Initial support for HSTS certificate locking. This isn't a finished work, but

net/base/x509_certificate_nss.cc

Index: net/base/x509_certificate_nss.cc
===================================================================
--- net/base/x509_certificate_nss.cc	(revision 80507)
+++ net/base/x509_certificate_nss.cc	(working copy)
@@ -949,6 +949,28 @@
 }
 
 // static
+void X509Certificate::GetCertChainFromCert(OSCertHandle cert_handle,
+                                           OSCertHandles* cert_handles) {
+  CERTCertList* cert_list =
+      CERT_GetCertChainFromCert(cert_handle, PR_Now(), certUsageSSLServer);

[wtc, 2011/04/07 01:00:29]

The certificate chain is readily available in the Verify()
method.  It is best to get the certificate chain in Verify().

+  CERTCertListNode* node;
+  for (node = CERT_LIST_HEAD(cert_list);
+       !CERT_LIST_END(node, cert_list);
+       node = CERT_LIST_NEXT(node)) {
+    cert_handles->push_back(CERT_DupCertificate(node->cert));
+  }
+  CERT_DestroyCertList(cert_list);
+}
+
+// static
+void X509Certificate::DestroyCertChain(OSCertHandles* cert_handles) {
+  for (OSCertHandles::iterator i(cert_handles->begin());
+       i != cert_handles->end(); ++i)
+    CERT_DestroyCertificate(*i);
+  cert_handles->clear();
+}
+
+// static
 SHA1Fingerprint X509Certificate::CalculateFingerprint(
     OSCertHandle cert) {
   SHA1Fingerprint sha1;