Adding iOS OpenSSL Implementation

net/cert/x509_certificate_openssl_ios.cc

-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
-#include <openssl/asn1.h>
-#include <openssl/bytestring.h>
-#include <openssl/crypto.h>
-#include <openssl/obj_mac.h>
-#include <openssl/pem.h>
-#include <openssl/sha.h>
-#include <openssl/ssl.h>
+#include <CommonCrypto/CommonDigest.h>
+#include <Security/Security.h>
+
 #include <openssl/x509v3.h>

[davidben, 2016/03/21 19:46:47]

I think this also needs an <openssl/x509.h>

[svaldez, 2016/03/21 20:23:52]

Done.

 
-#include "base/macros.h"
-#include "base/memory/singleton.h"
-#include "base/numerics/safe_conversions.h"
+#include "base/mac/scoped_cftyperef.h"
 #include "base/pickle.h"
-#include "base/sha1.h"
-#include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
 #include "crypto/openssl_util.h"
 #include "crypto/scoped_openssl_types.h"
 #include "net/base/ip_address_number.h"
-#include "net/base/net_errors.h"
 #include "net/cert/x509_util_openssl.h"
+#include "net/ssl/openssl_ssl_util.h"
 
-#if defined(OS_ANDROID)
-#include "base/logging.h"
-#include "net/android/network_library.h"
-#endif
+using base::ScopedCFTypeRef;
 
 namespace net {
 
 namespace {
 
 using ScopedGENERAL_NAMES =
     crypto::ScopedOpenSSL<GENERAL_NAMES, GENERAL_NAMES_free>;
 
+// Returns true if a given |cert_handle| is actually a valid X.509 certificate
+// handle.
+//
+// SecCertificateCreateFromData() does not always force the immediate parsing of
+// the certificate, and as such, may return a SecCertificateRef for an
+// invalid/unparsable certificate. Force parsing to occur to ensure that the
+// SecCertificateRef is correct. On later versions where
+// SecCertificateCreateFromData() immediately parses, rather than lazily, this
+// call is cheap, as the subject is cached.
+bool IsValidOSCertHandle(SecCertificateRef cert_handle) {
+  ScopedCFTypeRef<CFStringRef> sanity_check(
+      SecCertificateCopySubjectSummary(cert_handle));
+  return sanity_check != NULL;
+}
+
 void CreateOSCertHandlesFromPKCS7Bytes(
     const char* data,
     size_t length,
     X509Certificate::OSCertHandles* handles) {
   crypto::EnsureOpenSSLInit();
   crypto::OpenSSLErrStackTracer err_cleaner(FROM_HERE);
 
   CBS der_data;
   CBS_init(&der_data, reinterpret_cast<const uint8_t*>(data), length);
   STACK_OF(X509)* certs = sk_X509_new_null();
 
   if (PKCS7_get_certificates(certs, &der_data)) {

[davidben, 2016/03/21 19:46:47]

[Hrm. I really should get you a non-crypto/x509 version of this function.]

[svaldez, 2016/03/21 20:23:52]

Acknowledged.

     for (size_t i = 0; i < sk_X509_num(certs); ++i) {
-      X509* x509_cert =
-          X509Certificate::DupOSCertHandle(sk_X509_value(certs, i));
-      handles->push_back(x509_cert);
+      X509* x509_cert = sk_X509_value(certs, i);
+      base::StringPiece der;
+      if (!x509_util::GetDER(x509_cert, &der))
+        return;
+      handles->push_back(X509Certificate::CreateOSCertHandleFromBytes(
+          der.data(), der.length()));
     }
   }
   sk_X509_pop_free(certs, X509_free);
 }
 
 void ParsePrincipalValues(X509_NAME* name,
                           int nid,
                           std::vector<std::string>* fields) {
   for (int index = -1;
        (index = X509_NAME_get_index_by_NID(name, nid, index)) != -1;) {
     std::string field;
     if (!x509_util::ParsePrincipalValueByIndex(name, index, &field))
       break;
     fields->push_back(field);
   }
 }
 
-void ParsePrincipal(X509Certificate::OSCertHandle cert,
+void ParsePrincipal(X509Certificate::OSCertHandle os_cert,
                     X509_NAME* x509_name,
                     CertPrincipal* principal) {
   if (!x509_name)
     return;
 
