Do not map Windows certificate errors returned by Schannel's...

net/base/ssl_client_socket_win.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/ssl_client_socket_win.h"
 
 #include <schnlsp.h>
 
 #include "base/lock.h"
 #include "base/singleton.h"
@@ skipping 594 matching lines @@
       memmove(recv_buffer_.get(),
               recv_buffer_.get() + (bytes_received_ - in_buffers_[1].cbBuffer),
               in_buffers_[1].cbBuffer);
       bytes_received_ = in_buffers_[1].cbBuffer;
     } else {
       bytes_received_ = 0;
     }
     return DidCompleteHandshake();
   }
 
-  if (FAILED(isc_status_))
-    return MapSecurityError(isc_status_);
+  if (FAILED(isc_status_)) {
+    int result = MapSecurityError(isc_status_);
+    // We told Schannel to not verify the server certificate
+    // (SCH_CRED_MANUAL_CRED_VALIDATION), so any certificate error returned by
+    // InitializeSecurityContext must be referring to the (missing) client
+    // certificate.
+    if (IsCertificateError(result)) {
+      // TODO(wtc): When we support SSL client authentication, we will need to
+      // add new error codes for client certificate errors reported by the
+      // server using SSL/TLS alert messages.  See http://crbug.com/318.  See
+      // also the MSDN page "Schannel Error Codes for TLS and SSL Alerts",
+      // which maps TLS alert messages to Windows error codes:
+      // http://msdn.microsoft.com/en-us/library/dd721886%28VS.85%29.aspx
+      return ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
+    }
+    return result;
+  }
 
   if (isc_status_ == SEC_I_INCOMPLETE_CREDENTIALS) {
     // We don't support SSL client authentication yet.  For now we just set
     // no_client_cert_ to true and call InitializeSecurityContext again.
     no_client_cert_ = true;
     next_state_ = STATE_HANDSHAKE_READ_COMPLETE;
     ignore_ok_result_ = true;  // OK doesn't mean EOF.
     return OK;
   }
 
@@ skipping 385 matching lines @@
   }
 }
 
 void SSLClientSocketWin::FreeSendBuffer() {
   SECURITY_STATUS status = FreeContextBuffer(send_buffer_.pvBuffer);
   DCHECK(status == SEC_E_OK);
   memset(&send_buffer_, 0, sizeof(send_buffer_));
 }
 
 }  // namespace net