Do not perform online revocation checking when the user has explicitly disabled it, except for when…

net/base/x509_certificate.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_CERTIFICATE_H_
 #define NET_BASE_X509_CERTIFICATE_H_
 
 #include <string.h>
 
 #include <string>
@@ skipping 71 matching lines @@
     kPublicKeyTypeECDH
   };
 
   // Predicate functor used in maps when X509Certificate is used as the key.
   class NET_EXPORT LessThan {
    public:
     bool operator() (X509Certificate* lhs,  X509Certificate* rhs) const;
   };
 
   enum VerifyFlags {
+    // If set, enables online revocation checking via CRLs and OCSP for the
+    // certificate chain.
     VERIFY_REV_CHECKING_ENABLED = 1 << 0,
+
+    // If set, and the certificate being verified may be an EV certificate,
+    // attempt to verify the certificate according to the EV processing
+    // guidelines. In order to successfully verify a certificate as EV,
+    // either an online or offline revocation check must be successfully
+    // completed. To ensure it's possible to complete a revocation check,
+    // callers should also specify either VERIFY_REV_CHECKING_ENABLED or
+    // VERIFY_REV_CHECKING_ENABLED_EV_ONLY (to enable online checks), and
+    // VERIFY_CERT_IO_ENABLED (to enable network fetches for online checks).
     VERIFY_EV_CERT = 1 << 1,
+
+    // If set, permits NSS to use the network when verifying certificates,
+    // such as to fetch missing intermediates or to check OCSP or CRLs.
+    // TODO(rsleevi): http://crbug.com/143300 - Define this flag for all
+    // verification engines with well-defined semantics, rather than being
+    // NSS only.
     VERIFY_CERT_IO_ENABLED = 1 << 2,
+
+    // If set, enables online revocation checking via CRLs or OCSP, but only
+    // for certificates which may be EV, and only when VERIFY_EV_CERT is also
+    // set.
+    VERIFY_REV_CHECKING_ENABLED_EV_ONLY = 1 << 3,

[wtc, 2012/08/17 00:34:44]

Nit: the fact that this flag is tacked on by CertVerifyProc::Verify()
internally probably should be described.  Perhaps
this flag should be considered as an internal flag?

[Ryan Sleevi, 2012/08/17 00:37:18]

The intent is to make it not an internal-only flag; http://crbug.com/142974

   };
 
   enum Format {
     // The data contains a single DER-encoded certificate, or a PEM-encoded
     // DER certificate with the PEM encoding block name of "CERTIFICATE".
     // Any subsequent blocks will be ignored.
     FORMAT_SINGLE_CERTIFICATE = 1 << 0,
 
     // The data contains a sequence of one or more PEM-encoded, DER
     // certificates, with the PEM encoding block name of "CERTIFICATE".
@@ skipping 412 matching lines @@
   // based on the type of the certificate.
   std::string default_nickname_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_X509_CERTIFICATE_H_