Do not allow the server certificate to change in a renegotiation.

net/socket/nss_ssl_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/nss_ssl_util.h"
 
 #include <nss.h>
 #include <secerr.h>
 #include <ssl.h>
 #include <sslerr.h>
@@ skipping 215 matching lines @@
     case SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE:
     // TODO(wtc): the following errors may also occur in contexts unrelated
     // to the peer's public key.  We should add new error codes for them, or
     // map them to ERR_SSL_BAD_PEER_PUBLIC_KEY only in the right context.
     // General unsupported/unknown key algorithm error.
     case SEC_ERROR_UNSUPPORTED_KEYALG:
     // General DER decoding errors.
     case SEC_ERROR_BAD_DER:
     case SEC_ERROR_EXTRA_INPUT:
       return ERR_SSL_BAD_PEER_PUBLIC_KEY;
+    // During renegotiation, the server presented a different certificate than
+    // was used earlier.
+    case SSL_ERROR_WRONG_CERTIFICATE:
+      return ERR_SSL_SERVER_CERT_CHANGED;
 
     default: {
       if (IS_SSL_ERROR(err)) {
         LOG(WARNING) << "Unknown SSL error " << err
                      << " mapped to net::ERR_SSL_PROTOCOL_ERROR";
         return ERR_SSL_PROTOCOL_ERROR;
       }
       LOG(WARNING) << "Unknown error " << err << " mapped to net::ERR_FAILED";
       return ERR_FAILED;
     }
@@ skipping 21 matching lines @@
                           const char* param) {
   DCHECK(function);
   DCHECK(param);
   net_log.AddEvent(
       NetLog::TYPE_SSL_NSS_ERROR,
       base::Bind(&NetLogSSLFailedNSSFunctionCallback,
                  function, param, PR_GetError()));
 }
 
 }  // namespace net