Parse an application/x-x509-user-cert response with

net/base/cert_database_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
@@ skipping 58 matching lines @@
     slot = PK11_ImportCertForKey(
         cert,
         cert_obj->GetDefaultNickname(net::USER_CERT).c_str(),
         NULL);
   }
 
   if (!slot) {
     LOG(ERROR) << "Couldn't import user certificate.";
     return ERR_ADD_USER_CERT_FAILED;
   }
+  const X509Certificate::OSCertHandles& intermediate_certs =
+      cert_obj->GetIntermediateCertificates();
+  for (size_t i = 0; i < intermediate_certs.size(); ++i) {
+    CERTCertificate* intermediate_cert = intermediate_certs[i];
+    // TODO(wtc): skip intermediate_cert if it is a self-signed root cert?
+    // It is not useful to import a root cert without trust settings.
+    char* nickname = CERT_MakeCANickname(intermediate_cert);
+    PK11_ImportCert(slot, intermediate_cert, CK_INVALID_HANDLE, nickname,
+                    PR_FALSE);
+    PORT_Free(nickname);
+  }
   PK11_FreeSlot(slot);
   CertDatabase::NotifyObserversOfUserCertAdded(cert_obj);
   return OK;
 }
 
 void CertDatabase::ListCerts(CertificateList* certs) {
   certs->clear();
 
   CERTCertList* cert_list = PK11_ListCerts(PK11CertListUnique, NULL);
   CERTCertListNode* node;
@@ skipping 224 matching lines @@
 
   return true;
 }
 
 bool CertDatabase::IsReadOnly(const X509Certificate* cert) const {
   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
   return slot && PK11_IsReadOnly(slot);
 }
 
 }  // namespace net