Mark untrusted certificates as such in Linux UI.

net/base/cert_database_nss.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
@@ skipping 218 matching lines @@
           trust.HasTrustedCA(PR_FALSE, PR_FALSE, PR_TRUE) * TRUSTED_OBJ_SIGN;
     case SERVER_CERT:
       return trust.HasTrustedPeer(PR_TRUE, PR_FALSE, PR_FALSE) * TRUSTED_SSL +
           trust.HasTrustedPeer(PR_FALSE, PR_TRUE, PR_FALSE) * TRUSTED_EMAIL +
           trust.HasTrustedPeer(PR_FALSE, PR_FALSE, PR_TRUE) * TRUSTED_OBJ_SIGN;
     default:
       return UNTRUSTED;
   }
 }
 
+bool CertDatabase::IsUntrusted(const X509Certificate* cert) const {
+  CERTCertTrust nsstrust;
+  SECStatus rv = CERT_GetCertTrust(cert->os_cert_handle(), &nsstrust);
+  if (rv != SECSuccess) {
+    LOG(ERROR) << "CERT_GetCertTrust failed with error " << PORT_GetError();
+    return false;
+  }
+
+  return nsstrust.sslFlags == 0 &&
+         nsstrust.emailFlags == 0 &&
+         nsstrust.objectSigningFlags == 0;

[wtc, 2011/06/29 00:30:45]

I believe this is correct only for root certs.

(Note: the trusts for the IPS roots were removed in
https://bugzilla.mozilla.org/show_bug.cgi?id=530853.)

For non-root certs, I think we will need code similar to
the CERT_CheckLeafTrust function in Bob Relyea's patch
https://bug642503.bugzilla.mozilla.org/attachment.cgi?id=527127
in the NSS bug
https://bugzilla.mozilla.org/show_bug.cgi?id=642503

Specifically, we need to test if the
CERTDB_TERMINAL_RECORD bit (formerly named
CERTDB_VALID_PEER) is set.

nsstrust.sslFlags == 0 for a non-root cert actually means it
derives its trust from its CA.

Two important test cases for non-root certs are:
https://bugzilla.mozilla.org/show_bug.cgi?id=471715
https://bugzilla.mozilla.org/show_bug.cgi?id=642815

I will ask Bob Relyea (an NSS developer) about this.

[mattm, 2011/06/29 01:12:07]

Maybe we should only check the sslFlags?  If for some reason a cert is untrusted
for SSL but still trusted for other things we'd probably still want to display
the badge since we only use SSL trust, right?

+}
+
 bool CertDatabase::SetCertTrust(const X509Certificate* cert,
                                 CertType type,
                                 unsigned int trusted) {
   bool success = psm::SetCertTrust(cert, type, trusted);
   if (success)
     CertDatabase::NotifyObserversOfCertTrustChanged(cert);
 
   return success;
 }
 
@@ skipping 19 matching lines @@
   }
   return true;
 }
 
 bool CertDatabase::IsReadOnly(const X509Certificate* cert) const {
   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
   return slot && PK11_IsReadOnly(slot);
 }
 
 }  // namespace net