Refuse to accept certificate chains containing any RSA public key smaller

net/base/net_error_list.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file intentionally does not have header guards, it's included
 // inside a macro to generate enum.
 
 // This file contains the list of network errors.
 
 //
@@ skipping 355 matching lines @@
 // signature algorithm.
 NET_ERROR(CERT_WEAK_SIGNATURE_ALGORITHM, -208)
 
 // The domain has CERT records which are tagged as being an exclusive list of
 // valid fingerprints. But the certificate presented was not in this list.
 NET_ERROR(CERT_NOT_IN_DNS, -209)
 
 // The host name specified in the certificate is not unique.
 NET_ERROR(CERT_NON_UNIQUE_NAME, -210)
 
+// The server responded with a certificate that contains a weak key (e.g.

[wtc, 2011/11/17 02:52:18]

Nit: Shorten this to "The server's certificate contains a
weak key ...".

+// a too-small RSA key).
+NET_ERROR(CERT_WEAK_KEY, -211)
+
 // Add new certificate error codes here.
 //
 // Update the value of CERT_END whenever you add a new certificate error
 // code.
 
 // The value immediately past the last certificate error code.
-NET_ERROR(CERT_END, -211)
+NET_ERROR(CERT_END, -212)
 
 // The URL is invalid.
 NET_ERROR(INVALID_URL, -300)
 
 // The scheme of the URL is disallowed.
 NET_ERROR(DISALLOWED_URL_SCHEME, -301)
 
 // The scheme of the URL is unknown.
 NET_ERROR(UNKNOWN_URL_SCHEME, -302)
 
@@ skipping 243 matching lines @@
 NET_ERROR(DNS_SERVER_FAILED, -802)
 
 // DNS transaction timed out.
 NET_ERROR(DNS_TIMED_OUT, -803)
 
 // The entry was not found in cache, for cache-only lookups.
 NET_ERROR(DNS_CACHE_MISS, -804)
 
 // FIXME: Take the next number.
 NET_ERROR(PIPELINE_EVICTION, -900)