKeyPair reusedKey(CloneReusedKeyPair());
   ByteString certDER(CreateEncodedCertificate(
                        v3, sha256WithRSAEncryption(),
                        serialNumber, issuerDER,
-                       oneDayBeforeNow - ONE_DAY_IN_SECONDS_AS_TIME_T,
+                       twoDaysBeforeNow,
                        oneDayBeforeNow,
                        subjectDER, *reusedKey, nullptr, *reusedKey,
                        sha256WithRSAEncryption()));
   EXPECT_FALSE(ENCODING_FAILED(certDER));
 
   Input cert;
   ASSERT_EQ(Success, cert.Init(certDER.data(), certDER.length()));
   ASSERT_EQ(Result::ERROR_EXPIRED_CERTIFICATE,

--- a/security/pkix/test/gtest/pkixgtest.cpp
+++ b/security/pkix/test/gtest/pkixgtest.cpp
@@ -25,20 +25,22 @@
 #include "pkixgtest.h"
 
 #include <ctime>
 
 #include "pkix/Time.h"
 
 namespace mozilla { namespace pkix { namespace test {
 
-const std::time_t ONE_DAY_IN_SECONDS_AS_TIME_T =
+static const std::time_t ONE_DAY_IN_SECONDS_AS_TIME_T =
   static_cast<std::time_t>(Time::ONE_DAY_IN_SECONDS);
 
 // This assumes that time/time_t are POSIX-compliant in that time() returns
 // the number of seconds since the Unix epoch.
-const std::time_t now(time(nullptr));
-const std::time_t oneDayBeforeNow(time(nullptr) -
-                                  ONE_DAY_IN_SECONDS_AS_TIME_T);
-const std::time_t oneDayAfterNow(time(nullptr) +
-                                 ONE_DAY_IN_SECONDS_AS_TIME_T);
+static const std::time_t now(time(nullptr));
+const std::time_t oneDayBeforeNow(now - ONE_DAY_IN_SECONDS_AS_TIME_T);
+const std::time_t oneDayAfterNow(now + ONE_DAY_IN_SECONDS_AS_TIME_T);
+const std::time_t twoDaysBeforeNow(now - (2 * ONE_DAY_IN_SECONDS_AS_TIME_T));
+const std::time_t twoDaysAfterNow(now + (2 * ONE_DAY_IN_SECONDS_AS_TIME_T));
+const std::time_t tenDaysBeforeNow(now - (10 * ONE_DAY_IN_SECONDS_AS_TIME_T));
+const std::time_t tenDaysAfterNow(now + (10 * ONE_DAY_IN_SECONDS_AS_TIME_T));
 
 } } } // namespace mozilla::pkix::test

--- a/security/pkix/test/gtest/pkixgtest.h
+++ b/security/pkix/test/gtest/pkixgtest.h
@@ -72,21 +72,22 @@ PrintTo(const Result& result, ::std::ost
     *os << "mozilla::pkix::Result(" << static_cast<unsigned int>(result) << ")";
   }
 }
 
 } } // namespace mozilla::pkix
 
 namespace mozilla { namespace pkix { namespace test {
 
-extern const std::time_t ONE_DAY_IN_SECONDS_AS_TIME_T;
-
-extern const std::time_t now;
 extern const std::time_t oneDayBeforeNow;
 extern const std::time_t oneDayAfterNow;
+extern const std::time_t twoDaysBeforeNow;
+extern const std::time_t twoDaysAfterNow;
+extern const std::time_t tenDaysBeforeNow;
+extern const std::time_t tenDaysAfterNow;
 
 
 class EverythingFailsByDefaultTrustDomain : public TrustDomain
 {
 public:
   Result GetCertTrust(EndEntityOrCA, const CertPolicyId&,
                       Input, /*out*/ TrustLevel&) override
   {

--- a/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
+++ b/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
@@ -587,18 +587,18 @@ TEST_F(pkixocsp_VerifyEncodedResponse_De
     CreateEncodedEKUExtension(OCSPSigningEKUDER, Critical::No),
     ByteString()
   };
 
   ScopedTestKeyPair signerKeyPair(GenerateKeyPair());
   ByteString signerDER(CreateEncodedCertificate(
                           ++rootIssuedCount, sha256WithRSAEncryption(),
                           rootName,
-                          now - (10 * ONE_DAY_IN_SECONDS_AS_TIME_T),
-                          now - (2 * ONE_DAY_IN_SECONDS_AS_TIME_T),
+                          tenDaysBeforeNow,
+                          twoDaysBeforeNow,
                           signerName, *signerKeyPair, extensions,
                           *rootKeyPair));
   ASSERT_FALSE(ENCODING_FAILED(signerDER));
 
   ByteString certs[] = { signerDER, ByteString() };
   ByteString responseString(
                CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID,
@@ -623,18 +623,18 @@ TEST_F(pkixocsp_VerifyEncodedResponse_De
     CreateEncodedEKUExtension(OCSPSigningEKUDER, Critical::No),
     ByteString()
   };
 
   ScopedTestKeyPair signerKeyPair(GenerateKeyPair());
   ByteString signerDER(CreateEncodedCertificate(
                          ++rootIssuedCount, sha256WithRSAEncryption(),
                          rootName,
-                         now + (2 * ONE_DAY_IN_SECONDS_AS_TIME_T),
-                         now + (10 * ONE_DAY_IN_SECONDS_AS_TIME_T),
+                         twoDaysAfterNow,
+                         tenDaysAfterNow,
                          signerName, *signerKeyPair, extensions,
                          *rootKeyPair));
   ASSERT_FALSE(ENCODING_FAILED(signerDER));
 
   ByteString certs[] = { signerDER, ByteString() };
   ByteString responseString(
                CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID,