Map Mac's CSSMERR_APPLETP_INVALID_EMPTY_SUBJECT error to...

Map Mac's CSSMERR_APPLETP_INVALID_EMPTY_SUBJECT error to
ERR_CERT_NAME_INVALID instead of ERR_CERT_INVALID so that it can be
overriden by the user.

R=rsleevi
BUG=63988
TEST=net_unittests --gtest_filter=X509CertificateTest.EmptySubject

[Ryan Sleevi, 2011-03-10 02:30:51]

http://codereview.chromium.org/6656015/diff/1/net/base/x509_certificate_mac.cc
File net/base/x509_certificate_mac.cc (right):

http://codereview.chromium.org/6656015/diff/1/net/base/x509_certificate_mac.c...
net/base/x509_certificate_mac.cc:81: case CSSMERR_APPLETP_INVALID_EMPTY_SUBJECT:
This error is also returned if the EE cert has an empty subject and is missing
the subjectAltName entirely, or if a CA in the chain has an empty subject.

Should the user be able to override it in those situations? Is that a concern?

http://codereview.chromium.org/6656015/diff/1/net/base/x509_certificate_unitt...
File net/base/x509_certificate_unittest.cc (right):

http://codereview.chromium.org/6656015/diff/1/net/base/x509_certificate_unitt...
net/base/x509_certificate_unittest.cc:450: #if defined(OS_MACOSX)
For parity testing, my preference would be to see the test run on all platforms,
and just the EXPECT_EQ in the platform-specific portions.

I would expect for !defined(OS_MACOSX), it should just be
CERT_STATUS_AUTHORITY_INVALID.

Thoughts?

[wtc, 2011-03-11 00:25:11]

rsleevi: thank you for the review.  I made your suggested change.
Please review Patch Set 2.

http://codereview.chromium.org/6656015/diff/1/net/base/x509_certificate_mac.cc
File net/base/x509_certificate_mac.cc (right):

http://codereview.chromium.org/6656015/diff/1/net/base/x509_certificate_mac.c...
net/base/x509_certificate_mac.cc:81: case CSSMERR_APPLETP_INVALID_EMPTY_SUBJECT:
Both cases are OK.

Case 1: an EE cert has an empty subject and is missing the subjectAltName
entirely.

This will result in CERT_STATUS_COMMON_NAME_INVALID anyway,
regardless of this CL.

Case 2: a CA in the chain has an empty subject.

A proper CA won't issue a subordinate CA certificate with an empty Subject
field.

So a chain containing such a broken CA cert will get a spurious, confusing
CERT_STATUS_COMMON_NAME_INVALID, but should have
CERT_STATUS_AUTHORITY_INVALID as well.

[Ryan Sleevi, 2011-03-11 01:03:18]

LGTM. I'm not sure if it's worth mentioning in/updating the comment for
x509_certificate_mac.cc to include the other cases, but that's a very minor nit.