Forget SSL error exceptions when good certs seen for regular requests.

chrome/browser/ssl/ssl_browser_tests.cc

Index: chrome/browser/ssl/ssl_browser_tests.cc
diff --git a/chrome/browser/ssl/ssl_browser_tests.cc b/chrome/browser/ssl/ssl_browser_tests.cc
index ba69fe78eb8b47aee9d8ebc1bb8ecb8fff4a3cc8..f330972736cf467df881669f298e4a5e9226348d 100644
--- a/chrome/browser/ssl/ssl_browser_tests.cc
+++ b/chrome/browser/ssl/ssl_browser_tests.cc
@@ -19,6 +19,7 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/safe_browsing/ping_manager.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
+#include "chrome/browser/ssl/chrome_ssl_host_state_delegate.h"
 #include "chrome/browser/ssl/ssl_blocking_page.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
@@ -2129,6 +2130,36 @@ IN_PROC_BROWSER_TEST_F(SSLUITest, InterstitialNotAffectedByHideShow) {
   EXPECT_TRUE(tab->GetRenderWidgetHostView()->IsShowing());
 }
 
+// Verifies that if a bad certificate is seen for a host and the user proceeds
+// through the interstitial, the decision to proceed is initially remembered.
+// However, if this is followed by another visit, and a good certificate
+// is seen for the same host, the original exception is forgotten.
+IN_PROC_BROWSER_TEST_F(SSLUITest, BadCertFollowedByGoodCert) {
+  ASSERT_TRUE(https_server_mismatched_.Start());
+
+  ui_test_utils::NavigateToURL(
+      browser(), https_server_mismatched_.GetURL("files/ssl/google.html"));
+  WebContents* tab = browser()->tab_strip_model()->GetActiveWebContents();
+
+  ChromeSSLHostStateDelegate* state =
+      reinterpret_cast<ChromeSSLHostStateDelegate*>(
+          Profile::FromBrowserContext(tab->GetBrowserContext())
+              ->GetSSLHostStateDelegate());
+
+  ProceedThroughInterstitial(tab);
+
+  EXPECT_TRUE(state->HasAllowException(tab->GetURL().host()));
+

[davidben, 2015/04/07 21:08:43]

You should probably flush the socket pools here for good measure. Otherwise you
might just reuse an old socket. Though I don't know if the test server does
keep-alives?

This is how net-internals does it:
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/ui/...

That'll need to all run on the IO thread, so do a PostTaskAndReply with the
reply being the QuitClosure of a base::RunLoop and then spin the RunLoop.

[jww, 2015/04/08 00:57:40]

Done.

+  net::SpawnedTestServer::SSLOptions new_options(
+      net::SpawnedTestServer::SSLOptions::CERT_OK);
+  https_server_mismatched_.set_ssl_options(new_options);
+  ui_test_utils::NavigateToURL(
+      browser(), https_server_mismatched_.GetURL("files/ssl/google.html"));
+  tab = browser()->tab_strip_model()->GetActiveWebContents();
+
+  EXPECT_FALSE(state->HasAllowException(tab->GetURL().host()));
+}
+
 class SSLBlockingPageIDNTest : public SecurityInterstitialIDNTest {
  protected:
   // SecurityInterstitialIDNTest implementation