Add enterprise policy to allow locally issued SHA-1 certificates.

net/cert/cert_verifier.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_CERT_VERIFIER_H_
 #define NET_CERT_CERT_VERIFIER_H_
 
 #include <memory>
 #include <string>
 #include <vector>
@@ skipping 57 matching lines @@
     // If set, this is equivalent to VERIFY_REV_CHECKING_ENABLED, in that it
     // enables online revocation checking via CRLs or OCSP, but only
     // for certificates issued by non-public trust anchors. Failure to check
     // revocation is treated as a hard failure.
     // Note: If VERIFY_CERT_IO_ENABLE is not also supplied, certificates
     // that chain to local trust anchors will likely fail - for example, due to
     // lacking fresh cached revocation issue (Windows) or because OCSP stapling
     // can only provide information for the leaf, and not for any
     // intermediates.
     VERIFY_REV_CHECKING_REQUIRED_LOCAL_ANCHORS = 1 << 4,
+
+    // If set, certificates with SHA-1 signatures will be allowed, but only if
+    // they are issued by non-public trust anchors.
+    VERIFY_ENABLE_SHA1_LOCAL_ANCHORS = 1 << 5,
   };
 
   // Parameters to verify |certificate| against the supplied
   // |hostname| as an SSL server.
   //
   // |hostname| should be a canonicalized hostname (in A-Label form) or IP
   // address in string form, following the rules of a URL host portion. In
   // the case of |hostname| being a domain name, it may contain a trailing
   // dot (e.g. "example.com."), as used to signal to DNS not to perform
   // suffix search, and it will safely be ignored. If |hostname| is an IPv6
@@ skipping 81 matching lines @@
   virtual bool SupportsOCSPStapling();
 
   // Creates a CertVerifier implementation that verifies certificates using
   // the preferred underlying cryptographic libraries.
   static std::unique_ptr<CertVerifier> CreateDefault();
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_CERT_VERIFIER_H_