Add enterprise policy to allow locally issued SHA-1 certificates.

Add enterprise policy to allow locally issued SHA-1 certificates.

BUG=626432
Committed: https://crrev.com/9b3b296ad3c43aa058ba9b33126d2096f408c970
Cr-Commit-Position: refs/heads/master@{#412041}

[mattm, 2016-08-11 23:32:36]

The CQ bit was checked by mattm@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-11 23:33:48]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[mattm, 2016-08-12 00:37:48]

mattm@chromium.org changed reviewers:
+ holte@chromium.org, rsleevi@chromium.org, tnagel@chromium.org

[mattm, 2016-08-12 00:37:48]

tnagel: policy
holte: histograms.xml
rsleevi: components/ssl_config, net/

Note that the CL adds the policy and plumbs it through
CertVerifier::VerifyFlags, but doesn't change cert_verify_proc to check the
flag, since currently locally issued SHA-1 certificates are always allowed. A
later change will default to not exempting locally issued certs unless the
policy is set.

I manually tested it by adding a LOG message in cert_verify_proc that prints the
flag value, and creating a policy file.

[commit-bot: I haz the power, 2016-08-12 02:02:21]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-12 02:02:22]

Dry run: This issue passed the CQ dry run.

[Thiemo Nagel, 2016-08-12 13:12:45]

policy lgtm

https://codereview.chromium.org/2239963002/diff/1/components/policy/resources...
File components/policy/resources/policy_templates.json (right):

https://codereview.chromium.org/2239963002/diff/1/components/policy/resources...
components/policy/resources/policy_templates.json:4632: 'desc': '''When this
setting is enabled, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
allow SHA-1 signed certificates as long as they successfully validate and chain
to a locally-installed CA certificates.
Style nit: I'd suggest to use present tense.

https://codereview.chromium.org/2239963002/diff/1/components/policy/resources...
components/policy/resources/policy_templates.json:4636: If this policy is not
set, or it is set to false, then <ph name="PRODUCT_NAME">$1<ex>Google
Chrome</ex></ph> will follow the publicly announced SHA-1 deprecation
schedule.''',
Same here, suggest to use present tense.

[Ryan Sleevi, 2016-08-12 19:31:04]

lgtm

[mattm, 2016-08-12 20:48:14]

https://codereview.chromium.org/2239963002/diff/1/components/policy/resources...
File components/policy/resources/policy_templates.json (right):

https://codereview.chromium.org/2239963002/diff/1/components/policy/resources...
components/policy/resources/policy_templates.json:4632: 'desc': '''When this
setting is enabled, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will
allow SHA-1 signed certificates as long as they successfully validate and chain
to a locally-installed CA certificates.
On 2016/08/12 13:12:44, Thiemo Nagel wrote:
> Style nit: I'd suggest to use present tense.

Done.

https://codereview.chromium.org/2239963002/diff/1/components/policy/resources...
components/policy/resources/policy_templates.json:4636: If this policy is not
set, or it is set to false, then <ph name="PRODUCT_NAME">$1<ex>Google
Chrome</ex></ph> will follow the publicly announced SHA-1 deprecation
schedule.''',
On 2016/08/12 13:12:45, Thiemo Nagel wrote:
> Same here, suggest to use present tense.

Done.

[Steven Holte, 2016-08-13 00:44:00]

histograms lgtm

[mattm, 2016-08-15 19:56:22]

The CQ bit was checked by mattm@chromium.org

[mattm, 2016-08-15 19:56:23]

The patchset sent to the CQ was uploaded after l-g-t-m from tnagel@chromium.org,
rsleevi@chromium.org
Link to the patchset: https://codereview.chromium.org/2239963002/#ps40001
(title: "rebase")

[commit-bot: I haz the power, 2016-08-15 19:56:42]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-15 20:54:51]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-08-15 21:00:46]

Description was changed from

==========
Add enterprise policy to allow locally issued SHA-1 certificates.

BUG=626432
==========

to

==========
Add enterprise policy to allow locally issued SHA-1 certificates.

BUG=626432

Committed: https://crrev.com/9b3b296ad3c43aa058ba9b33126d2096f408c970
Cr-Commit-Position: refs/heads/master@{#412041}
==========

[commit-bot: I haz the power, 2016-08-15 21:00:47]

Patchset 3 (id:??) landed as
https://crrev.com/9b3b296ad3c43aa058ba9b33126d2096f408c970
Cr-Commit-Position: refs/heads/master@{#412041}