From discussion in https://codereview.chromium.org/1903453003/:

On 2016/04/20 22:45:03, Ryan Sleevi wrote:
> I'm not comfortable with this fix; it papers over the root issue, and as a
> result, causes the test not to cover what it's meant to test.
> 
> In this case, I'd be more comfortable if you disabled the test, and filed a bug
> - because then it's at least clear this test is missing coverage.

On 2016/04/20 23:03:35, davidben wrote:
> Is there actually anything to file a bug about? It seems newer iOS SDKs behave
> correctly and while older ones didn't. (I'd buy skipping the test in the old SDK
> case though.)


On 2016/04/20 23:13:44, Ryan Sleevi wrote:
> No, the newer SDKs behave incorrectly - they're treating it as a "CA trust
> issue", rather than an "invalid certificate issue". This suggests that the
> issuing CA is no longer trusted (perhaps a lack of intermediates to chain to a
> newer root), rather than as being a fundamental encoding issue. That's the
> concern - we're no longer sure we're actually testing the certificate as
> rejected, but instead that the CA is not trusted - which means we're not
> actually sure that an (otherwise trusted) embedded-null cert would be rejected.
> 
> One approach to fix this would be to generate a local CA with a
> forcibly-embedded NUL, rather than relying on the current test certificate
> (which can cause issues like this when the underlying root store changes, as it
> did)

On 2016/04/20 at 23:19:07, davidben wrote:
> I see. Then we should have filed a bug ages ago, no? The non-simulator case
> (what we actually care about), Mac, and Windows already all use
> ERR_CERT_AUTHORITY_INVALID (line 241 on the RHS). It's just NSS that was doing
> anything different before this iOS codepath.
> 
> The new SDK's simulator is correct in that it correctly matches the real result.

On 2016/04/20 at 23:20:48, rsleevi wrote:
> Correct, we should have.
> 
> Right, it appears this test was inappropriately "fixed" (based on the real world)
> to no longer cover what it was supposed to be testing.