Mark SHA-1 as deprecated

content/browser/ssl/ssl_policy.cc

Index: content/browser/ssl/ssl_policy.cc
diff --git a/content/browser/ssl/ssl_policy.cc b/content/browser/ssl/ssl_policy.cc
index 51ae7b2a1c800cdcf7e648869783d60277a08381..09537efb439506fd700eb3e80a3c05938126714b 100644
--- a/content/browser/ssl/ssl_policy.cc
+++ b/content/browser/ssl/ssl_policy.cc
@@ -109,8 +109,10 @@ void SSLPolicy::OnRequestStarted(SSLRequestInfo* info) {
   // this information back through WebKit and out some FrameLoaderClient
   // methods.
 
-  if (net::IsCertStatusError(info->ssl_cert_status()))
+  if (net::IsCertStatusError(info->ssl_cert_status()) &&
+      !net::IsCertStatusMinorError(info->ssl_cert_status())) {

[Ryan Sleevi, 2014/09/24 02:50:36]

This allows the following three errors to NOT be treated as mixed content

Unable to check revocation
No revocation mechanism
SHA-1

1&2 are treated as hard failures by enterprise policy, otherwise we'd never set
them. The latter seems correct - for now :)

[palmer, 2014/09/26 19:15:04]

Agree.

     backend_->HostRanInsecureContent(info->url().host(), info->child_id());
+  }
 }
 
 void SSLPolicy::UpdateEntry(NavigationEntryImpl* entry,