Stop caching DER-encoded certificates unnecessarily

remoting/protocol/ssl_hmac_channel_authenticator.cc

Index: remoting/protocol/ssl_hmac_channel_authenticator.cc
diff --git a/remoting/protocol/ssl_hmac_channel_authenticator.cc b/remoting/protocol/ssl_hmac_channel_authenticator.cc
index e0aa78108b41cdbc9a06289f8ebf976c1c2fabd2..f41af43895a5c1a2e7ec342c2c82367a3675b3fe 100644
--- a/remoting/protocol/ssl_hmac_channel_authenticator.cc
+++ b/remoting/protocol/ssl_hmac_channel_authenticator.cc
@@ -285,10 +285,6 @@ void SslHmacChannelAuthenticator::SecureAndAuthenticate(
     ct_verifier_.reset(new IgnoresCTVerifier);
     ct_policy_enforcer_.reset(new IgnoresCTPolicyEnforcer);
 
-    net::SSLConfig::CertAndStatus cert_and_status;
-    cert_and_status.cert_status = net::CERT_STATUS_AUTHORITY_INVALID;
-    cert_and_status.der_cert = remote_cert_;
-
     net::SSLConfig ssl_config;
     // Certificate verification and revocation checking are not needed
     // because we use self-signed certs. Disable it so that the SSL
@@ -296,9 +292,22 @@ void SslHmacChannelAuthenticator::SecureAndAuthenticate(
     // thread).
     ssl_config.cert_io_enabled = false;
     ssl_config.rev_checking_enabled = false;
-    ssl_config.allowed_bad_certs.push_back(cert_and_status);
     ssl_config.require_ecdhe = true;
 
+    scoped_refptr<net::X509Certificate> cert =
+        net::X509Certificate::CreateFromBytes(remote_cert_.data(),
+                                              remote_cert_.length());
+    if (!cert.get()) {

[davidben, 2016/08/31 19:20:49]

!cert?

+      LOG(ERROR) << "Failed to parse X509Certificate";
+      NotifyError(net::ERR_FAILED);
+      return;
+    }
+
+    net::SSLConfig::CertAndStatus cert_and_status;
+    cert_and_status.cert = std::move(cert);
+    cert_and_status.cert_status = net::CERT_STATUS_AUTHORITY_INVALID;
+    ssl_config.allowed_bad_certs.emplace_back(cert_and_status);

[Sergey Ulanov, 2016/08/31 18:46:44]

Why emplace_back() instead of push_back()? Copy constructor is called either
way, so I don't see any reason to use emplace_back() here and push_back() is
more readable.

[Ryan Sleevi, 2016/08/31 20:33:13]

Because I'm an idiot who forgot to std::move()-it, std::move()-it. :) Fixed it.

(wanted to avoid the extra ref-counting and better reflect the throw-awayness)

+
     net::HostPortPair host_and_port(kSslFakeHostName, 0);
     net::SSLClientSocketContext context;
     context.transport_security_state = transport_security_state_.get();