Add client-side support for the origin bound certificate TLS extension.

net/socket/ssl_client_socket_nss.cc

Index: net/socket/ssl_client_socket_nss.cc
===================================================================
--- net/socket/ssl_client_socket_nss.cc	(revision 91902)
+++ net/socket/ssl_client_socket_nss.cc	(working copy)
@@ -957,6 +957,12 @@
     LogFailedNSSFunction(net_log_, "SSL_OptionSet", "SSL_ENABLE_CACHED_INFO");
 #endif
 
+#ifdef SSL_ENABLE_OB_CERTS
+  rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_OB_CERTS, PR_TRUE);

[wtc, 2011/07/13 22:13:47]

Sorry I didn't get it when you asked me about the PR_TRUE
argument here.  We should use a ssl_config_.ob_certs_enabled
option until the new code is ready to be turned on by default.

You can pass PR_FALSE for now to disable this.

+  if (rv != SECSuccess)
+    LogFailedNSSFunction(net_log_, "SSL_OptionSet", "SSL_ENABLE_OB_CERTS");
+#endif
+
   rv = SSL_OptionSet(nss_fd_, SSL_HANDSHAKE_AS_CLIENT, PR_TRUE);
   if (rv != SECSuccess) {
     LogFailedNSSFunction(net_log_, "SSL_OptionSet", "SSL_HANDSHAKE_AS_CLIENT");