[ios] Use -[WKWebView serverTrust] instead of certificateChain on iOS 10.

ios/web/web_state/ui/crw_web_controller.mm

Index: ios/web/web_state/ui/crw_web_controller.mm
diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index 847c3a69eda9aae9ed46f97cf7d3793afc5ef224..705d368e3b20a6cc2d5e4993ff9fe42a76f463bb 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm
@@ -4484,11 +4484,22 @@ const NSTimeInterval kSnapshotOverlayTransition = 0.5;
     [_SSLStatusUpdater setDelegate:self];
   }
   NSString* host = base::SysUTF8ToNSString(_documentURL.host());
-  NSArray* certChain = [_webView certificateChain];
   BOOL hasOnlySecureContent = [_webView hasOnlySecureContent];
+  base::ScopedCFTypeRef<SecTrustRef> trust;
+// TODO(crbug.com/628696): Remove these guards after moving to iOS10 SDK.
+#if defined(__IPHONE_10_0) && __IPHONE_OS_VERSION_MAX_ALLOWED >= __IPHONE_10_0
+  if (base::ios::IsRunningOnIOS10OrLater()) {
+    trust.reset([_webView serverTrust], base::scoped_policy::RETAIN);
+  } else {
+    trust = web::CreateServerTrustFromChain([_webView certificateChain], host);
+  }
+#else
+  trust = web::CreateServerTrustFromChain([_webView certificateChain], host);
+#endif
+
   [_SSLStatusUpdater updateSSLStatusForNavigationItem:currentNavItem
                                          withCertHost:host
-                                            certChain:certChain
+                                                trust:std::move(trust)
                                  hasOnlySecureContent:hasOnlySecureContent];
 }
 
@@ -5262,11 +5273,9 @@ const NSTimeInterval kSnapshotOverlayTransition = 0.5;
 #pragma mark CRWSSLStatusUpdater DataSource/Delegate Methods
 
 - (void)SSLStatusUpdater:(CRWSSLStatusUpdater*)SSLStatusUpdater
-    querySSLStatusForCertChain:(NSArray*)certChain
-                          host:(NSString*)host
-             completionHandler:(StatusQueryHandler)completionHandler {
-  base::ScopedCFTypeRef<SecTrustRef> trust(
-      web::CreateServerTrustFromChain(certChain, host));
+    querySSLStatusForTrust:(base::ScopedCFTypeRef<SecTrustRef>)trust
+                      host:(NSString*)host
+         completionHandler:(StatusQueryHandler)completionHandler {
   [_certVerificationController querySSLStatusForTrust:std::move(trust)
                                                  host:host
                                     completionHandler:completionHandler];