   ParsePrincipalValues(x509_name, NID_streetAddress,
                        &principal->street_addresses);
   ParsePrincipalValues(x509_name, NID_organizationName,
                        &principal->organization_names);
   ParsePrincipalValues(x509_name, NID_organizationalUnitName,
                        &principal->organization_unit_names);
   ParsePrincipalValues(x509_name, NID_domainComponent,
                        &principal->domain_components);
 
   x509_util::ParsePrincipalValueByNID(x509_name, NID_commonName,
                                       &principal->common_name);
   x509_util::ParsePrincipalValueByNID(x509_name, NID_localityName,
                                       &principal->locality_name);
   x509_util::ParsePrincipalValueByNID(x509_name, NID_stateOrProvinceName,
                                       &principal->state_or_province_name);
   x509_util::ParsePrincipalValueByNID(x509_name, NID_countryName,
                                       &principal->country_name);
 }
 
-void ParseSubjectAltName(X509Certificate::OSCertHandle cert,
+void ParseSubjectAltName(X509Certificate::OSCertHandle os_cert,
                          std::vector<std::string>* dns_names,
                          std::vector<std::string>* ip_addresses) {
   DCHECK(dns_names || ip_addresses);
-  int index = X509_get_ext_by_NID(cert, NID_subject_alt_name, -1);
-  X509_EXTENSION* alt_name_ext = X509_get_ext(cert, index);
+  ScopedX509 cert = OSCertHandleToOpenSSL(os_cert);

[davidben, 2016/03/21 19:46:47]

Check for errors here. iOS and OpenSSL may have different leniencies in parsing.
Ditto elsewhere.

[svaldez, 2016/03/21 20:23:52]

Done.

+  int index = X509_get_ext_by_NID(cert.get(), NID_subject_alt_name, -1);
+  X509_EXTENSION* alt_name_ext = X509_get_ext(cert.get(), index);
   if (!alt_name_ext)
     return;
 
   ScopedGENERAL_NAMES alt_names(
       reinterpret_cast<GENERAL_NAMES*>(X509V3_EXT_d2i(alt_name_ext)));
   if (!alt_names.get())
     return;
 
   for (size_t i = 0; i < sk_GENERAL_NAME_num(alt_names.get()); ++i) {
     const GENERAL_NAME* name = sk_GENERAL_NAME_value(alt_names.get(), i);
@@ skipping 16 matching lines @@
         // net mask hence 8 or 32 bytes. Logging to help diagnose any mixup.
         LOG(WARNING) << "Bad sized IP Address in cert: " << ip_addr_len;
         continue;
       }
       ip_addresses->push_back(
           std::string(reinterpret_cast<const char*>(ip_addr), ip_addr_len));
     }
   }
 }
 
-class X509InitSingleton {
- public:
-  static X509InitSingleton* GetInstance() {
-    // We allow the X509 store to leak, because it is used from a non-joinable
-    // worker that is not stopped on shutdown, hence may still be using
-    // OpenSSL library after the AtExit runner has completed.
-    return base::Singleton<X509InitSingleton, base::LeakySingletonTraits<
-                                                  X509InitSingleton>>::get();
-  }
-  X509_STORE* store() const { return store_.get(); }
-
-  void ResetCertStore() {
-    store_.reset(X509_STORE_new());
-    DCHECK(store_.get());
-    X509_STORE_set_default_paths(store_.get());
-    // TODO(joth): Enable CRL (see X509_STORE_set_flags(X509_V_FLAG_CRL_CHECK)).
-  }
-
- private:
-  friend struct base::DefaultSingletonTraits<X509InitSingleton>;
-  X509InitSingleton() {
-    crypto::EnsureOpenSSLInit();
-    ResetCertStore();
-  }
-
-  crypto::ScopedOpenSSL<X509_STORE, X509_STORE_free> store_;
-
-  DISALLOW_COPY_AND_ASSIGN(X509InitSingleton);
-};
-
 // Used to free a list of X509_NAMEs and the objects it points to.
-void sk_X509_NAME_free_all(STACK_OF(X509_NAME)* sk) {
+void sk_X509_NAME_free_all(STACK_OF(X509_NAME) * sk) {
   sk_X509_NAME_pop_free(sk, X509_NAME_free);
 }
 
