IgnoreCertError should check if the error is a certificate error.

net/socket/ssl_client_socket.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket.h"
 
 #include "base/metrics/histogram.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/strings/string_util.h"
 #include "crypto/ec_private_key.h"
 #include "net/base/connection_type_histograms.h"
 #include "net/base/host_port_pair.h"
+#include "net/base/net_errors.h"
 #include "net/ssl/channel_id_service.h"
 #include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_config_service.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 
 namespace net {
 
 SSLClientSocket::SSLClientSocket()
     : was_npn_negotiated_(false),
       was_spdy_negotiated_(false),
@@ skipping 71 matching lines @@
 
 bool SSLClientSocket::WasNpnNegotiated() const {
   return was_npn_negotiated_;
 }
 
 NextProto SSLClientSocket::GetNegotiatedProtocol() const {
   return protocol_negotiated_;
 }
 
 bool SSLClientSocket::IgnoreCertError(int error, int load_flags) {
-  return error == OK || (load_flags & LOAD_IGNORE_ALL_CERT_ERRORS);
+  if (error == OK)
+    return true;
+  return (load_flags & LOAD_IGNORE_ALL_CERT_ERRORS) &&
+         IsCertificateError(error);
 }
 
 bool SSLClientSocket::set_was_npn_negotiated(bool negotiated) {
   return was_npn_negotiated_ = negotiated;
 }
 
 bool SSLClientSocket::was_spdy_negotiated() const {
   return was_spdy_negotiated_;
 }
 
@@ skipping 146 matching lines @@
     } else {
       sample += 500;
     }
   } else {
     DCHECK_EQ(kExtensionALPN, negotiation_extension_);
   }
   UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSLProtocolNegotiation", sample);
 }
 
 }  // namespace net