When detecting client certs on OS X, ensure all certs match the server's CertificateRequest

net/base/x509_certificate_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 #include <time.h>
@@ skipping 1475 matching lines @@
       if ((*certs)[i]->fingerprint().Equals(fingerprint))
         break;
     }
     if (i < certs->size())
       continue;
 
     bool is_preferred = preferred_identity &&
         CFEqual(preferred_identity, identity);
 
     // Make sure the issuer matches valid_issuers, if given.
-    // But an explicit cert preference overrides this.
-    if (!is_preferred &&
-        !valid_issuers.empty() &&
-        !cert->IsIssuedBy(valid_issuers))
+    if (!valid_issuers.empty() && !cert->IsIssuedBy(valid_issuers))
       continue;
 
     // The cert passes, so add it to the vector.
     // If it's the preferred identity, add it at the start (so it'll be
     // selected by default in the UI.)
     if (is_preferred)
       certs->insert(certs->begin(), cert);
     else
       certs->push_back(cert);
   }
@@ skipping 116 matching lines @@
       *type = kPublicKeyTypeDH;
       break;
     default:
       *type = kPublicKeyTypeUnknown;
       *size_bits = 0;
       break;
   }
 }
 
 }  // namespace net