Add --ignore-certificate-errors-spki-list switch and UMA histogram.

net/cert/x509_certificate.h

Index: net/cert/x509_certificate.h
diff --git a/net/cert/x509_certificate.h b/net/cert/x509_certificate.h
index aa123fc334d095d904ec92d40fa2ea59f88f4e86..a3520dabb13c84447d41c706c9607534bb24075d 100644
--- a/net/cert/x509_certificate.h
+++ b/net/cert/x509_certificate.h
@@ -368,6 +368,8 @@ class NET_EXPORT X509Certificate
       OSCertHandle leaf,
       const OSCertHandles& intermediates);
 
+  static SHA256HashValue CalculatePublicKeyHashSHA256(OSCertHandle cert_handle);

[Ryan Sleevi, 2017/03/16 23:19:13]

We've been trying to avoid adding new public static methods to X509Certificate,
so it doesn't become a catch-all, and to keep the API from over-complicating.

I think it's probably appropriate that in the place you need to check, you can
just use the pattern we've been using

base::StringPiece spki;
if (!asn1::ExtractSPKIFromDERCert([cert der], &spki)) {
  // unparsable cert
}
hash = crypto::SHA256HashString(spki);


I don't think there'd be a big win for wrapping into a utility method on the
base class.

[martinkr, 2017/03/28 23:16:02]

Done.

+
   // Returns true if the certificate is self-signed.
   static bool IsSelfSigned(OSCertHandle cert_handle);