We don't handle certificate errors during SSL renegotiation....

net/base/net_error_list.h

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file contains the list of network errors.
 
 // An asynchronous IO operation is not yet complete.  This usually does not
 // indicate a fatal error.  Typically this error will be generated as a
 // notification to wait for some external notification that the IO operation
 // finally completed.
@@ skipping 81 matching lines @@
 // The client and server don't support a common SSL protocol version or
 // cipher suite.
 NET_ERROR(SSL_VERSION_OR_CIPHER_MISMATCH, -113)
 
 // The server requested a renegotiation (rehandshake).
 NET_ERROR(SSL_RENEGOTIATION_REQUESTED, -114)
 
 // The proxy requested authentication (for tunnel establishment).
 NET_ERROR(PROXY_AUTH_REQUESTED, -115)
 
+// During SSL renegotiation (rehandshake), the server sent a certificate with
+// an error.
+//
+// Note: this error is not in the -2xx range so that it won't be handled as a
+// certificate error.
+NET_ERROR(CERT_ERROR_IN_SSL_RENEGOTIATION, -116)
+
 // Certificate error codes
 //
 // The values of certificate error codes must be consecutive.
 
 // The server responded with a certificate whose common name did not match
 // the host name.  This could mean:
 //
 // 1. An attacker has redirected our traffic to his server and is
 //    presenting a certificate for which he knows the private key.
 //
@@ skipping 136 matching lines @@
 
 // The network transaction factory of the cache was not able to create a new
 // transaction.
 NET_ERROR(CACHE_CANNOT_CREATE_NETWORK_TRANSACTION, -402)
 
 // The operation is not supported for this entry.
 NET_ERROR(CACHE_OPERATION_NOT_SUPPORTED, -403)
 
 // The server's response was insecure (e.g. there was a cert error).
 NET_ERROR(INSECURE_RESPONSE, -501)