sslutil: more helpful fingerprint mismatch message

This will aid debugging for users of sites that renew certs.

mercurial/sslutil.py

@@ -122,8 +122,9 b' class validator(object):'
         if hostfingerprint:
             if peerfingerprint.lower() != \
                     hostfingerprint.replace(':', '').lower():
-                raise util.Abort(_('invalid certificate for %s with '
-                                   'fingerprint %s') % (host, nicefingerprint))
+                raise util.Abort(_('certificate for %s has unexpected '
+                                   'fingerprint %s') % (host, nicefingerprint),
+                                 hint=_('check hostfingerprint configuration'))
             self.ui.debug('%s certificate matched fingerprint %s\n' %
                           (host, nicefingerprint))
         elif cacerts:

tests/test-https.t

@@ -225,7 +225,8 b' Fingerprints'
 
 - fails when cert doesn't match hostname (port is ignored)
   $ hg -R copy-pull id https://localhost:$HGPORT1/
-  abort: invalid certificate for localhost with fingerprint 28:ff:71:bf:65:31:14:23:ad:62:92:b4:0e:31:99:18:fc:83:e3:9b
+  abort: certificate for localhost has unexpected fingerprint 28:ff:71:bf:65:31:14:23:ad:62:92:b4:0e:31:99:18:fc:83:e3:9b
+  (check hostfingerprint configuration)
   [255]
 
 - ignores that certificate doesn't match hostname