Initial support for HSTS certificate locking. This isn't a finished work, but

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
@@ skipping 314 matching lines @@
   ParsePrincipal(cert_handle_, X509_get_issuer_name(cert_handle_), &issuer_);
   nxou::ParseDate(X509_get_notBefore(cert_handle_), &valid_start_);
   nxou::ParseDate(X509_get_notAfter(cert_handle_), &valid_expiry_);
 }
 
 // static
 void X509Certificate::ResetCertStore() {
   X509InitSingleton::GetInstance()->ResetCertStore();
 }
 
+// static
+void X509Certificate::GetCertChainFromCert(OSCertHandle cert_handle,
+                                           OSCertHandles* cert_handles) {
+  // TODO(bulach): how to get the chain out of a certificate?

[wtc, 2011/04/07 01:00:29]

I don't know.  Usually a certificate chain is a byproduct
of certificate verification.  But my quick search on this
topic didn't find anything.  Sorry.

+  cert_handles->push_back(net::X509Certificate::DupOSCertHandle(cert_handle));
+}
+
+// static
+void X509Certificate::DestroyCertChain(OSCertHandles* cert_handles) {
+  for (OSCertHandles::iterator i = cert_handles->begin();
+       i != cert_handles->end(); ++i)
+    X509_free(*i);
+  cert_handles->clear();
+}
+
 SHA1Fingerprint X509Certificate::CalculateFingerprint(OSCertHandle cert) {
   SHA1Fingerprint sha1;
   unsigned int sha1_size = static_cast<unsigned int>(sizeof(sha1.data));
   int ret = X509_digest(cert, EVP_sha1(), sha1.data, &sha1_size);
   CHECK(ret);
   CHECK_EQ(sha1_size, sizeof(sha1.data));
   return sha1;
 }
 
 // static
@@ skipping 150 matching lines @@
   // cache the DER (if not already cached via X509_set_ex_data).
   DERCache der_cache_a, der_cache_b;
 
   return GetDERAndCacheIfNeeded(a, &der_cache_a) &&
       GetDERAndCacheIfNeeded(b, &der_cache_b) &&
       der_cache_a.data_length == der_cache_b.data_length &&
       memcmp(der_cache_a.data, der_cache_b.data, der_cache_a.data_length) == 0;
 }
 
 } // namespace net