Adds CreateSelfSignedCertEC to x509_util.h in preparation of persistent DTLS identity store for Web…

net/cert/x509_util_nss_unittest.cc

Index: net/cert/x509_util_nss_unittest.cc
diff --git a/net/cert/x509_util_nss_unittest.cc b/net/cert/x509_util_nss_unittest.cc
index 968cc147ec505ecd3d7ef408bb7854144a93c044..59c2da544500b4c7e05b385cc7568e8d6c6cd178 100644
--- a/net/cert/x509_util_nss_unittest.cc
+++ b/net/cert/x509_util_nss_unittest.cc
@@ -139,6 +139,25 @@ void VerifyDomainBoundCert(const std::string& domain,
   PORT_FreeArena(arena, PR_FALSE);
 }
 
+void VerifySelfSignedCert(const std::string& common_name,
+                          const std::string& der_cert) {
+  // This test is run on Mac and Win where X509Certificate::os_cert_handle isn't
+  // an NSS type, so we have to manually create a NSS certificate object so we
+  // can use CERT_FindCertExtension.  We also check the subject and validity
+  // times using NSS since X509Certificate will fail with EC certs on OSX 10.5
+  // (http://crbug.com/101231).
+  CERTCertificate* nss_cert = CreateNSSCertHandleFromBytes(
+      der_cert.data(), der_cert.size());
+
+  char* actual = CERT_GetCommonName(&nss_cert->subject);
+  ASSERT_TRUE(actual);
+  EXPECT_STREQ(common_name.data(), actual);
+  PORT_Free(actual);
+  EXPECT_EQ(SECSuccess, CERT_CertTimesValid(nss_cert));
+
+  CERT_DestroyCertificate(nss_cert);
+}
+
 }  // namespace
 
 // This test creates a domain-bound cert from an EC private key and
@@ -168,4 +187,30 @@ TEST(X509UtilNSSTest, CreateDomainBoundCertEC) {
 #endif
 }
 
+// This test creates a self-signed cert from an EC private key pair and
+// then verifies the content of the certificate.
+TEST(X509UtilNSSTest, CreateSelfSignedertEC) {
+  // Create a sample ASCII weborigin.

[Ryan Sleevi, 2013/06/06 23:26:15]

I find this comment very confusing. There's nothing relevant to "weborigin" in
this code.

Seems like the comment itself is entirely unnecessary.

[jiayl, 2013/06/06 23:45:37]

Done.

+  std::string common_name = "webrtc";
+  base::Time now = base::Time::Now();
+
+  scoped_ptr<crypto::ECPrivateKey> key(crypto::ECPrivateKey::Create());

[Ryan Sleevi, 2013/06/06 23:26:15]

ASSERT_TRUE(key);

Your test will explode otherwise.

[jiayl, 2013/06/06 23:45:37]

Done.

+  std::string der_cert;
+  ASSERT_TRUE(x509_util::CreateSelfSignedCertEC(
+      key.get(),
+      "CN=" + common_name, 1,
+      now,
+      now + base::TimeDelta::FromDays(1),
+      &der_cert));
+
+  VerifySelfSignedCert(common_name, der_cert);
+
+#if !defined(OS_WIN) && !defined(OS_MACOSX)
+  // signature_verifier_win and signature_verifier_mac can't handle EC certs.
+  std::vector<uint8> spki;
+  ASSERT_TRUE(key->ExportPublicKey(&spki));
+  VerifyCertificateSignature(der_cert, spki);
+#endif
+}
+
 }  // namespace net