 }  // namespace
 
 // static
 X509Certificate::OSCertHandle X509Certificate::DupOSCertHandle(
-    OSCertHandle cert_handle) {
-  DCHECK(cert_handle);
-  return X509_up_ref(cert_handle);
+    OSCertHandle handle) {
+  if (!handle)
+    return NULL;
+  return reinterpret_cast<OSCertHandle>(const_cast<void*>(CFRetain(handle)));
 }
 
 // static
 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) {
-  // Decrement the ref-count for the cert and, if all references are gone,
-  // free the memory and any application-specific data associated with the
-  // certificate.
-  X509_free(cert_handle);
+  if (cert_handle)
+    CFRelease(cert_handle);
 }
 
 void X509Certificate::Initialize() {
   crypto::EnsureOpenSSLInit();
   fingerprint_ = CalculateFingerprint(cert_handle_);
   ca_fingerprint_ = CalculateCAFingerprint(intermediate_ca_certs_);
-
-  ASN1_INTEGER* serial_num = X509_get_serialNumber(cert_handle_);
+  ScopedX509 x509_cert = OSCertHandleToOpenSSL(cert_handle_);
+  ASN1_INTEGER* serial_num = X509_get_serialNumber(x509_cert.get());
   if (serial_num) {
     // ASN1_INTEGERS represent the decoded number, in a format internal to
     // OpenSSL. Most notably, this may have leading zeroes stripped off for
     // numbers whose first byte is >= 0x80. Thus, it is necessary to
     // re-encoded the integer back into DER, which is what the interface
     // of X509Certificate exposes, to ensure callers get the proper (DER)
     // value.
     int bytes_required = i2c_ASN1_INTEGER(serial_num, NULL);
     unsigned char* buffer = reinterpret_cast<unsigned char*>(
         base::WriteInto(&serial_number_, bytes_required + 1));
     int bytes_written = i2c_ASN1_INTEGER(serial_num, &buffer);
     DCHECK_EQ(static_cast<size_t>(bytes_written), serial_number_.size());
   }
 
-  ParsePrincipal(cert_handle_, X509_get_subject_name(cert_handle_), &subject_);
-  ParsePrincipal(cert_handle_, X509_get_issuer_name(cert_handle_), &issuer_);
-  x509_util::ParseDate(X509_get_notBefore(cert_handle_), &valid_start_);
-  x509_util::ParseDate(X509_get_notAfter(cert_handle_), &valid_expiry_);
-}
-
-// static
-void X509Certificate::ResetCertStore() {
-  X509InitSingleton::GetInstance()->ResetCertStore();
+  ParsePrincipal(cert_handle_, X509_get_subject_name(x509_cert.get()),
+                 &subject_);
+  ParsePrincipal(cert_handle_, X509_get_issuer_name(x509_cert.get()), &issuer_);
+  x509_util::ParseDate(X509_get_notBefore(x509_cert.get()), &valid_start_);
+  x509_util::ParseDate(X509_get_notAfter(x509_cert.get()), &valid_expiry_);
 }
 
 // static
 SHA1HashValue X509Certificate::CalculateFingerprint(OSCertHandle cert) {
   SHA1HashValue sha1;
-  unsigned int sha1_size = static_cast<unsigned int>(sizeof(sha1.data));
-  int ret = X509_digest(cert, EVP_sha1(), sha1.data, &sha1_size);
-  CHECK(ret);
-  CHECK_EQ(sha1_size, sizeof(sha1.data));
+  memset(sha1.data, 0, sizeof(sha1.data));
+
+  ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert));
+  if (!cert_data)
+    return sha1;
+  DCHECK(CFDataGetBytePtr(cert_data));
+  DCHECK_NE(0, CFDataGetLength(cert_data));
+  CC_SHA1(CFDataGetBytePtr(cert_data), CFDataGetLength(cert_data), sha1.data);
+
   return sha1;
 }
 
