Clear the SSL Client Auth cache when a new SSL Client Certificate is...

net/http/http_network_session.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_session.h"
 
 #include <utility>
 
 #include "base/logging.h"
 #include "base/stl_util-inl.h"
 #include "base/string_util.h"
 #include "base/values.h"
 #include "net/http/http_auth_handler_factory.h"
 #include "net/http/http_response_body_drainer.h"
 #include "net/http/url_security_manager.h"
 #include "net/socket/client_socket_factory.h"
+#include "net/socket/ssl_client_socket.h"
 #include "net/spdy/spdy_session_pool.h"
 
 namespace net {
 
 // TODO(mbelshe): Move the socket factories into HttpStreamFactory.
 HttpNetworkSession::HttpNetworkSession(const Params& params)
     : cert_verifier_(NULL),
       proxy_service_(params.proxy_service),
       ssl_config_service_(params.ssl_config_service),
       socket_pool_manager_(params.net_log,
@@ skipping 28 matching lines @@
 void HttpNetworkSession::RemoveResponseDrainer(
     HttpResponseBodyDrainer* drainer) {
   DCHECK(ContainsKey(response_drainers_, drainer));
   response_drainers_.erase(drainer);
 }
 
 Value* HttpNetworkSession::SpdySessionPoolInfoToValue() const {
   return spdy_session_pool_.SpdySessionPoolInfoToValue();
 }
 
+void HttpNetworkSession::ResetSSLState() {
+  // Erase any mapping from host:port to client certificate.
+  ssl_client_auth_cache()->Clear();
+  // Clear any cached ssl sessions so that we do not resume with the old
+  // certificate.
+  SSLClientSocket::ClearSSLSessionCache();
+  // Close all connections to force a reconnection.
+  FlushSocketPools();
+  spdy_session_pool()->CloseAllSessions();

[wtc, 2011/02/23 00:38:38]

Should we imitate NetworkChangeNotifier and add a
CertDatabase::Observer interface, and make these four classes
observers of CertDatabase changes?  This is more in keeping
with the C++ coding style in the Chromium source tree.  See
how the SpdySessionPool class implements the
NetworkChangeNotifier::Observer and
SSLConfigService::Observer interfaces.

Note: SpdySessionPool calls CloseCurrentSessions() in
those two observer methods.  So perhaps it's enough to
call CloseCurrentSessions() here, too.

+}
+
 }  //  namespace net