[Telemetry] Use --ignore-certificate-errors-spki-list to bypass cert errors

telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py

Index: telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py
diff --git a/telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py b/telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py
index 908239d798e35054745a91fcab9a802e15298df9..cf1889d429590e829f56d7ba3526032728c87e55 100644
--- a/telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py
+++ b/telemetry/telemetry/internal/backends/chrome/chrome_browser_backend.py
@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 import logging
+import os
 import pprint
 import shlex
 import sys
@@ -128,9 +129,18 @@ class ChromeBrowserBackend(browser_backend.BrowserBackend):
     proxy_port = network_backend.forwarder.port_pair.remote_port
     replay_args.append('--proxy-server=socks://localhost:%s' % proxy_port)
     if not network_backend.is_test_ca_installed:
-      # Ignore certificate errors if the platform backend has not created
-      # and installed a root certificate.
-      replay_args.append('--ignore-certificate-errors')
+      # Ignore certificate errors for certs that are signed with Wpr's root.
+      # For more details on this flag, see crbug.com/753948.
+      wpr_public_hash_file = os.path.join(util.GetCatapultDir(),
+                                          'web_page_replay_go',
+                                          'wpr_public_hash.txt')
+      if not os.path.exists(wpr_public_hash_file):
+        raise exceptions.PathMissingError('Unable to find %s' %
+                                          wpr_public_hash_file)
+      with open(wpr_public_hash_file) as f:
+        wpr_public_hash = f.readline().strip()
+        replay_args.append('--ignore-certificate-errors-spki-list=' +
+                           wpr_public_hash)
     return replay_args
 
   def HasBrowserFinishedLaunching(self):