 // static
 SHA256HashValue X509Certificate::CalculateFingerprint256(OSCertHandle cert) {
   SHA256HashValue sha256;
-  unsigned int sha256_size = static_cast<unsigned int>(sizeof(sha256.data));
-  int ret = X509_digest(cert, EVP_sha256(), sha256.data, &sha256_size);
-  CHECK(ret);
-  CHECK_EQ(sha256_size, sizeof(sha256.data));
+  memset(sha256.data, 0, sizeof(sha256.data));
+
+  ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert));
+  if (!cert_data)
+    return sha256;
+  DCHECK(CFDataGetBytePtr(cert_data));
+  DCHECK_NE(0, CFDataGetLength(cert_data));
+  CC_SHA256(CFDataGetBytePtr(cert_data), CFDataGetLength(cert_data),
+            sha256.data);
+
   return sha256;
 }
 
 // static
 SHA1HashValue X509Certificate::CalculateCAFingerprint(
     const OSCertHandles& intermediates) {
   SHA1HashValue sha1;
   memset(sha1.data, 0, sizeof(sha1.data));
 
-  SHA_CTX sha1_ctx;
-  SHA1_Init(&sha1_ctx);
-  base::StringPiece der;
+  CC_SHA1_CTX sha1_ctx;
+  CC_SHA1_Init(&sha1_ctx);
   for (size_t i = 0; i < intermediates.size(); ++i) {
-    if (!x509_util::GetDER(intermediates[i], &der))
+    ScopedCFTypeRef<CFDataRef> cert_data(
+        SecCertificateCopyData(intermediates[i]));
+    if (!cert_data)
       return sha1;
-    SHA1_Update(&sha1_ctx, der.data(), der.length());
+    CC_SHA1_Update(&sha1_ctx, CFDataGetBytePtr(cert_data),
+                   CFDataGetLength(cert_data));
   }
-  SHA1_Final(sha1.data, &sha1_ctx);
-
+  CC_SHA1_Final(sha1.data, &sha1_ctx);
   return sha1;
 }
 
 // static
 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes(
     const char* data,
     size_t length) {
-  crypto::EnsureOpenSSLInit();
-  const unsigned char* d2i_data =
-      reinterpret_cast<const unsigned char*>(data);
-  // Don't cache this data for x509_util::GetDER as this wire format
-  // may be not be identical from the i2d_X509 roundtrip.
-  X509* cert = d2i_X509(NULL, &d2i_data, base::checked_cast<long>(length));
-  return cert;
+  ScopedCFTypeRef<CFDataRef> cert_data(CFDataCreateWithBytesNoCopy(
+      kCFAllocatorDefault, reinterpret_cast<const UInt8*>(data),
+      base::checked_cast<CFIndex>(length), kCFAllocatorNull));
+  if (!cert_data)
+    return nullptr;
+  OSCertHandle cert_handle = SecCertificateCreateWithData(NULL, cert_data);
+  if (!cert_handle)
+    return nullptr;
+  if (!IsValidOSCertHandle(cert_handle)) {
+    CFRelease(cert_handle);
+    return nullptr;
+  }
+  return cert_handle;
 }
 
 // static
 X509Certificate::OSCertHandles X509Certificate::CreateOSCertHandlesFromBytes(
     const char* data,
     size_t length,
     Format format) {
   OSCertHandles results;
 
   switch (format) {
     case FORMAT_SINGLE_CERTIFICATE: {
-      OSCertHandle handle = CreateOSCertHandleFromBytes(data, length);
+      OSCertHandle handle =
+          X509Certificate::CreateOSCertHandleFromBytes(data, length);
       if (handle)
         results.push_back(handle);
       break;
     }
     case FORMAT_PKCS7: {
       CreateOSCertHandlesFromPKCS7Bytes(data, length, &results);
       break;
     }
     default: {
       NOTREACHED() << "Certificate format " << format << " unimplemented";
       break;
     }
   }
 
   return results;
 }
 
 void X509Certificate::GetSubjectAltName(
     std::vector<std::string>* dns_names,
     std::vector<std::string>* ip_addrs) const {
   if (dns_names)
     dns_names->clear();
   if (ip_addrs)
     ip_addrs->clear();
 
