Move client certificates retrieval logic out of the SSL sockets.

content/browser/loader/resource_loader.cc

Index: content/browser/loader/resource_loader.cc
diff --git a/content/browser/loader/resource_loader.cc b/content/browser/loader/resource_loader.cc
index a45229ee70ec4df164d8686cd132b5e862d3ae64..15f9cad8463793857c1b9099f1e99638d9ec79f9 100644
--- a/content/browser/loader/resource_loader.cc
+++ b/content/browser/loader/resource_loader.cc
@@ -21,6 +21,8 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/resource_response.h"
 #include "content/public/common/url_constants.h"
+#include "net/base/client_cert_store.h"
+#include "net/base/client_cert_store_impl.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_response_headers.h"
 #include "webkit/appcache/appcache_interceptor.h"
@@ -65,6 +67,9 @@ ResourceLoader::ResourceLoader(scoped_ptr<net::URLRequest> request,
       last_upload_position_(0),
       waiting_for_upload_progress_ack_(false),
       is_transferring_(false),
+#if defined(USE_NSS) && !defined(OS_IOS)

[Ryan Sleevi, 2013/01/30 19:54:51]

This is the wrong use of the define. USE_NSS == "Use NSS for certificate
validation", not "Use NSS for crypto"

Pretty sure this conditional should be:
#if !defined(USE_OPENSSL)

[ppi, 2013/02/01 22:22:34]

Thanks! Fixed in patch set 6.

+      client_cert_store_(new net::ClientCertStoreImpl()),
+#endif
       weak_ptr_factory_(this) {
   request_->set_delegate(this);
   handler_->SetController(this);
@@ -269,6 +274,10 @@ void ResourceLoader::OnCertificateRequested(
     return;
   }
 
+#if defined(USE_NSS) && !defined(OS_IOS)
+  client_cert_store_->GetClientCerts(*cert_info, &cert_info->client_certs);
+#endif
+
   if (cert_info->client_certs.empty()) {
     // No need to query the user if there are no certs to choose from.
     request_->ContinueWithCertificate(NULL);