Include both certificate chains in invalid cert reporting

net/ssl/ssl_info.h

Index: net/ssl/ssl_info.h
diff --git a/net/ssl/ssl_info.h b/net/ssl/ssl_info.h
index 154c4a0e901bbfd8b60e73b99e35e6297c8f8e96..43ae22c3d0c290a3be777d6d9ce417694768a8c4 100644
--- a/net/ssl/ssl_info.h
+++ b/net/ssl/ssl_info.h
@@ -48,6 +48,10 @@ class NET_EXPORT SSLInfo {
   // The SSL certificate.
   scoped_refptr<X509Certificate> cert;
 
+  // The SSL certificate with unverified certificate chain as sent by
+  // the server.
+  scoped_refptr<X509Certificate> unverified_server_cert;

[Ryan Sleevi, 2015/02/25 23:15:41]

the _server_ seems redundant here.

[Ryan Sleevi, 2015/02/25 23:15:41]

There's a problem here, which is that HttpResponseInfo contains an SSLInfo

HttpResponseInfo is our entry point into a responses information, and it's also
a stable object persisted to disk. That is, when synthesizing responses from the
cache, all of an HttpResponseInfo must be filled "as if" it was received over
the network.

This creates a problem, in that
1) Existing cached resources won't contain this information
2) We'll now have to start caching these unverified certs to disk (in addition
to the verified cert) in order to meet the //net API contracts that disk-served
resources are 'as good as' their from-the-network counterparts.

Thus, |unverified_server_cert| can be NULL, and a fair bit of the rest of the CL
falls over on the assumption that it must never be null.

+
   // Bitmask of status info of |cert|, representing, for example, known errors
   // and extended validation (EV) status.
   // See cert_status_flags.h for values.