Show the "cannot proceed" text only when appropriate.

content/browser/ssl/ssl_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/ssl/ssl_policy.h"
 
 #include "base/bind.h"
 #include "base/base_switches.h"
 #include "base/command_line.h"
 #include "base/memory/singleton.h"
@@ skipping 46 matching lines @@
   // The judgment is either DENIED or UNKNOWN.
   // For now we handle the DENIED as the UNKNOWN, which means a blocking
   // page is shown to the user every time he comes back to the page.
 
   switch (handler->cert_error()) {
     case net::ERR_CERT_COMMON_NAME_INVALID:
     case net::ERR_CERT_DATE_INVALID:
     case net::ERR_CERT_AUTHORITY_INVALID:
     case net::ERR_CERT_WEAK_SIGNATURE_ALGORITHM:
     case net::ERR_CERT_WEAK_KEY:
-      OnCertErrorInternal(handler, !handler->fatal());
+      OnCertErrorInternal(handler, !handler->fatal(), handler->fatal());
       break;
     case net::ERR_CERT_NO_REVOCATION_MECHANISM:
       // Ignore this error.
       handler->ContinueRequest();
       break;
     case net::ERR_CERT_UNABLE_TO_CHECK_REVOCATION:
       // We ignore this error but will show a warning status in the location
       // bar.
       handler->ContinueRequest();
       break;
     case net::ERR_CERT_CONTAINS_ERRORS:
     case net::ERR_CERT_REVOKED:
     case net::ERR_CERT_INVALID:
     case net::ERR_CERT_NOT_IN_DNS:
-      OnCertErrorInternal(handler, false);
+      OnCertErrorInternal(handler, false, handler->fatal());
       break;
     default:
       NOTREACHED();
       handler->CancelRequest();
       break;
   }
 }
 
 void SSLPolicy::DidRunInsecureContent(NavigationEntryImpl* entry,
                                       const std::string& security_origin) {
@@ skipping 94 matching lines @@
     backend_->DenyCertForHost(handler->ssl_info().cert,
                               handler->request_url().host());
     handler->CancelRequest();
   }
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // Certificate Error Routines
 
 void SSLPolicy::OnCertErrorInternal(SSLCertErrorHandler* handler,
-                                    bool overridable) {
+                                    bool overridable,
+                                    bool strict_enforcement) {
   if (handler->resource_type() != ResourceType::MAIN_FRAME) {
     // A sub-resource has a certificate error.  The user doesn't really
     // have a context for making the right decision, so block the
     // request hard, without an info bar to allow showing the insecure
     // content.
     handler->DenyRequest();
     return;
   }
 
   bool cancel_request = false;
   content::GetContentClient()->browser()->AllowCertificateError(
       handler->render_process_id(),
       handler->render_view_id(),
       handler->cert_error(),
       handler->ssl_info(),
       handler->request_url(),
       overridable,
+      strict_enforcement,
       base::Bind(&SSLPolicy::OnAllowCertificate, base::Unretained(this),
                  make_scoped_refptr(handler)),
       &cancel_request);
   if (cancel_request)
     handler->CancelRequest();
 }
 
 void SSLPolicy::InitializeEntryIfNeeded(NavigationEntryImpl* entry) {
   if (entry->GetSSL().security_style != content::SECURITY_STYLE_UNKNOWN)
     return;
 
   entry->GetSSL().security_style = entry->GetURL().SchemeIsSecure() ?
       content::SECURITY_STYLE_AUTHENTICATED :
       content::SECURITY_STYLE_UNAUTHENTICATED;
 }
 
 void SSLPolicy::OriginRanInsecureContent(const std::string& origin, int pid) {
   GURL parsed_origin(origin);
   if (parsed_origin.SchemeIsSecure())
     backend_->HostRanInsecureContent(parsed_origin.host(), pid);
 }