Resolve certificate references in ONC by PEM.

chromeos/network/onc/onc_translator_onc_to_shill.cc

Index: chromeos/network/onc/onc_translator_onc_to_shill.cc
diff --git a/chromeos/network/onc/onc_translator_onc_to_shill.cc b/chromeos/network/onc/onc_translator_onc_to_shill.cc
index 70831c4d8ae4738d52c44a1dc740dc4f1c323bb2..8c09df3c4451483befb05a37d3e34a7ef9fecc13 100644
--- a/chromeos/network/onc/onc_translator_onc_to_shill.cc
+++ b/chromeos/network/onc/onc_translator_onc_to_shill.cc
@@ -101,18 +101,20 @@ void LocalTranslator::TranslateFields() {
 void LocalTranslator::TranslateOpenVPN() {
   // Shill supports only one RemoteCertKU but ONC a list.
   // Copy only the first entry if existing.
-  const base::ListValue* certKUs = NULL;
-  std::string certKU;
-  if (onc_object_->GetListWithoutPathExpansion(vpn::kRemoteCertKU, &certKUs) &&
-      certKUs->GetString(0, &certKU)) {
+  const base::ListValue* cert_kus = NULL;
+  std::string cert_ku;
+  if (onc_object_->GetListWithoutPathExpansion(vpn::kRemoteCertKU, &cert_kus) &&
+      cert_kus->GetString(0, &cert_ku)) {
     shill_dictionary_->SetStringWithoutPathExpansion(
-        flimflam::kOpenVPNRemoteCertKUProperty, certKU);
+        flimflam::kOpenVPNRemoteCertKUProperty, cert_ku);
   }
 
   for (base::DictionaryValue::Iterator it(*onc_object_); !it.IsAtEnd();
        it.Advance()) {
     scoped_ptr<base::Value> translated;
-    if (it.key() == vpn::kSaveCredentials || it.key() == vpn::kRemoteCertKU) {
+    if (it.key() == vpn::kSaveCredentials ||
+        it.key() == vpn::kRemoteCertKU ||
+        it.key() == openvpn::kServerCAPEMs) {
       translated.reset(it.value().DeepCopy());
     } else {
       // Shill wants all Provider/VPN fields to be strings.