MD Settings: Certificate manager, respect export/edit/delete restrictions.

chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.js

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview settings-certificate-subentry represents an SSL certificate
  * sub-entry.
  */
 
 /**
@@ skipping 123 matching lines @@
             this.dispatchCertificateActionEvent_(
                 settings.CertificateAction.EXPORT_PERSONAL);
           }.bind(this),
           this.onRejected_.bind(this));
     } else {
       this.browserProxy_.exportCertificate(this.model.id);
     }
   },
 
   /**
-   * @param {string} certificateType The type of this certificate.
+   * @param {!settings.CertificateType} certificateType
+   * @param {!CertificateSubnode} model
    * @return {boolean} Whether the certificate can be edited.
    * @private
    */
-  canEdit_: function(certificateType) {
-    return this.certificateType == settings.CertificateType.CA;
+  canEdit_: function(certificateType, model) {
+    return certificateType == settings.CertificateType.CA && !model.policy;
+  },
+
+  /**
+   * @param {!settings.CertificateType} certificateType
+   * @param {!CertificateSubnode} model
+   * @return {boolean} Whether the certificate can be exported.
+   * @private
+   */
+  canExport_: function(certificateType, model) {
+    if (certificateType == settings.CertificateType.PERSONAL) {
+      return model.extractable;
+    }
+    return true;
+  },
+
+  /**
+   * @param {!CertificateSubnode} model
+   * @return {boolean} Whether the certificate can be deleted.
+   * @private
+   */
+  canDelete_: function(model) {
+    return !model.readonly && !model.policy;
   },
 
   /** @private */
   closePopupMenu_: function() {
     this.$$('iron-dropdown').close();
   },
 });