Treat failure to parse certificates as SSL protocol errors.

net/data/ssl/certificates/README

 This directory contains various certificates for use with SSL-related
 unit tests.
 
 ===== Real-world certificates that need manual updating
 - google.binary.p7b
 - google.chain.pem
 - google.pem_cert.p7b
 - google.pem_pkcs7.p7b
 - google.pkcs7.p7b
 - google.single.der
@@ skipping 123 matching lines @@
 - ok_cert.pem
 - root_ca_cert.pem
     These certificates are the common certificates used by the Python test
     server for simulating HTTPS connections.
 
 - name_constraint_bad.pem
 - name_constraint_good.pem
     Two certificates used to test the built-in ability to restrict a root to
     a particular namespace.
 
+- bad_validity.pem
+    A certificate and private key only valid on 0001-01-01. Windows refuses to
+    parse this certificate.
+
 - sha256.pem: Used to test the handling of SHA-256 certs on Windows.
 
 - spdy_pooling.pem : Used to test the handling of spdy IP connection pooling
 
 - subjectAltName_sanity_check.pem : Used to test the handling of various types
      within the subjectAltName extension of a certificate.
 
 - punycodetest.pem : A test self-signed server certificate with punycode name.
      The common name is "xn--wgv71a119e.com" (日本語.com)
 
@@ skipping 112 matching lines @@
 ===== From net/data/ssl/scripts/generate-aia-certs.sh
 - aia-cert.pem
 - aia-intermediate.der
 - aia-root.pem
      A certificate chain which we use to ensure AIA fetching works correctly
      when using NSS to verify certificates (which uses our HTTP stack).
      aia-cert.pem has a caIssuers that points to "aia-test.invalid" as the URL
      containing the intermediate, which can be served via a URLRequestFilter.
      aia-intermediate.der is stored in DER form for convenience, since that is
      the form expected of certificates discovered via AIA.