Index: net/quic/crypto/quic_crypto_client_config.cc |
diff --git a/net/quic/crypto/quic_crypto_client_config.cc b/net/quic/crypto/quic_crypto_client_config.cc |
index d00e67677df1c62763bf662f04d2c9ed28a8dc51..4ede2c6d812994d975e1d2876a0ba5c9ae383396 100644 |
--- a/net/quic/crypto/quic_crypto_client_config.cc |
+++ b/net/quic/crypto/quic_crypto_client_config.cc |
@@ -611,7 +611,12 @@ QuicErrorCode QuicCryptoClientConfig::CacheNewServerConfig( |
cached->SetProof(certs, proof); |
} else { |
- cached->ClearProof(); |
+ if (proof_verifier() != NULL) { |
+ // Secure QUIC: clear existing proof as we have been sent a new SCFG |
+ // without matching proof/certs. |
+ cached->ClearProof(); |
+ } |
+ |
if (has_proof && !has_cert) { |
*error_details = "Certificate missing"; |
return QUIC_INVALID_CRYPTO_MESSAGE_PARAMETER; |