Roll src/third_party/boringssl/src be2ee342d..a58baaf9e

net/ssl/openssl_ssl_util.cc

Index: net/ssl/openssl_ssl_util.cc
diff --git a/net/ssl/openssl_ssl_util.cc b/net/ssl/openssl_ssl_util.cc
index f1266d5dfa2f20c40de2cc427a94c314d2b4b407..c703a7166d500b0410d8a6d56497ce7ac7ded570 100644
--- a/net/ssl/openssl_ssl_util.cc
+++ b/net/ssl/openssl_ssl_util.cc
@@ -96,9 +96,14 @@ int MapOpenSSLErrorSSL(uint32_t error_code) {
       return ERR_SSL_UNRECOGNIZED_NAME_ALERT;
     case SSL_R_BAD_DH_P_LENGTH:
       return ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY;
+    case SSL_R_SERVER_CERT_CHANGED:
+      return ERR_SSL_SERVER_CERT_CHANGED;
     case SSL_R_CERTIFICATE_VERIFY_FAILED:
       // The only way that the certificate verify callback can fail is if
       // the leaf certificate changed during a renegotiation.
+      //
+      // TODO(davidben): This check has since moved within BoringSSL. Remove the
+      // Chromium-side machinery for it.
       return ERR_SSL_SERVER_CERT_CHANGED;
     // SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE may be returned from the server after
     // receiving ClientHello if there's no common supported cipher. Map that