Don't process HSTS/HPKP headers when host is an IP address

net/data/ssl/scripts/generate-test-certs.sh

Index: net/data/ssl/scripts/generate-test-certs.sh
diff --git a/net/data/ssl/scripts/generate-test-certs.sh b/net/data/ssl/scripts/generate-test-certs.sh
index 24eadf108552a1bde2e64fc6ecd8cc22a5d1d269..b0fd908b9a3e80583e6f1b0d8cd79afe8b93345e 100755
--- a/net/data/ssl/scripts/generate-test-certs.sh
+++ b/net/data/ssl/scripts/generate-test-certs.sh
@@ -8,8 +8,7 @@
 # certificates that can be used to test fetching of an intermediate via AIA.
 
 try() {
-  echo "$@"
-  "$@" || exit 1
+  "$@" || (e=$?; echo "$@" > /dev/stderr; exit $e)
 }
 
 try rm -rf out
@@ -33,11 +32,10 @@ CA_COMMON_NAME="Test Root CA" \
   try openssl x509 \
     -req -days 3650 \
     -in out/2048-sha256-root.req \
-    -out out/2048-sha256-root.pem \
     -signkey out/2048-sha256-root.key \
     -extfile ca.cnf \
     -extensions ca_cert \
-    -text
+    -text > out/2048-sha256-root.pem
 
 # Generate the leaf certificate requests
 try openssl req \
@@ -52,6 +50,14 @@ try openssl req \
   -out out/ok_cert.req \
   -config ee.cnf
 
+SUBJECT_NAME=req_localhost_cn \
+try openssl req \
+  -new \
+  -keyout out/localhost_cert.key \
+  -out out/localhost_cert.req \
+  -reqexts req_localhost_san \
+  -config ee.cnf
+
 # Generate the leaf certificates
 CA_COMMON_NAME="Test Root CA" \
   try openssl ca \
@@ -92,8 +98,19 @@ CA_COMMON_NAME="Test Root CA" \
     -out out/name_constraint_good.pem \
     -config ca.cnf
 
+CA_COMMON_NAME="Test Root CA" \
+  try openssl ca \
+    -batch \
+    -extensions user_cert \
+    -days 3650 \
+    -in out/localhost_cert.req \
+    -out out/localhost_cert.pem \
+    -config ca.cnf
+
 try /bin/sh -c "cat out/ok_cert.key out/ok_cert.pem \
     > ../certificates/ok_cert.pem"
+try /bin/sh -c "cat out/localhost_cert.key out/localhost_cert.pem \
+    > ../certificates/localhost_cert.pem"
 try /bin/sh -c "cat out/expired_cert.key out/expired_cert.pem \
     > ../certificates/expired_cert.pem"
 try /bin/sh -c "cat out/2048-sha256-root.key out/2048-sha256-root.pem \
@@ -108,7 +125,7 @@ try /bin/sh -c "cat out/ok_cert.key out/name_constraint_good.pem \
 try openssl req -x509 -days 3650 \
     -config ../scripts/ee.cnf -newkey rsa:2048 -text \
     -sha256 \
-    -out sha256.pem
+    -out ../certificates/sha256.pem
 
 ## Self-signed cert for SPDY/QUIC/HTTP2 pooling testing
 try openssl req -x509 -days 3650 -extensions req_spdy_pooling \