Wire up SSL client authentication for OpenSSL/Android through the net/ stack

net/socket/ssl_client_socket_openssl.cc

Index: net/socket/ssl_client_socket_openssl.cc
diff --git a/net/socket/ssl_client_socket_openssl.cc b/net/socket/ssl_client_socket_openssl.cc
index e14527cfb8d56d69219a7ebd1520ba736e46df8c..8ec3fc43d45e027a0a37c85ef46b7ac2881d203a 100644
--- a/net/socket/ssl_client_socket_openssl.cc
+++ b/net/socket/ssl_client_socket_openssl.cc
@@ -585,9 +585,13 @@ int SSLClientSocketOpenSSL::ClientCertRequestCallback(SSL* ssl,
 
   // Second pass: a client certificate should have been selected.
   if (ssl_config_.client_cert) {
-    EVP_PKEY* privkey = OpenSSLPrivateKeyStore::GetInstance()->FetchPrivateKey(
-        X509_PUBKEY_get(X509_get_X509_PUBKEY(
-            ssl_config_.client_cert->os_cert_handle())));
+    // A note about ownership: FetchClientCertPrivateKey() increments
+    // the reference count of the returned EVP_PKEY, which is later
+    // passed directly to OpenSSL. The library will later call
+    // EVP_PKEY_free() on it when the SSL object is destroyed.
+    EVP_PKEY* privkey =
+        OpenSSLPrivateKeyStore::GetInstance()->FetchClientCertPrivateKey(
+            *ssl_config_.client_cert.get());
     if (privkey) {
       // TODO(joth): (copied from NSS) We should wait for server certificate
       // verification before sending our credentials. See http://crbug.com/13934