Do not assume OSCertHandle is OpenSSL's X509 structure.

net/socket/ssl_client_socket_openssl.cc

Index: net/socket/ssl_client_socket_openssl.cc
diff --git a/net/socket/ssl_client_socket_openssl.cc b/net/socket/ssl_client_socket_openssl.cc
index d04670fc14fcab9b1e7465a3525886b6b798b03a..ac16e4c899cec25ae1aa24b18009065ef14f67b5 100644
--- a/net/socket/ssl_client_socket_openssl.cc
+++ b/net/socket/ssl_client_socket_openssl.cc
@@ -1502,8 +1502,29 @@ int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) {
     return 1;
   }
 
-  if (X509Certificate::IsSameOSCert(server_cert_->os_cert_handle(),
-                                    sk_X509_value(store_ctx->untrusted, 0))) {
+  std::string der_current_cert;
+  if (!X509Certificate::GetDEREncoded(server_cert_->os_cert_handle(),
+                                      &der_current_cert)) {
+    LOG(ERROR) << "Failed to get current certificate in DER form";
+    return 0;
+  }
+
+  X509* leaf_cert = sk_X509_value(store_ctx->chain, 0);
+  int len = i2d_X509(leaf_cert, NULL);
+  if (len < 0) {
+    LOG(ERROR) << "Failed to marshal certificate from renegotiation";
+    return 0;
+  }
+
+  scoped_ptr<uint8[]> der_leaf_cert(new uint8[len]);
+  uint8 *outp = der_leaf_cert.get();
+  len = i2d_X509(leaf_cert, &outp);
+
+  if (static_cast<size_t>(len) == der_current_cert.size() &&
+      memcmp(der_leaf_cert.get(),
+             der_current_cert.data(),
+             der_current_cert.size()) == 0) {
+    // The certificates match so the renegotiation can continue.

[Ryan Sleevi, 2014/03/18 20:47:07]

Why not convert the untrusted cert to an X509Certificate/PeerCertificateChain,
and compare against that? Like NSS?

[haavardm, 2014/03/18 21:36:41]

Not sure I understand. If I get this correctly, NSS is actually comparing the
der strings from two CERTCertificate retrieved from PeerCertificateChain and the
socket. As most of the code here is to turn X509 into der I'm not sure it would
simplify this much. 

But I could certainly extend PeerCertificateChain with a function to take in
store_ctx->chain (which would also be called by Reset(ssl) and then compare new
and old X509Certificate objects.

     return 1;
   }