Refuse to accept certificate chains containing any RSA public key smaller

net/base/cert_status_flags.cc

Index: net/base/cert_status_flags.cc
===================================================================
--- net/base/cert_status_flags.cc	(revision 114272)
+++ net/base/cert_status_flags.cc	(working copy)
@@ -41,6 +41,8 @@
       return CERT_STATUS_INVALID;
     case ERR_CERT_WEAK_SIGNATURE_ALGORITHM:
       return CERT_STATUS_WEAK_SIGNATURE_ALGORITHM;
+    case ERR_CERT_WEAK_KEY:
+      return CERT_STATUS_WEAK_KEY;
     case ERR_CERT_NOT_IN_DNS:
       return CERT_STATUS_NOT_IN_DNS;
     default:
@@ -65,6 +67,8 @@
     return ERR_CERT_COMMON_NAME_INVALID;
   if (cert_status & CERT_STATUS_WEAK_SIGNATURE_ALGORITHM)
     return ERR_CERT_WEAK_SIGNATURE_ALGORITHM;
+  if (cert_status & CERT_STATUS_WEAK_KEY)
+    return ERR_CERT_WEAK_KEY;

[Ryan Sleevi, 2011/12/13 23:54:16]

Just a reminder that you will want to update the localized error pages in a
subsequent CL, especially if you wish an interstitial to show to allow the user
to recover (Line 63)

   if (cert_status & CERT_STATUS_DATE_INVALID)
     return ERR_CERT_DATE_INVALID;