When detecting client certs on OS X, ensure all certs match the server's CertificateRequest

net/base/x509_certificate_mac.cc

Index: net/base/x509_certificate_mac.cc
diff --git a/net/base/x509_certificate_mac.cc b/net/base/x509_certificate_mac.cc
index 1f8103f08be21aaf14ee51741fcf99c4388c0e3c..9103152ec85445f6c615b9ba374938cde94af03f 100644
--- a/net/base/x509_certificate_mac.cc
+++ b/net/base/x509_certificate_mac.cc
@@ -1493,10 +1493,7 @@ bool X509Certificate::GetSSLClientCertificates(
         CFEqual(preferred_identity, identity);
 
     // Make sure the issuer matches valid_issuers, if given.
-    // But an explicit cert preference overrides this.
-    if (!is_preferred &&
-        !valid_issuers.empty() &&
-        !cert->IsIssuedBy(valid_issuers))
+    if (!valid_issuers.empty() && !cert->IsIssuedBy(valid_issuers))
       continue;
 
     // The cert passes, so add it to the vector.