[Telemetry] Use --ignore-certificate-errors-spki-list to bypass cert errors

telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py

Index: telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py
diff --git a/telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py b/telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py
index 908239d798e35054745a91fcab9a802e15298df9..51d98fb937ef8f5817a8556ecb49338649708b28 100644
--- a/telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py
+++ b/telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py
@@ -128,9 +128,13 @@ class ChromeBrowserBackend(browser_backend.BrowserBackend):
     proxy_port = network_backend.forwarder.port_pair.remote_port
     replay_args.append('--proxy-server=socks://localhost:%s' % proxy_port)
     if not network_backend.is_test_ca_installed:
-      # Ignore certificate errors if the platform backend has not created
-      # and installed a root certificate.
-      replay_args.append('--ignore-certificate-errors')
+      # Ignore certificate errors for certs that are signed with Wpr's root.
+      # openssl x509 -noout -pubkey -in wpr_cert.pem |
+      # openssl pkey -pubin -outform der |
+      # openssl dgst -sha256 -binary |
+      # base64

[nednguyen, 2017/08/22 15:40:50]

I think this string probably should be managed by wprgo code base. Maybe stored
in a file like ca_root.txt.

Then with this, we can add PRESUBMIT so that if people change wpr_cert.pem,
presubmit will validate whether the string in ca_root.txt is in sync. 

[xunjieli, 2017/08/22 21:05:43]

Done.

+      replay_args.append('--ignore-certificate-errors-spki-list='

[nednguyen, 2017/08/22 15:40:50]

nits: also link the discussion in crbug.com/757508 to here 

+                         'PhrPvGIaAMmd29hj8BCZOq096yj7uMpRNHpn5PDxI6I=')
     return replay_args
 
   def HasBrowserFinishedLaunching(self):