* Change logic of SpdySession::VerifyDomainAuthentication to

net/spdy/spdy_session.cc

Index: net/spdy/spdy_session.cc
diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc
index 7610c9c7f740ab5389a9a519f670711f889e954c..f9238ecbe61ca19e429ae7f8464a3773757e0851 100644
--- a/net/spdy/spdy_session.cc
+++ b/net/spdy/spdy_session.cc
@@ -435,7 +435,10 @@ bool SpdySession::VerifyDomainAuthentication(const std::string& domain) {
     return true;   // This is not a secure session, so all domains are okay.
 
   return !ssl_info.client_cert_sent &&
-      (g_enable_credential_frames || !ssl_info.channel_id_sent) &&
+      (g_enable_credential_frames || !ssl_info.channel_id_sent ||
+       ServerBoundCertService::GetDomainForHost(domain) ==
+       ServerBoundCertService::GetDomainForHost(
+           host_port_proxy_pair_.first.host())) &&

[wtc, 2012/09/19 22:42:35]

It would be useful to add a comment to explain this new test.

If the new host name is in the same subdomain, then it shares
the same channel ID and therefore we don't need to send a
CREDENTIAL frame for the new host name.

       ssl_info.cert->VerifyNameMatch(domain);
 }