Refuse to accept certificate chains containing any RSA public key smaller

net/data/ssl/scripts/ee.cnf

Index: net/data/ssl/scripts/ee.cnf
===================================================================
--- net/data/ssl/scripts/ee.cnf	(revision 0)
+++ net/data/ssl/scripts/ee.cnf	(revision 0)
@@ -0,0 +1,20 @@
+[req]
+default_bits       = $ENV::KEY_SIZE
+default_md         = sha1
+string_mask        = utf8only
+prompt             = no
+encrypt_key        = no
+distinguished_name = req_dn
+req_extensions     = req_extensions
+
+[req_dn]
+C  = US
+ST = California
+L  = Mountain View
+O  = Test CA
+# TODO(joth): Support matching the iPAddress subjectAltName when using
+# OpenSSL. See http://crbug.com/62973 and http://crbug.com/20276

[Ryan Sleevi, 2011/12/13 23:54:16]

Heh, this has long been added. I think this was a carry-over from the original
script I e-mailed you?

You can remove this TODO, for sure, and optionally update the CN like wtc
requested. Re-generating the certs doesn't matter as much as making sure to
remove the TODO.

+CN = 127.0.0.1
+
+[req_extensions]
+subjectAltName = IP:127.0.0.1