Disable commonName matching for certificates

net/ssl/ssl_config.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SSL_CONFIG_H_
 #define NET_SSL_SSL_CONFIG_H_
 
 #include <stdint.h>
 
 #include "base/memory/ref_counted.h"
@@ skipping 60 matching lines @@
   // certificates will be treated as revoked ("hard-fail").
   // Note: This is distinct from rev_checking_enabled. If true, it is
   // equivalent to also setting rev_checking_enabled, but only when the
   // certificate chain chains to a local (non-public) trust anchor.
   bool rev_checking_required_local_anchors;
 
   // sha1_local_anchors_enabled is true if SHA-1 signed certificates issued by a
   // local (non-public) trust anchor should be allowed.
   bool sha1_local_anchors_enabled;
 
+  // common_name_fallback_local_anchors_enabled is true if certificates which
+  // only have a commonName in the Subject (i.e. lacking a subjectAltName)
+  // should be checked if the name matches. Only those issued by a local
+  // (non-public) trust anchor will be allowed to match.
+  bool common_name_fallback_local_anchors_enabled;
+
   // The minimum and maximum protocol versions that are enabled.
   // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined above.)
   // SSL 2.0 and SSL 3.0 are not supported. If version_max < version_min, it
   // means no protocol versions are enabled.
   uint16_t version_min;
   uint16_t version_max;
 
   // Presorted list of cipher suites which should be explicitly prevented from
   // being used in addition to those disabled by the net built-in policy.
   //
@@ skipping 74 matching lines @@
   // The list of application-level protocols to enable renegotiation for.
   NextProtoVector renego_allowed_for_protos;
 
   scoped_refptr<X509Certificate> client_cert;
   scoped_refptr<SSLPrivateKey> client_private_key;
 };
 
 }  // namespace net
 
 #endif  // NET_SSL_SSL_CONFIG_H_