Include cert status in invalid certificate reports

chrome/browser/net/cert_logger.proto

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This protobuffer is intended to store reports from Chrome users of
 // certificate errors. A report will be sent from Chrome when it gets
 // e.g. a certificate for google.com that chains up to a root CA not expected by
 // Chrome for that origin, such as DigiNotar (compromised in July 2011), or
 // other pinning errors such as a blacklisted cert in the chain, or
 // (when opted in) other certificate validation errors like an expired
@@ skipping 21 matching lines @@
   required string cert_chain = 2;
   // The time (in usec since the epoch) when the client attempted to access the
   // site generating the pinning error.
   required int64 time_usec = 3;
   // public_key_hash contains the string forms of the hashes calculated for
   // the chain. (I.e. "sha1/<base64 data>".)
   repeated string public_key_hash = 4;
   // pin contains the string forms of the pins that were matched against for
   // this host.
   repeated string pin = 5;
+  // The result of validating this certificate chain. A bitmask of
+  // status flags as defined in //net/cert/cert_status_flags.h
+  optional uint32 cert_status = 6;

[Ryan Sleevi, 2015/05/06 00:00:33]

The //net flags are API compatible, but are not defined as a stable API (that
is, we can change the status flags, so long as we handle the disk cache issues
that arise)

While it sounds duplicative, I'd suggest you define your own enum here, then map
the CertStatusFlags to it.

[estark, 2015/05/06 00:50:20]

Done. (Now it's reporting the most serious error, like
|MapCertStatusToNetError|.)

 };
 
 // A wrapper proto containing an encrypted CertLoggerRequest
 message EncryptedCertLoggerRequest {
   // An encrypted, serialized CertLoggerRequest
   required bytes encrypted_report = 1;
   // The server public key version that was used to derive the shared secret.
   required uint32 server_public_key_version = 2;
   // The client public key that corresponds to the private key that was used
   // to derive the shared secret.
@@ skipping 12 matching lines @@
   enum ResponseCode {
     OK = 1;
     MALFORMED_CERT_DATA = 2;
     HOST_CERT_DONT_MATCH = 3;
     ROOT_NOT_RECOGNIZED = 4;
     ROOT_NOT_UNEXPECTED = 5;
     OTHER_ERROR = 6;
   };
   required ResponseCode response = 1;
 };