Don't use X509Certificate in SSLConfig.

net/base/ssl_config_service.cc

Index: net/base/ssl_config_service.cc
diff --git a/net/base/ssl_config_service.cc b/net/base/ssl_config_service.cc
index 5fe01cf360f5c78a693c1b3d00ea209e7ec7d66d..4e298e73677ec0d0cb9cb47640a5ee938340a7fa 100644
--- a/net/base/ssl_config_service.cc
+++ b/net/base/ssl_config_service.cc
@@ -26,8 +26,16 @@ SSLConfig::~SSLConfig() {
 
 bool SSLConfig::IsAllowedBadCert(X509Certificate* cert,
                                  int* cert_status) const {
+  std::string cert_der;
+  if (!cert->GetDEREncoded(&cert_der))
+    return false;
+  return IsAllowedBadCert(cert_der, cert_status);
+}
+
+bool SSLConfig::IsAllowedBadCert(const std::string& cert_der,
+                                 int* cert_status) const {
   for (size_t i = 0; i < allowed_bad_certs.size(); ++i) {
-    if (cert->Equals(allowed_bad_certs[i].cert)) {
+    if (cert_der == allowed_bad_certs[i].cert_der) {
       if (cert_status)
         *cert_status = allowed_bad_certs[i].cert_status;
       return true;