Add --ignore-certificate-errors-spki-list switch and UMA histogram.

content/public/common/content_switches.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "build/build_config.h"
 #include "content/public/common/content_switches.h"
 #include "media/media_features.h"
 
 namespace switches {
 
@@ skipping 565 matching lines @@
 
 // Makes GPU sandbox failures fatal.
 const char kGpuSandboxFailuresFatal[]       = "gpu-sandbox-failures-fatal";
 
 // Causes the GPU process to display a dialog on launch.
 const char kGpuStartupDialog[]              = "gpu-startup-dialog";
 
 // Ignores certificate-related errors.
 const char kIgnoreCertificateErrors[]       = "ignore-certificate-errors";
 
+// A set of certificates by public key hash for which to ignore

[Ryan Sleevi, 2017/03/16 23:19:13]

I think this may either be missing a word (certificates _identified_ by public
key hash?) or may just be better with fewer words (A set of public key hashes
...)

[martinkr, 2017/03/28 23:16:02]

Done.

+// certificate-related errors. If an SSL certificates presented by the server
+// (leaf or intermediate) matches a public key from this list, certificate

[Ryan Sleevi, 2017/03/16 23:19:13]

Grammar: an SSL certificates mismatches plurality

But I'm wondering if this might be simpler as

// If the certificate chain presented by the server does not validate,
// and one or more certificates have public key hashes that match a
// key from this list, the error is ignored.

?

[martinkr, 2017/03/28 23:16:02]

Done.

+// errors are ignored.
+//
+// The switch value must be a comma-separated list of base64-encoded SHA-256
+// hashes of the DER-encoded certificate subject public keys (without tag and
+// length).

[Ryan Sleevi, 2017/03/16 23:19:13]

// The switch value is comprised of a comma-separated list of
// RFC 7469 pin-directives (e.g. pin-sha256=abcdef)

Alternatively, you could say:

// The switch value must a be a comma-separated list of Base64-encoded
// SHA-256 SPKI Fingerprints (RFC 7469, Section 2.4).

[martinkr, 2017/03/28 23:16:02]

Done.

+const char kIgnoreCertificateErrorsSPKIList[] =
+    "ignore-certificate-errors-spki-list";
+
 // Don't allow content to arbitrarily append to the back/forward list.
 // The page must prcoess a user gesture before an entry can be added.
 const char kHistoryEntryRequiresUserGesture[] =
     "history-entry-requires-user-gesture";
 
 // These mappings only apply to the host resolver.
 const char kHostResolverRules[]             = "host-resolver-rules";
 
 // Makes all APIs reflect the layout viewport.
 const char kInertVisualViewport[]           = "inert-visual-viewport";
@@ skipping 487 matching lines @@
 // the given directory. Used primarily to gather samples for IPC fuzzing.
 const char kIpcDumpDirectory[] = "ipc-dump-directory";
 
 // Specifies the testcase used by the IPC fuzzer.
 const char kIpcFuzzerTestcase[] = "ipc-fuzzer-testcase";
 #endif
 
 // Don't dump stuff here, follow the same order as the header.
 
 }  // namespace switches