We don't handle certificate errors during SSL renegotiation....

net/http/http_network_transaction.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/scoped_ptr.h"
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/string_util.h"
@@ skipping 727 matching lines @@
     return ERR_EMPTY_RESPONSE;
   }
 
   // Assume everything else is a HTTP/0.9 response (including responses
   // of 'h', 'ht', 'htt').
   header_buf_body_offset_ = 0;
   return OK;
 }
 
 int HttpNetworkTransaction::DoReadHeadersComplete(int result) {
+  if (using_ssl_ && IsCertificateError(result)) {
+    // We don't handle a certificate error during SSL renegotiation, so we
+    // have to return an error that's not in the certificate error range
+    // (-2xx).
+    LOG(ERROR) << "Got a server certificate with error " << result
+               << " during SSL renegotiation";
+    result = ERR_CERT_ERROR_IN_SSL_RENEGOTIATION;
+  }
+
   if (result < 0)
     return HandleIOError(result);
 
   if (result == 0 && ShouldResendRequest()) {
     ResetConnectionAndRequestForResend();
     return result;
   }
 
   // Record our best estimate of the 'response time' as the time when we read
   // the first bytes of the response headers.
@@ skipping 858 matching lines @@
     host_and_port = proxy_info_.proxy_server().host_and_port();
   } else {
     DCHECK(target == HttpAuth::AUTH_SERVER);
     host_and_port = GetHostAndPort(request_->url);
   }
   auth_info->host_and_port = ASCIIToWide(host_and_port);
   response_.auth_challenge = auth_info;
 }
 
 }  // namespace net