Our HTTP client callback functions for NSS must set an NSS/NSPR error...

net/base/x509_certificate_nss.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <cert.h>
 #include <pk11pub.h>
 #include <prerror.h>
 #include <prtime.h>
@@ skipping 444 matching lines @@
     cvin->push_back(in_param);
     in_param.type = cert_pi_end;
     cvin->push_back(in_param);
     rv = CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer,
                              &(*cvin)[0], cvout, NULL);
     if (rv == SECSuccess)
       return rv;
     int new_nss_error = PORT_GetError();
     if (new_nss_error == SEC_ERROR_INVALID_ARGS ||
         new_nss_error == SEC_ERROR_UNKNOWN_AIA_LOCATION_TYPE ||
+        new_nss_error == SEC_ERROR_BAD_HTTP_RESPONSE ||
+        new_nss_error == SEC_ERROR_BAD_LDAP_RESPONSE ||
         !IS_SEC_ERROR(new_nss_error)) {
       // Use the original error code because of cert_pi_useAIACertFetch's
       // bad error reporting.
       PORT_SetError(nss_error);
       return rv;
     }
     nss_error = new_nss_error;
   }
 
   // If an intermediate CA certificate has requireExplicitPolicy in its
@@ skipping 278 matching lines @@
   DCHECK(0 != cert->derCert.len);
 
   SECStatus rv = HASH_HashBuf(HASH_AlgSHA1, sha1.data,
                               cert->derCert.data, cert->derCert.len);
   DCHECK(rv == SECSuccess);
 
   return sha1;
 }
 
 }  // namespace net