Do not treat weak keys (<1024 bits || MD5) as fatal errors

net/base/cert_verify_proc_win.cc

Index: net/base/cert_verify_proc_win.cc
diff --git a/net/base/cert_verify_proc_win.cc b/net/base/cert_verify_proc_win.cc
index 7e1aa4370241a7737363bbbf9b195be8585baecc..be5f004aa56e8a931c7e494f7a086b6cff33407d 100644
--- a/net/base/cert_verify_proc_win.cc
+++ b/net/base/cert_verify_proc_win.cc
@@ -23,6 +23,12 @@
 
 #pragma comment(lib, "crypt32.lib")
 
+#if !defined(CERT_TRUST_HAS_WEAK_SIGNATURE)
+// This was introduced in Windows 8 / Windows Server 2012, but retroactively
+// ported as far back as Windows XP via system update.
+#define CERT_TRUST_HAS_WEAK_SIGNATURE 0x00100000
+#endif
+
 namespace net {
 
 namespace {
@@ -140,9 +146,18 @@ int MapCertChainErrorStatusToCertStatus(DWORD error_status) {
     cert_status |= CERT_STATUS_INVALID;
   }
 
+  if (error_status & CERT_TRUST_IS_NOT_SIGNATURE_VALID) {
+    // Check for a 'non-strong-signed' signature. Depending on OS

[agl, 2012/06/13 21:15:13]

You have 'non-strong-signed' in quotes, so maybe it's taken from somewhere else.
But it doesn't make a lot of sense to me :)

[Ryan Sleevi, 2012/06/13 21:22:37]

Yeah, MSFT document. They don't call it a 'weak' signature, they call the
assertions 'strong' signatures (
http://msdn.microsoft.com/en-us/library/windows/desktop/hh870262(v=vs.85).aspx )

All signatures we consider weak, Microsoft considers to not be strong signed.
However, signatures that we may consider acceptable (eg: non-weak) Microsoft
considers not to be strong signed. eg: SHA-1, RSA < 2048.

I've tweaked the wording a little to reflect this.

+    // configuration, this may also exclude SHA-1 signatures.
+    if (error_status & CERT_TRUST_HAS_WEAK_SIGNATURE) {
+      cert_status |= CERT_STATUS_WEAK_KEY;
+    } else {
+      cert_status |= CERT_STATUS_INVALID;
+    }
+  }
+
   // The rest of the errors.
   const DWORD kCertInvalidErrors =
-      CERT_TRUST_IS_NOT_SIGNATURE_VALID |
       CERT_TRUST_IS_CYCLIC |
       CERT_TRUST_INVALID_EXTENSION |
       CERT_TRUST_INVALID_POLICY_CONSTRAINTS |