net: a weak DH key is not a certificate error.

net/base/net_errors.h

Index: net/base/net_errors.h
diff --git a/net/base/net_errors.h b/net/base/net_errors.h
index c8742a8110df194d01666ebd46d20e8403c121c1..6022a29babe7d236d315931fb1f4b0b5e629d319 100644
--- a/net/base/net_errors.h
+++ b/net/base/net_errors.h
@@ -37,7 +37,6 @@ inline bool IsCertificateError(int error) {
   // Certificate errors are negative integers from net::ERR_CERT_BEGIN
   // (inclusive) to net::ERR_CERT_END (exclusive) in *decreasing* order.

[wtc, 2014/03/04 20:13:30]

This comment should be updated to note ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN as
an exception to this rule.

The rule is that all certificate errors should be within this range, and have a
corresponding certificate error status bit defined in cert_status_flags.h.

There is another related problem (also coming from
https://codereview.chromium.org/23908005/): ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY
has a corresponding CERT_STATUS_WEAK_DH_KEY bit. That certificate error status
bit should be removed.

As for ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN, we usually don't change the numeric
value of an error code. We can, however, replace it with a new error code
ERR_CERT_PINNED_KEY_MISSING within the certificate error range.

[agl, 2014/03/04 22:54:38]

Done.
Yea. The problem stems from the fact that I didn't intend for pinning to be a
certificate error. I planned on it being a simple, fatal error like a connection
failure.
Since this is a crash fix and will probably be merged, I'll keep it simple.
Again, I'll avoid doing this in this change. I'd like to talk to felt about the
treatment of pinning errors first.

   return (error <= ERR_CERT_BEGIN && error > ERR_CERT_END) ||
-         (error == ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY) ||
          (error == ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN);
 }