Support trust anchor constraints, by specifying them as a certificate.

net/net.gypi

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # This file is shared between the regular GYP build, the NaCl GYP build, and
 # the GN build. For GN support, it must have no conditionals or anything like
 # that beyond the simple one-level-deep dictionary of values.
 {
   'variables': {
     # Subset of net source files that are compiled for NaCl (net_nacl target).
@@ skipping 2455 matching lines @@
       'data/url_request_unittest/redirect308-to-echo.mock-http-headers',
       'data/url_request_unittest/redirect308-to-https',
       'data/url_request_unittest/redirect308-to-https.mock-http-headers',
       'data/url_request_unittest/simple.html',
       'data/url_request_unittest/simple.html.mock-http-headers',
       'data/url_request_unittest/two-content-lengths.html',
       'data/url_request_unittest/two-content-lengths.html.mock-http-headers',
       'data/url_request_unittest/with-headers.html',
       'data/url_request_unittest/with-headers.html.mock-http-headers',
       'data/verify_certificate_chain_unittest/basic-constraints-pathlen-0-self-issued.pem',
+      'data/verify_certificate_chain_unittest/constrained-non-self-signed-root.pem',
+      'data/verify_certificate_chain_unittest/constrained-root-basic-constraints-ca-false.pem',
+      'data/verify_certificate_chain_unittest/constrained-root-lacks-basic-constraints.pem',
+      'data/verify_certificate_chain_unittest/expired-constrained-root.pem',
       'data/verify_certificate_chain_unittest/expired-intermediate.pem',
-      'data/verify_certificate_chain_unittest/expired-root.pem',
       'data/verify_certificate_chain_unittest/expired-target-notBefore.pem',
       'data/verify_certificate_chain_unittest/expired-target.pem',
+      'data/verify_certificate_chain_unittest/expired-unconstrained-root.pem',
       'data/verify_certificate_chain_unittest/intermediate-basic-constraints-ca-false.pem',
       'data/verify_certificate_chain_unittest/intermediate-basic-constraints-not-critical.pem',
       'data/verify_certificate_chain_unittest/intermediate-lacks-basic-constraints.pem',
       'data/verify_certificate_chain_unittest/intermediate-lacks-signing-key-usage.pem',
       'data/verify_certificate_chain_unittest/intermediate-signed-with-md5.pem',
       'data/verify_certificate_chain_unittest/intermediate-unknown-critical-extension.pem',
       'data/verify_certificate_chain_unittest/intermediate-unknown-non-critical-extension.pem',
       'data/verify_certificate_chain_unittest/issuer-and-subject-not-byte-for-byte-equal-anchor.pem',
       'data/verify_certificate_chain_unittest/issuer-and-subject-not-byte-for-byte-equal.pem',
       'data/verify_certificate_chain_unittest/key-rollover-longrolloverchain.pem',
       'data/verify_certificate_chain_unittest/key-rollover-newchain.pem',
       'data/verify_certificate_chain_unittest/key-rollover-oldchain.pem',
       'data/verify_certificate_chain_unittest/key-rollover-rolloverchain.pem',
       'data/verify_certificate_chain_unittest/non-self-signed-root.pem',
       'data/verify_certificate_chain_unittest/target-and-intermediate.pem',
       'data/verify_certificate_chain_unittest/target-has-keycertsign-but-not-ca.pem',
       'data/verify_certificate_chain_unittest/target-has-pathlen-but-not-ca.pem',
       'data/verify_certificate_chain_unittest/target-not-end-entity.pem',
       'data/verify_certificate_chain_unittest/target-signed-by-512bit-rsa.pem',
       'data/verify_certificate_chain_unittest/target-signed-using-ecdsa.pem',
       'data/verify_certificate_chain_unittest/target-signed-with-md5.pem',
       'data/verify_certificate_chain_unittest/target-unknown-critical-extension.pem',
       'data/verify_certificate_chain_unittest/target-wrong-signature.pem',
+      'data/verify_certificate_chain_unittest/unconstrained-non-self-signed-root.pem',
+      'data/verify_certificate_chain_unittest/unconstrained-root-basic-constraints-ca-false.pem',
+      'data/verify_certificate_chain_unittest/unconstrained-root-lacks-basic-constraints.pem',
       'data/verify_certificate_chain_unittest/unknown-root.pem',
       'data/verify_certificate_chain_unittest/violates-basic-constraints-pathlen-0.pem',
-      'data/verify_certificate_chain_unittest/violates-pathlen-1-root.pem',
+      'data/verify_certificate_chain_unittest/violates-pathlen-1-constrained-root.pem',
+      'data/verify_certificate_chain_unittest/violates-pathlen-1-unconstrained-root.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-case_swap-dupe_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-case_swap-extra_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-case_swap-extra_rdn.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-case_swap.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-extra_whitespace-dupe_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-extra_whitespace-extra_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-extra_whitespace-extra_rdn.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-extra_whitespace.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-unmangled-dupe_attr.pem',
       'data/verify_name_match_unittest/names/ascii-BMPSTRING-unmangled-extra_attr.pem',
@@ skipping 673 matching lines @@
       'third_party/nist-pkits/crls/requireExplicitPolicy5subCACRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy5subsubCACRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy5subsubsubCACRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy7CACRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy7subCARE2CRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy7subsubCARE2RE4CRL.crl',
       'third_party/nist-pkits/crls/requireExplicitPolicy7subsubsubCARE2RE4CRL.crl',
     ],
   }
 }