Fix imported server certs being distrusted in NSS 3.13.

chrome/browser/ui/webui/options2/certificate_manager_handler2.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/options2/certificate_manager_handler2.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/file_util.h"  // for FileAccessProvider
 #include "base/memory/scoped_vector.h"
@@ skipping 800 matching lines @@
     ImportExportCleanup();
     ShowError(
         l10n_util::GetStringUTF8(IDS_CERT_MANAGER_SERVER_IMPORT_ERROR_TITLE),
         l10n_util::GetStringUTF8(IDS_CERT_MANAGER_CERT_PARSE_ERROR));
     return;
   }
 
   net::CertDatabase::ImportCertFailureList not_imported;
   bool result = certificate_manager_model_->ImportServerCert(
       selected_cert_list_,
+      net::CertDatabase::UNTRUSTED,  // TODO(mattm): Add UI for trust.
       &not_imported);
   if (!result) {
     ShowError(
         l10n_util::GetStringUTF8(IDS_CERT_MANAGER_SERVER_IMPORT_ERROR_TITLE),
         l10n_util::GetStringUTF8(IDS_CERT_MANAGER_UNKNOWN_ERROR));
   } else if (!not_imported.empty()) {
     ShowImportErrors(
         l10n_util::GetStringUTF8(IDS_CERT_MANAGER_SERVER_IMPORT_ERROR_TITLE),
         not_imported);
   }
@@ skipping 58 matching lines @@
   fail |= !CallbackArgsToBool(args, 0, &trust_ssl);
   fail |= !CallbackArgsToBool(args, 1, &trust_email);
   fail |= !CallbackArgsToBool(args, 2, &trust_obj_sign);
   if (fail) {
     LOG(ERROR) << "ImportCATrustSelected args fail";
     ImportExportCleanup();
     web_ui()->CallJavascriptFunction("CertificateEditCaTrustOverlay.dismiss");
     return;
   }
 
+  // TODO(mattm): add UI for setting explicit distrust, too.
   net::CertDatabase::ImportCertFailureList not_imported;
   bool result = certificate_manager_model_->ImportCACerts(
       selected_cert_list_,
       trust_ssl * net::CertDatabase::TRUSTED_SSL +
           trust_email * net::CertDatabase::TRUSTED_EMAIL +
           trust_obj_sign * net::CertDatabase::TRUSTED_OBJ_SIGN,
       &not_imported);
   web_ui()->CallJavascriptFunction("CertificateEditCaTrustOverlay.dismiss");
   if (!result) {
     ShowError(
@@ skipping 148 matching lines @@
   web_ui()->CallJavascriptFunction("CertificateManager.onCheckTpmTokenReady",
                                    ready);
 }
 #endif
 
 gfx::NativeWindow CertificateManagerHandler::GetParentWindow() const {
   return web_ui()->GetWebContents()->GetView()->GetTopLevelNativeWindow();
 }
 
 }  // namespace options2