Enable SSLClientSocketTest unit tests on Mac OS X by implementing our own cer...

net/base/x509_certificate.h

Index: net/base/x509_certificate.h
===================================================================
--- net/base/x509_certificate.h	(revision 24466)
+++ net/base/x509_certificate.h	(working copy)
@@ -209,6 +209,12 @@
   // now.
   bool HasExpired() const;
 
+#if defined(OS_MACOSX)
+    // Adds an untrusted intermediate certificate that may be needed for

[wtc, 2009/08/27 00:14:18]

Nit: Fix indentation.

+    // chain building.
+    void AddIntermediateCertificate(SecCertificateRef cert);
+#endif
+
   // Verifies the certificate against the given hostname.  Returns OK if
   // successful or an error code upon failure.
   //
@@ -299,6 +305,12 @@
   // A handle to the certificate object in the underlying crypto library.
   OSCertHandle cert_handle_;
 
+#if defined(OS_MACOSX)
+    // Untrusted intermediate certificates associated with this certificate
+    // that may be needed for chain building.
+    CFMutableArrayRef intermediate_ca_certs_;

[wtc, 2009/08/27 00:14:18]

intermediate_certs_ is fine.  I found that Mac OS X
documentation uses the term "intermediate certificate",
so I'm now used to this term.

But actually, why don't we just stick the CFArrayRef
returned by SSLCopyPeerCertificates here as
  CFArrayRef cert_chain_;

Then we can just pass the cert_chain_ member directly
to SecTrustCreateWithCertificates in X509Certificate::Verify.
This avoids the calls to AddIntermediateCertificate
and rebuilding cert_array from intermediate_ca_certs_.

+#endif
+
   // Where the certificate comes from.
   Source source_;