Make it a fatal SSL error when encountering certs signed with md[2,4], and interstitial md5

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
@@ skipping 146 matching lines @@
     case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
       return CERT_STATUS_AUTHORITY_INVALID;
 #if 0
 // TODO(bulach): what should we map to these status?
       return CERT_STATUS_NO_REVOCATION_MECHANISM;
       return CERT_STATUS_UNABLE_TO_CHECK_REVOCATION;
       return CERT_STATUS_NOT_IN_DNS;
 #endif
     case X509_V_ERR_CERT_REVOKED:
       return CERT_STATUS_REVOKED;
-    case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
-      return CERT_STATUS_WEAK_SIGNATURE_ALGORITHM;
     // All these status are mapped to CERT_STATUS_INVALID.
     case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
     case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
     case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
     case X509_V_ERR_CERT_SIGNATURE_FAILURE:
     case X509_V_ERR_CRL_SIGNATURE_FAILURE:
     case X509_V_ERR_OUT_OF_MEM:
     case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
     case X509_V_ERR_CERT_CHAIN_TOO_LONG:
     case X509_V_ERR_PATH_LENGTH_EXCEEDED:
     case X509_V_ERR_INVALID_PURPOSE:
     case X509_V_ERR_CERT_UNTRUSTED:
     case X509_V_ERR_CERT_REJECTED:
     case X509_V_ERR_AKID_SKID_MISMATCH:
     case X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH:
     case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
+    case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:

[wtc, 2011/10/24 22:36:42]

The change in this file is correct, regardless of the rest of
the CL.  You may check in this change first.

     case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
     case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
     case X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED:
     case X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE:
     case X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED:
     case X509_V_ERR_INVALID_EXTENSION:
     case X509_V_ERR_INVALID_POLICY_EXTENSION:
     case X509_V_ERR_NO_EXPLICIT_POLICY:
     case X509_V_ERR_UNNESTED_RESOURCE:
     case X509_V_ERR_APPLICATION_VERIFICATION:
@@ skipping 358 matching lines @@
   DERCache der_cache;
   if (!GetDERAndCacheIfNeeded(cert_handle, &der_cache))
     return false;
 
   return pickle->WriteData(
       reinterpret_cast<const char*>(der_cache.data),
       der_cache.data_length);
 }
 
 }  // namespace net