Mark SHA-1 as deprecated

content/browser/ssl/ssl_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/ssl/ssl_policy.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/memory/singleton.h"
@@ skipping 91 matching lines @@
 
   backend_->HostRanInsecureContent(GURL(security_origin).host(),
                                    site_instance->GetProcess()->GetID());
 }
 
 void SSLPolicy::OnRequestStarted(SSLRequestInfo* info) {
   // TODO(abarth): This mechanism is wrong.  What we should be doing is sending
   // this information back through WebKit and out some FrameLoaderClient
   // methods.
 
-  if (net::IsCertStatusError(info->ssl_cert_status()))
+  if (net::IsCertStatusError(info->ssl_cert_status()) &&
+      !net::IsCertStatusMinorError(info->ssl_cert_status())) {

[Ryan Sleevi, 2014/09/24 02:50:36]

This allows the following three errors to NOT be treated as mixed content

Unable to check revocation
No revocation mechanism
SHA-1

1&2 are treated as hard failures by enterprise policy, otherwise we'd never set
them. The latter seems correct - for now :)

[palmer, 2014/09/26 19:15:04]

Agree.

     backend_->HostRanInsecureContent(info->url().host(), info->child_id());
+  }
 }
 
 void SSLPolicy::UpdateEntry(NavigationEntryImpl* entry,
                             WebContentsImpl* web_contents) {
   DCHECK(entry);
 
   InitializeEntryIfNeeded(entry);
 
   if (!entry->GetURL().SchemeIsSecure())
     return;
@@ skipping 107 matching lines @@
       SECURITY_STYLE_AUTHENTICATED : SECURITY_STYLE_UNAUTHENTICATED;
 }
 
 void SSLPolicy::OriginRanInsecureContent(const std::string& origin, int pid) {
   GURL parsed_origin(origin);
   if (parsed_origin.SchemeIsSecure())
     backend_->HostRanInsecureContent(parsed_origin.host(), pid);
 }
 
 }  // namespace content