Update SSL error handling code to account for Subject CN deprecation

components/ssl_errors/error_info.cc

Index: components/ssl_errors/error_info.cc
diff --git a/components/ssl_errors/error_info.cc b/components/ssl_errors/error_info.cc
index 7ef291ebe4b443c39dadb389877a4c9481bce1fc..d4a662a6986b3b6f4bbbb04d180453e36f88a8a1 100644
--- a/components/ssl_errors/error_info.cc
+++ b/components/ssl_errors/error_info.cc
@@ -32,22 +32,28 @@ ErrorInfo ErrorInfo::CreateError(ErrorType error_type,
   base::string16 details, short_description;
   switch (error_type) {
     case CERT_COMMON_NAME_INVALID: {
-      // If the certificate contains multiple DNS names, we choose the most
-      // representative one -- either the DNS name that's also in the subject
-      // field, or the first one.  If this heuristic turns out to be
-      // inadequate, we can consider choosing the DNS name that is the
-      // "closest match" to the host name in the request URL, or listing all
-      // the DNS names with an HTML <ul>.
       std::vector<std::string> dns_names;
-      cert->GetDNSNames(&dns_names);
-      DCHECK(!dns_names.empty());
+      cert->GetSubjectAltName(&dns_names, nullptr);
+
       size_t i = 0;
-      for (; i < dns_names.size(); ++i) {
-        if (dns_names[i] == cert->subject().common_name)
-          break;
+      if (dns_names.empty()) {
+        // The certificate had no DNS names, display an explanatory string.
+        dns_names.push_back("[missing_subjectAltName]");

[estark, 2017/04/04 17:22:07]

Can we use a more human-readable |details| string for this case?
WDYT of "This server could not prove that it is example.com; its security
certificate is missing a Subject Alternative Name."?

[elawrence, 2017/04/04 19:53:24]

Filed crbug.com/708268

+      } else {
+        // If the certificate contains multiple DNS names, we choose the most
+        // representative one -- either the DNS name that's also in the subject
+        // field, or the first one. If this heuristic turns out to be
+        // inadequate, we can consider choosing the DNS name that is the
+        // "closest match" to the host name in the request URL, or listing all
+        // the DNS names with an HTML <ul>.
+        for (; i < dns_names.size(); ++i) {
+          if (dns_names[i] == cert->subject().common_name)
+            break;
+        }
+        if (i == dns_names.size())
+          i = 0;
       }
-      if (i == dns_names.size())
-        i = 0;
+
       details = l10n_util::GetStringFUTF16(
           IDS_CERT_ERROR_COMMON_NAME_INVALID_DETAILS,
           UTF8ToUTF16(request_url.host()),