   ParseSubjectAltName(cert_handle_, dns_names, ip_addrs);
 }
 
 // static
-X509_STORE* X509Certificate::cert_store() {
-  return X509InitSingleton::GetInstance()->store();
-}
-
-// static
 bool X509Certificate::GetDEREncoded(X509Certificate::OSCertHandle cert_handle,
                                     std::string* encoded) {
   base::StringPiece der;
-  if (!cert_handle || !x509_util::GetDER(cert_handle, &der))
+  if (!cert_handle)
     return false;
-  encoded->assign(der.data(), der.length());
+  ScopedCFTypeRef<CFDataRef> der_data(SecCertificateCopyData(cert_handle));
+  if (!der_data)
+    return false;
+  encoded->assign(reinterpret_cast<const char*>(CFDataGetBytePtr(der_data)),
+                  CFDataGetLength(der_data));
   return true;
 }
 
 // static
 bool X509Certificate::IsSameOSCert(X509Certificate::OSCertHandle a,
                                    X509Certificate::OSCertHandle b) {
   DCHECK(a && b);
   if (a == b)
     return true;
-
-  // X509_cmp only checks the fingerprint, but we want to compare the whole
-  // DER data. Encoding it from OSCertHandle is an expensive operation, so we
-  // cache the DER (if not already cached via X509_set_ex_data).
-  base::StringPiece der_a, der_b;
-
-  return x509_util::GetDER(a, &der_a) &&
-      x509_util::GetDER(b, &der_b) &&
-      der_a == der_b;
+  if (CFEqual(a, b))
+    return true;
+  ScopedCFTypeRef<CFDataRef> a_data(SecCertificateCopyData(a));
+  ScopedCFTypeRef<CFDataRef> b_data(SecCertificateCopyData(b));
+  return a_data && b_data &&
+         CFDataGetLength(a_data) == CFDataGetLength(b_data) &&
+         memcmp(CFDataGetBytePtr(a_data), CFDataGetBytePtr(b_data),
+                CFDataGetLength(a_data)) == 0;
 }
 
 // static
 X509Certificate::OSCertHandle X509Certificate::ReadOSCertHandleFromPickle(
     base::PickleIterator* pickle_iter) {
   const char* data;
   int length;
   if (!pickle_iter->ReadData(&data, &length))
     return NULL;
 
-  return CreateOSCertHandleFromBytes(data, length);
+  return X509Certificate::CreateOSCertHandleFromBytes(data, length);
 }
 
 // static
 bool X509Certificate::WriteOSCertHandleToPickle(OSCertHandle cert_handle,
                                                 base::Pickle* pickle) {
-  base::StringPiece der;
-  if (!x509_util::GetDER(cert_handle, &der))
+  ScopedCFTypeRef<CFDataRef> cert_data(SecCertificateCopyData(cert_handle));
+  if (!cert_data)
     return false;
 
-  return pickle->WriteData(der.data(), der.length());
+  return pickle->WriteData(
+      reinterpret_cast<const char*>(CFDataGetBytePtr(cert_data)),
+      CFDataGetLength(cert_data));
 }
 
 // static
-void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle,
+void X509Certificate::GetPublicKeyInfo(OSCertHandle os_cert,
                                        size_t* size_bits,
                                        PublicKeyType* type) {

[davidben, 2016/03/21 19:46:47]

I'm really puzzled why this can't be done from Apple's APIs, but I can't find
anything. :-/ SecKeyGetBlockSize will apparently return the size of the RSA
modulus (bytes? bits?), but I don't see a way to find the key type.

[svaldez, 2016/03/21 20:23:52]

Because its iOS?

   *type = kPublicKeyTypeUnknown;
   *size_bits = 0;
-
-  crypto::ScopedEVP_PKEY scoped_key(X509_get_pubkey(cert_handle));
+  ScopedX509 cert = OSCertHandleToOpenSSL(os_cert);
+  crypto::ScopedEVP_PKEY scoped_key(X509_get_pubkey(cert.get()));
   if (!scoped_key.get())
     return;
 
   CHECK(scoped_key.get());
   EVP_PKEY* key = scoped_key.get();
 
   switch (key->type) {
     case EVP_PKEY_RSA:
       *type = kPublicKeyTypeRSA;
       *size_bits = EVP_PKEY_size(key) * 8;

[davidben, 2016/03/21 19:46:47]

I believe all of these want to be EVP_PKEY_bits(key). EVP_PKEY_size(key) is the
maximum size of the signature. (The API names are terrible. Blame OpenSSL.)

