We have to do EV certificate verification for every resource...

We have to do EV certificate verification for every resource
load.  The performance optimization of doing EV verification
for only main frames is incorrect with HTTP keep-alive connections.

R=eroman
BUG=41267
TEST=Visit https://www.paypal.com/.  Hit the Reload button
repeatedly.  The EV status should not disappear.

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=64813

[wtc, 2010-10-30 00:34:30]

eroman: I'm fixing this bug in three steps.

Step 1 (this CL): specify the net::LOAD_VERIFY_EV_CERT load
flag for every resource.  Note: this is still missing the
resources loaded by URLFetcher, but is good enough to fix
this bug in most cases.

Step 2: reduce the overhead of EV verification.  See
http://codereview.chromium.org/4124012/show.

Step 3: remove the net::LOAD_VERIFY_EV_CERT load flag and
the verify_ev_cert field of SSLConfig.

[eroman, 2010-10-30 03:39:15]

lgtm

http://codereview.chromium.org/3938001/diff/8001/9002
File chrome/browser/renderer_host/resource_dispatcher_host.cc (right):

http://codereview.chromium.org/3938001/diff/8001/9002#newcode447
chrome/browser/renderer_host/resource_dispatcher_host.cc:447: load_flags |=
net::LOAD_VERIFY_EV_CERT;
Perhaps we should reverse the direction of this flag -- i.e. always verify EV
certs by default, and have a flag for disabling it if users so choose.

[wtc, 2010-11-02 20:59:29]

http://codereview.chromium.org/3938001/diff/8001/9002
File chrome/browser/renderer_host/resource_dispatcher_host.cc (right):

http://codereview.chromium.org/3938001/diff/8001/9002#newcode447
chrome/browser/renderer_host/resource_dispatcher_host.cc:447: load_flags |=
net::LOAD_VERIFY_EV_CERT;
On 2010/10/30 03:39:15, eroman wrote:
> Perhaps we should reverse the direction of this flag -- i.e. always verify EV
> certs by default, and have a flag for disabling it if users so choose.

This flag will be removed in a future CL.

This flag was added when we were using WinHTTP.  It turns
out that this flag is difficult to use correctly when we
switched to our own "new HTTP", so I'm planning to remove
it.