Do not allow the server certificate to change in a renegotiation.

net/base/net_error_list.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file intentionally does not have header guards, it's included
 // inside a macro to generate enum values.
 
 // This file contains the list of network errors.
 
 //
@@ skipping 282 matching lines @@
 NET_ERROR(SSL_DECRYPT_ERROR_ALERT, -153)
 
 // There are too many pending WebSocketJob instances, so the new job was not
 // pushed to the queue.
 NET_ERROR(WS_THROTTLE_QUEUE_TOO_LARGE, -154)
 
 // There are too many active SocketStream instances, so the new connect request
 // was rejected.
 NET_ERROR(TOO_MANY_SOCKET_STREAMS, -155)
 
+// The SSL server certificate changed in a renegotiation.
+NET_ERROR(SSL_SERVER_CERT_CHANGED, -156)
+
 // Certificate error codes
 //
 // The values of certificate error codes must be consecutive.
 
 // The server responded with a certificate whose common name did not match
 // the host name.  This could mean:
 //
 // 1. An attacker has redirected our traffic to his server and is
 //    presenting a certificate for which he knows the private key.
 //
@@ skipping 381 matching lines @@
 NET_ERROR(DNS_TIMED_OUT, -803)
 
 // The entry was not found in cache, for cache-only lookups.
 NET_ERROR(DNS_CACHE_MISS, -804)
 
 // Suffix search list rules prevent resolution of the given host name.
 NET_ERROR(DNS_SEARCH_EMPTY, -805)
 
 // Failed to sort addresses according to RFC3484.
 NET_ERROR(DNS_SORT_ERROR, -806)