Add --ignore-certificate-errors-spki-list switch and UMA histogram.

net/cert/x509_certificate.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_X509_CERTIFICATE_H_
 #define NET_CERT_X509_CERTIFICATE_H_
 
 #include <stddef.h>
 #include <string.h>
 
@@ skipping 350 matching lines @@
   static SHA256HashValue CalculateCAFingerprint256(
       const OSCertHandles& intermediates);
 
   // Calculates the SHA-256 fingerprint for the complete chain, including the
   // leaf certificate and all intermediate CA certificates. Returns an empty
   // (all zero) fingerprint on failure.
   static SHA256HashValue CalculateChainFingerprint256(
       OSCertHandle leaf,
       const OSCertHandles& intermediates);
 
+  static SHA256HashValue CalculatePublicKeyHashSHA256(OSCertHandle cert_handle);

[Ryan Sleevi, 2017/03/16 23:19:13]

We've been trying to avoid adding new public static methods to X509Certificate,
so it doesn't become a catch-all, and to keep the API from over-complicating.

I think it's probably appropriate that in the place you need to check, you can
just use the pattern we've been using

base::StringPiece spki;
if (!asn1::ExtractSPKIFromDERCert([cert der], &spki)) {
  // unparsable cert
}
hash = crypto::SHA256HashString(spki);


I don't think there'd be a big win for wrapping into a utility method on the
base class.

[martinkr, 2017/03/28 23:16:02]

Done.

+
   // Returns true if the certificate is self-signed.
   static bool IsSelfSigned(OSCertHandle cert_handle);
 
  private:
   friend class base::RefCountedThreadSafe<X509Certificate>;
   friend class TestRootCerts;  // For unit tests
 
   FRIEND_TEST_ALL_PREFIXES(X509CertificateNameVerifyTest, VerifyHostname);
   FRIEND_TEST_ALL_PREFIXES(X509CertificateTest, SerialNumbers);
 
@@ skipping 67 matching lines @@
   // Untrusted intermediate certificates associated with this certificate
   // that may be needed for chain building.
   OSCertHandles intermediate_ca_certs_;
 
   DISALLOW_COPY_AND_ASSIGN(X509Certificate);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_X509_CERTIFICATE_H_