Perform online revocation checks when EV certificates aren't covered by a fresh CRLSet.
Previously a fresh CRLSet was sufficient to suppress online revocation checking
for EV certificates because we aimed to have full EV coverage in the CRLSet.
With this change, we'll only suppress online revocation checking for EV
certificates when a fresh CRLSet actually covers the chain in question. We
determine coverage by seeing if the CRLSet contains the issuer SPKI.
There are no changes to the OS X certificate code as I believe that OS X
already does online revocation checking for EV certs no matter what we do in
Chrome.
BUG=none
Review URL: https://chromiumcodereview.appspot.com/11260018
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@214825 0039d316-1c4b-4281-b951-d872f2087c98
diff --git a/net/cert/cert_verify_proc_unittest.cc b/net/cert/cert_verify_proc_unittest.cc
index 21b1439..21f79d60 100644
--- a/net/cert/cert_verify_proc_unittest.cc
+++ b/net/cert/cert_verify_proc_unittest.cc
@@ -155,7 +155,7 @@
X509Certificate::CreateFromHandle(certs[0]->os_cert_handle(),
intermediates);
- scoped_refptr<CRLSet> crl_set(CRLSet::EmptyCRLSetForTesting());
+ scoped_refptr<CRLSet> crl_set(CRLSet::ForTesting(false, NULL, ""));
CertVerifyResult verify_result;
int flags = CertVerifier::VERIFY_EV_CERT;
int error = Verify(comodo_chain.get(),
