Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chrome/browser/profiles/profile_io_data.cc

Index: chrome/browser/profiles/profile_io_data.cc
diff --git a/chrome/browser/profiles/profile_io_data.cc b/chrome/browser/profiles/profile_io_data.cc
index 35f0a2fbd9da150d0d5d1b7d36a6b54232f02307..e41410af86994a8a8eb42e9d403ba7a3ea8f46c3 100644
--- a/chrome/browser/profiles/profile_io_data.cc
+++ b/chrome/browser/profiles/profile_io_data.cc
@@ -58,6 +58,7 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/resource_context.h"
 #include "extensions/common/constants.h"
+#include "net/base/cert_verifier.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/cookies/cookie_monster.h"
 #include "net/http/http_transaction_factory.h"
@@ -82,9 +83,12 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/drive/drive_protocol_handler.h"
+#include "chrome/browser/chromeos/policy/network_configuration_updater.h"
+#include "chrome/browser/chromeos/policy/policy_cert_verifier.h"
 #include "chrome/browser/chromeos/proxy_config_service_impl.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/chromeos/settings/cros_settings_names.h"
+#include "chrome/browser/policy/browser_policy_connector.h"
 #endif  // defined(OS_CHROMEOS)
 
 using content::BrowserContext;
@@ -263,6 +267,12 @@ void ProfileIOData::InitializeOnUIThread(Profile* profile) {
   params->managed_mode_url_filter =
       managed_user_service->GetURLFilterForIOThread();
 #endif
+#if defined(OS_CHROMEOS)
+  policy::BrowserPolicyConnector* connector =
+      g_browser_process->browser_policy_connector();
+  params->trust_anchor_provider =
+      connector->GetNetworkConfigurationUpdater()->GetCertTrustAnchorProvider();

[pneubeck (no reviews), 2013/03/26 10:01:25]

seeing these many levels of nesting, should we better add a
  GetCertTrustAnchorProvider()
function to the browser_policy_connector, too?
That would break the dependency from here to the NetConfUpd

[Joao da Silva, 2013/03/31 19:22:14]

Good idea, done.

+#endif
 
   params->profile = profile;
   profile_params_.reset(params.release());
@@ -372,6 +382,9 @@ ProfileIOData::ProfileParams::ProfileParams()
 #if defined(ENABLE_NOTIFICATIONS)
       notification_service(NULL),
 #endif
+#if defined(OS_CHROMEOS)
+      trust_anchor_provider(NULL),
+#endif
       profile(NULL) {
 }
 
@@ -694,6 +707,15 @@ void ProfileIOData::Init(content::ProtocolHandlerMap* protocol_handlers) const {
   managed_mode_url_filter_ = profile_params_->managed_mode_url_filter;
 #endif
 
+#if defined(OS_CHROMEOS)
+  cert_verifier_.reset(new policy::PolicyCertVerifier(
+      profile_params_->profile, profile_params_->trust_anchor_provider));
+  main_request_context_->set_cert_verifier(cert_verifier_.get());
+#else
+  main_request_context_->set_cert_verifier(
+      io_thread_globals->cert_verifier.get());
+#endif
+
   InitializeInternal(profile_params_.get(), protocol_handlers);
 
   profile_params_.reset();