Add a check for server and CA certificates in device policies to the ONC validator.

chrome/browser/chromeos/cros/network_library_impl_base.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/cros/network_library_impl_base.h"
 
 #include "base/bind.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_writer.h"
 #include "base/memory/scoped_vector.h"
@@ skipping 1134 matching lines @@
           &certificates);
 
   const base::ListValue* network_configs;
   bool has_network_configurations = root_dict->GetListWithoutPathExpansion(
       onc::toplevel_config::kNetworkConfigurations,
       &network_configs);
 
   if (has_certificates) {
     VLOG(2) << "ONC file has " << certificates->GetSize() << " certificates";
 
-    onc::CertificateImporter cert_importer(source, allow_web_trust_from_policy);
+    // Web trust is only granted to certificates imported for a managed user
+    // on a managed device and for user imports.
+    bool allow_web_trust =
+        (source == onc::ONC_SOURCE_USER_IMPORT) ||
+        (source == onc::ONC_SOURCE_USER_POLICY && allow_web_trust_from_policy);
+    onc::CertificateImporter cert_importer(allow_web_trust);
     if (cert_importer.ParseAndStoreCertificates(*certificates) !=
         onc::CertificateImporter::IMPORT_OK) {
       LOG(ERROR) << "Cannot parse some of the certificates in the ONC from "
                  << onc::GetSourceAsString(source);
       success = false;
     }
   }
 
   std::set<std::string> removal_ids;
   std::set<std::string>& network_ids(network_source_map_[source]);
@@ skipping 628 matching lines @@
   GetTpmInfo();
   return tpm_slot_;
 }
 
 const std::string& NetworkLibraryImplBase::GetTpmPin() {
   GetTpmInfo();
   return tpm_pin_;
 }
 
 }  // namespace chromeos