Suggest upgrading to SP3 or later for invalid certificate errors.

chrome/browser/ssl/ssl_blocking_page.cc

Index: chrome/browser/ssl/ssl_blocking_page.cc
diff --git a/chrome/browser/ssl/ssl_blocking_page.cc b/chrome/browser/ssl/ssl_blocking_page.cc
index d0d95b8f5e744a3b3f0981549be09553bfe39b42..7f264f4c260256991ac2a75b4cd32a160f2d63c5 100644
--- a/chrome/browser/ssl/ssl_blocking_page.cc
+++ b/chrome/browser/ssl/ssl_blocking_page.cc
@@ -542,7 +542,6 @@ std::string SSLBlockingPage::GetHTMLContentsV2() {
   load_time_data.SetString(
      "closeDetails",
      l10n_util::GetStringUTF16(IDS_SSL_V2_CLOSE_DETAILS_BUTTON));
-

[felt, 2014/06/30 18:16:07]

any particular reason why you're deleting this line?

[radhikabhar, 2014/07/02 18:51:08]

Done.

   if (overridable_ && !strict_enforcement_) {  // Overridable.
     SSLErrorInfo error_info =
         SSLErrorInfo::CreateError(
@@ -559,17 +558,27 @@ std::string SSLBlockingPage::GetHTMLContentsV2() {
         l10n_util::GetStringFUTF16(IDS_SSL_OVERRIDABLE_PROCEED_PARAGRAPH, url));
   } else {  // Non-overridable.
     load_time_data.SetBoolean("overridable", false);
-    load_time_data.SetString(
-        "explanationParagraph",
-        l10n_util::GetStringFUTF16(IDS_SSL_NONOVERRIDABLE_MORE, url));
+    SSLErrorInfo::ErrorType type =
+        SSLErrorInfo::NetErrorToErrorType(cert_error_);
+    if (type == SSLErrorInfo::CERT_INVALID) {

[felt, 2014/06/30 18:16:07]

it seems like this would be simpler as:

if (type == SSLErrorInfo::CERT_INVALID && WindowsVersionSP3Lower()) {
  ...
} else {
  ...
}

instead of doing two separate comparisons

[radhikabhar, 2014/07/01 23:56:49]

Done.

+      load_time_data.SetString(
+          "explanationParagraph",
+          WindowsVersionSP3Lower() ?
+          l10n_util::GetStringFUTF16(
+              IDS_SSL_NONOVERRIDABLE_MORE_INVALID_SP3,url) :

[felt, 2014/06/30 18:16:07]

nit: you need a space here

IDS_SSL_NONOVERRIDABLE_MORE_INVALID_SP3, url

[radhikabhar, 2014/07/01 23:56:49]

Done.

+          l10n_util::GetStringFUTF16(
+              IDS_SSL_NONOVERRIDABLE_MORE, url));
+    } else {
+      load_time_data.SetString("explanationParagraph",
+                               l10n_util::GetStringFUTF16(
+                                   IDS_SSL_NONOVERRIDABLE_MORE, url));
+    }
     load_time_data.SetString(
         "primaryButtonText",
         l10n_util::GetStringUTF16(IDS_SSL_NONOVERRIDABLE_RELOAD_BUTTON));
     // Customize the help link depending on the specific error type.
     // Only mark as HSTS if none of the more specific error types apply, and use
     // INVALID as a fallback if no other string is appropriate.
-    SSLErrorInfo::ErrorType type =
-        SSLErrorInfo::NetErrorToErrorType(cert_error_);
     load_time_data.SetInteger("errorType", type);
     int help_string = IDS_SSL_NONOVERRIDABLE_INVALID;
     switch (type) {
@@ -760,3 +769,17 @@ void SSLBlockingPage::Observe(
   }
 #endif
 }
+
+bool SSLBlockingPage::WindowsVersionSP3Lower() {
+#if defined(OS_WIN)
+  bool on_windows_xp = base::win::GetVersion() < base::win::VERSION_VISTA;

[felt, 2014/06/30 18:16:07]

is it correct that this includes VERSION_SERVER_2003?

[radhikabhar, 2014/07/01 23:56:49]

Changed it so that it directly compares with the version

[felt, 2014/07/02 18:11:57]

I can see it going either way. I don't know anything about VERSION_SERVER_2003,
but there is something in the enum that makes it sound like maybe it *should*
apply to VERSION_SERVER_2003 too. Can you ask wfh? I suspect he would know.

[radhikabhar, 2014/07/02 18:51:08]

Windows Server 2003 does not have support for SHA2 but it can be downloaded.
This link gives the details
http://blogs.technet.com/b/pki/archive/2010/09/30/sha2-and-windows.aspx. 
I have asked @wfh also and waiting for his reply. 

+  if (on_windows_xp) {
+    OSVERSIONINFOEX version_info = { sizeof version_info };
+    GetVersionEx(reinterpret_cast<OSVERSIONINFO*>(&version_info));

[felt, 2014/06/30 18:36:15]

I don't think you should be directly invoking ::GetVersionEx. Instead, it would
be better for you to use the OSInfo class:
https://code.google.com/p/chromium/codesearch#chromium/src/base/win/windows_v...

[radhikabhar, 2014/07/01 23:56:49]

Done.

+    if (version_info.wServicePackMajor < 3)
+      return true;
+  }
+  return false;

[felt, 2014/06/30 18:16:07]

I don't think you need "return false" twice

[radhikabhar, 2014/07/01 23:56:49]

Done.

+#endif
+  return false;
+}