Add new certificate error code...

Add new certificate error code
ERR_CERT_WEAK_SIGNATURE_ALGORITHM and certificate status
flag CERT_STATUS_WEAK_SIGNATURE_ALGORITHM.  Note that I
didn't add new load flag
LOAD_IGNORE_CERT_WEAK_SIGNATURE_ALGORITHM.

Allow users to accept MD2 certificates as certificates
signed using a weak signature algorithm.  MD4 certificates
are still treated as invalid certificates.

R=jar,jcampan
BUG=http://crbug.com/18725
TEST=none

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=23497

[jcampan, 2009-08-14 00:11:37]

LGTM

http://codereview.chromium.org/165504/diff/1/6
File chrome/app/generated_resources.grd (right):

http://codereview.chromium.org/165504/diff/1/6#newcode1934
Line 1934: You attempted to reach &lt;strong&gt;<ph name="DOMAIN">
Nit: looks like VS was a bit zealous and formatted the param on several lines
for you.

[wtc, 2009-08-14 03:00:07]

abarth: just FYI

jcampan: thanks for the review.  I fixed the wrapped line
in generated_resources.grd.

cevans, jar: you only need to review two files:

1. MD4 certs are still considered invalid (no clicking through).  Only MD2 certs
get the "weak signature algorithm"
treatment.  See x509_certificate_win.cc.

2. The strings for "weak signature algorithm".  See
generated_resources.grd.

[wtc, 2009-08-14 03:08:03]

http://codereview.chromium.org/165504/diff/25/1009
File net/base/cert_status_flags.cc (right):

http://codereview.chromium.org/165504/diff/25/1009#newcode41
Line 41: int MapCertStatusToNetError(int cert_status) {
jar, cevans, abarth: Here is one more thing to look at.

When a cert has multiple errors, we report only one error
in the SSL interstitial page.  So this function is used
to pick the most serious error.  Please make sure the
ranking of ERR_CERT_WEAK_SIGNATURE_ALGORITHM is reasonable
(less serious than "untrusted CA" and "name mismatch",
but more serious than "expired").

[abarth-chromium, 2009-08-14 03:12:50]

http://codereview.chromium.org/165504/diff/25/1009
File net/base/cert_status_flags.cc (right):

http://codereview.chromium.org/165504/diff/25/1009#newcode48
Line 48: if (cert_status & CERT_STATUS_REVOKED)
Revoked is the worst.  It means this cert has been completely disavowed.  (Not
that we treat it differently than invalid.)  Other than that, this looks
correct.

[wtc, 2009-08-14 19:23:15]

Jim,

I updated the strings per our discussion.  Please review
generated_resources.grd.  Thanks!

[jar (doing other things), 2009-08-14 21:18:34]

The resource strings LGTM

[wtc, 2009-08-17 23:39:01]

Ian, could you review the new strings in generated_resources.grd?  Thanks.