Added a PolicyCertVerifier that uses the trust anchors from the ONC policies.

chrome/browser/policy/browser_policy_connector.cc

Index: chrome/browser/policy/browser_policy_connector.cc
diff --git a/chrome/browser/policy/browser_policy_connector.cc b/chrome/browser/policy/browser_policy_connector.cc
index 2b408f222250262099c1d1f6c1b443ec8af3f9a6..997e1870caac9d25aebad7d386cd29ac74d103cb 100644
--- a/chrome/browser/policy/browser_policy_connector.cc
+++ b/chrome/browser/policy/browser_policy_connector.cc
@@ -28,6 +28,7 @@
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
+#include "components/user_prefs/pref_registry_syncable.h"
 #include "content/public/browser/browser_thread.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 #include "google_apis/gaia/gaia_constants.h"
@@ -236,6 +237,8 @@ void BrowserPolicyConnector::Shutdown() {
   // Delete it first.
   app_pack_updater_.reset();
 
+  network_configuration_updater_.reset();
+
   if (device_cloud_policy_manager_)
     device_cloud_policy_manager_->Shutdown();
   if (device_local_account_policy_provider_)
@@ -304,7 +307,7 @@ void BrowserPolicyConnector::InitializeUserPolicy(
   // If the user is managed then importing certificates from ONC policy is
   // allowed, otherwise it's not. Update this flag once the user has signed in,
   // and before user policy is loaded.
-  GetNetworkConfigurationUpdater()->set_allow_web_trust(
+  GetNetworkConfigurationUpdater()->set_allow_trusted_certificates_from_policy(
       GetUserAffiliation(user_name) == USER_AFFILIATION_MANAGED);
 
   // Re-initializing user policy is disallowed for two reasons:
@@ -389,9 +392,7 @@ AppPackUpdater* BrowserPolicyConnector::GetAppPackUpdater() {
   }
   return app_pack_updater_.get();
 }
-#endif
 
-#if defined(OS_CHROMEOS)
 NetworkConfigurationUpdater*
     BrowserPolicyConnector::GetNetworkConfigurationUpdater() {
   if (!network_configuration_updater_) {
@@ -401,6 +402,11 @@ NetworkConfigurationUpdater*
   }
   return network_configuration_updater_.get();
 }
+
+net::CertTrustAnchorProvider*
+    BrowserPolicyConnector::GetCertTrustAnchorProvider() {
+  return GetNetworkConfigurationUpdater()->GetCertTrustAnchorProvider();
+}
 #endif
 
 void BrowserPolicyConnector::SetDeviceManagementServiceForTesting(
@@ -478,6 +484,15 @@ bool BrowserPolicyConnector::IsNonEnterpriseUser(const std::string& username) {
 }
 
 // static
+bool BrowserPolicyConnector::UsedPolicyCertificates(Profile* profile) {
+#if defined(OS_CHROMEOS)
+  if (profile->GetPrefs()->GetBoolean(prefs::kUsedPolicyCertificatesOnce))
+    return true;
+#endif
+  return false;
+}
+
+// static
 void BrowserPolicyConnector::RegisterPrefs(PrefRegistrySimple* registry) {
   registry->RegisterIntegerPref(prefs::kUserPolicyRefreshRate,
                                 kDefaultPolicyRefreshRateMs);
@@ -487,6 +502,15 @@ void BrowserPolicyConnector::RegisterPrefs(PrefRegistrySimple* registry) {
 #endif
 }
 
+// static
+void BrowserPolicyConnector::RegisterUserPrefs(PrefRegistrySyncable* registry) {
+#if defined(OS_CHROMEOS)
+  registry->RegisterBooleanPref(prefs::kUsedPolicyCertificatesOnce,
+                                false,
+                                PrefRegistrySyncable::UNSYNCABLE_PREF);
+#endif
+}
+
 void BrowserPolicyConnector::SetTimezoneIfPolicyAvailable() {
 #if defined(OS_CHROMEOS)
   typedef chromeos::CrosSettingsProvider Provider;