Add an out parameter to VerifyCertificateChain for retrieving the trusted chain.

net/cert/internal/verify_certificate_chain.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_VERIFY_CERTIFICATE_CHAIN_H_
 #define NET_CERT_INTERNAL_VERIFY_CERTIFICATE_CHAIN_H_
 
 #include <vector>
 
 #include "base/compiler_specific.h"
@@ skipping 33 matching lines @@
 //   trust_store:
 //     Contains the set of trusted public keys (and their names).
 //
 //   signature_policy:
 //     The policy to use when verifying signatures (what hash algorithms are
 //     allowed, what length keys, what named curves, etc).
 //
 //   time:
 //     The UTC time to use for expiration checks.
 //
+//   trusted_chain_out:
+//     The vector to populate with the verified trusted certificate chain.
+//     If a nullptr is passed, this parameter is ignored.
+//     If the target certificate can not be verified, this parameter is
+//     ignored.

[eroman, 2016/06/16 22:11:36]

Please additionally mention the order of the vector -- namely
trusted_chain_out->front() is the target certificate, and
trusted_chain_out->back() is the trust anchor.

[ryanchung, 2016/06/16 22:47:08]

Done.

+//
 // ---------
 // Outputs
 // ---------
 //
 //   Returns true if the target certificate can be verified.
 NET_EXPORT bool VerifyCertificateChain(
     const std::vector<scoped_refptr<ParsedCertificate>>& cert_chain,
     const TrustStore& trust_store,
     const SignaturePolicy* signature_policy,
-    const der::GeneralizedTime& time) WARN_UNUSED_RESULT;
+    const der::GeneralizedTime& time,
+    std::vector<scoped_refptr<ParsedCertificate>>* trusted_chain_out)
+    WARN_UNUSED_RESULT;
 
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_VERIFY_CERTIFICATE_CHAIN_H_