The URLRequestContext for off-the-record mode should...

chrome/browser/net/chrome_url_request_context.cc

Index: chrome/browser/net/chrome_url_request_context.cc
===================================================================
--- chrome/browser/net/chrome_url_request_context.cc	(revision 69414)
+++ chrome/browser/net/chrome_url_request_context.cc	(working copy)
@@ -402,9 +402,10 @@
 
   IOThread::Globals* io_thread_globals = io_thread()->globals();
 
-  // Share the same proxy service, host resolver, and http_auth_handler_factory
-  // as the original profile.
+  // Share the same proxy service, host resolver, cert verifier,
+  // and http_auth_handler_factory as the original profile.
   context->set_host_resolver(original_context->host_resolver());
+  context->set_cert_verifier(original_context->cert_verifier());

[wtc, 2010/12/17 01:11:42]

agl: I noticed that you don't copy original_context->dnsrr_resolver()
here, and you pass NULL as dns_cert_checker to
new net::HttpCache() at line 420 below.

Is that intentional or an oversight?

   context->set_proxy_service(original_context->proxy_service());
   context->set_http_auth_handler_factory(
       original_context->http_auth_handler_factory());