[svaldez, 2016/03/21 20:23:52]

Done.

       break;
     case EVP_PKEY_DSA:
       *type = kPublicKeyTypeDSA;
       *size_bits = EVP_PKEY_size(key) * 8;
       break;
     case EVP_PKEY_EC:
       *type = kPublicKeyTypeECDSA;
       *size_bits = EVP_PKEY_bits(key);
       break;
     case EVP_PKEY_DH:
       *type = kPublicKeyTypeDH;
       *size_bits = EVP_PKEY_size(key) * 8;
       break;
   }
 }
 
+bool X509Certificate::SupportsSSLClientAuth() const {
+  return false;
+}
+
+CFMutableArrayRef X509Certificate::CreateOSCertChainForCert() const {
+  CFMutableArrayRef cert_list =
+      CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
+  if (!cert_list)
+    return NULL;
+
+  CFArrayAppendValue(cert_list, os_cert_handle());
+  for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i)
+    CFArrayAppendValue(cert_list, intermediate_ca_certs_[i]);
+
+  return cert_list;
+}
+
 bool X509Certificate::IsIssuedByEncoded(
     const std::vector<std::string>& valid_issuers) {
   if (valid_issuers.empty())
     return false;
 
   // Convert to a temporary list of X509_NAME objects.
   // It will own the objects it points to.
   crypto::ScopedOpenSSL<STACK_OF(X509_NAME), sk_X509_NAME_free_all>
       issuer_names(sk_X509_NAME_new_null());
   if (!issuer_names.get())
     return false;
 
   for (std::vector<std::string>::const_iterator it = valid_issuers.begin();
-      it != valid_issuers.end(); ++it) {
-    const unsigned char* p =
-        reinterpret_cast<const unsigned char*>(it->data());
+       it != valid_issuers.end(); ++it) {
+    const unsigned char* p = reinterpret_cast<const unsigned char*>(it->data());
     long len = static_cast<long>(it->length());
     X509_NAME* ca_name = d2i_X509_NAME(NULL, &p, len);
     if (ca_name == NULL)
       return false;
     sk_X509_NAME_push(issuer_names.get(), ca_name);
   }
 
   // Create a temporary list of X509_NAME objects corresponding
   // to the certificate chain. It doesn't own the object it points to.
   std::vector<X509_NAME*> cert_names;
-  X509_NAME* issuer = X509_get_issuer_name(cert_handle_);
+  ScopedX509 x509_cert = OSCertHandleToOpenSSL(cert_handle_);
+  X509_NAME* issuer = X509_get_issuer_name(x509_cert.get());
   if (issuer == NULL)
     return false;
 
   cert_names.push_back(issuer);
   for (OSCertHandles::iterator it = intermediate_ca_certs_.begin();
-      it != intermediate_ca_certs_.end(); ++it) {
-    issuer = X509_get_issuer_name(*it);
+       it != intermediate_ca_certs_.end(); ++it) {
+    ScopedX509 intermediate_cert = OSCertHandleToOpenSSL(*it);
+    issuer = X509_get_issuer_name(intermediate_cert.get());
     if (issuer == NULL)
       return false;
     cert_names.push_back(issuer);
   }
 
   // and 'cert_names'.
   for (size_t n = 0; n < cert_names.size(); ++n) {
     for (size_t m = 0; m < sk_X509_NAME_num(issuer_names.get()); ++m) {
       X509_NAME* issuer = sk_X509_NAME_value(issuer_names.get(), m);
       if (X509_NAME_cmp(issuer, cert_names[n]) == 0) {
         return true;
       }
     }
   }
 
   return false;
 }
 
 // static
-bool X509Certificate::IsSelfSigned(OSCertHandle cert_handle) {
-  crypto::ScopedEVP_PKEY scoped_key(X509_get_pubkey(cert_handle));
+bool X509Certificate::IsSelfSigned(OSCertHandle os_cert) {
+  ScopedX509 cert = OSCertHandleToOpenSSL(os_cert);
+  crypto::ScopedEVP_PKEY scoped_key(X509_get_pubkey(cert.get()));
   if (!scoped_key)
     return false;
 
   // NOTE: X509_verify() returns 1 in case of success, 0 or -1 on error.
-  return X509_verify(cert_handle, scoped_key.get()) == 1;
+  return X509_verify(cert.get(), scoped_key.get()) == 1;
 }
 
 }  // namespace net