Add a check for server and CA certificates in device policies to the ONC validator.

chrome/browser/chromeos/cros/network_library_impl_base.cc

Index: chrome/browser/chromeos/cros/network_library_impl_base.cc
diff --git a/chrome/browser/chromeos/cros/network_library_impl_base.cc b/chrome/browser/chromeos/cros/network_library_impl_base.cc
index e96e862aff249c129c9d16833a86191e64d95a94..010929ecff1d7f5f5889674e468903e60161a338 100644
--- a/chrome/browser/chromeos/cros/network_library_impl_base.cc
+++ b/chrome/browser/chromeos/cros/network_library_impl_base.cc
@@ -1152,7 +1152,12 @@ bool NetworkLibraryImplBase::LoadOncNetworks(const std::string& onc_blob,
   if (has_certificates) {
     VLOG(2) << "ONC file has " << certificates->GetSize() << " certificates";
 
-    onc::CertificateImporter cert_importer(source, allow_web_trust_from_policy);
+    // Web trust is only granted to certificates imported for a managed user
+    // on a managed device and for user imports.
+    bool allow_web_trust =
+        (source == onc::ONC_SOURCE_USER_IMPORT) ||
+        (source == onc::ONC_SOURCE_USER_POLICY && allow_web_trust_from_policy);
+    onc::CertificateImporter cert_importer(allow_web_trust);
     if (cert_importer.ParseAndStoreCertificates(*certificates) !=
         onc::CertificateImporter::IMPORT_OK) {
       LOG(ERROR) << "Cannot parse some of the certificates in the ONC from "