Remember the intermediate CA certs if the server sends them to us....

net/base/ssl_client_socket_nss.h

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_SSL_CLIENT_SOCKET_NSS_H_
 #define NET_BASE_SSL_CLIENT_SOCKET_NSS_H_
 
+// Work around https://bugzilla.mozilla.org/show_bug.cgi?id=455424
+// until NSS 3.12.2 comes out and we update to it.
+#define Lock FOO_NSS_Lock
+#include <certt.h>
+#undef Lock
 #include <nspr.h>
 #include <nss.h>
 #include <string>
 
 #include "base/scoped_ptr.h"
 #include "net/base/completion_callback.h"
 #include "net/base/nss_memio.h"
 #include "net/base/ssl_client_socket.h"
 #include "net/base/ssl_config_service.h"
 
@@ skipping 65 matching lines @@
 
   // Used by both Read and Write functions.
   scoped_refptr<IOBuffer> user_buf_;
   int user_buf_len_;
 
   // Set when handshake finishes.  Value is net error code, see net_errors.h
   int server_cert_error_;
 
   // Set during handshake.
   scoped_refptr<X509Certificate> server_cert_;
+  // Certificate chain.
+  CERTCertList* cert_list_;
 
   bool completed_handshake_;
 
   enum State {
     STATE_NONE,
     STATE_HANDSHAKE_READ,
     // No STATE_HANDSHAKE_READ_COMPLETE needed, go to STATE_NONE instead.
     STATE_PAYLOAD_WRITE,
     STATE_PAYLOAD_READ,
   };
   State next_state_;
 
   // The NSS SSL state machine
   PRFileDesc* nss_fd_;
 
   // Buffers for the network end of the SSL state machine
   memio_Private* nss_bufs_;
 
   static bool nss_options_initialized_;
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_SSL_CLIENT_SOCKET_NSS_H_