Enable trust anchor constraints for the built-in Cast roots.

components/cast_certificate/cast_crl.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cast_certificate/cast_crl.h"
 
 #include <unordered_map>
 #include <unordered_set>
 
 #include "base/base64.h"
@@ skipping 49 matching lines @@
  private:
   friend struct base::DefaultSingletonTraits<CastCRLTrustStore>;
 
   CastCRLTrustStore() {
     // Initialize the trust store with the root certificate.
     scoped_refptr<net::ParsedCertificate> cert =
         net::ParsedCertificate::CreateFromCertificateData(
             kCastCRLRootCaDer, sizeof(kCastCRLRootCaDer),
             net::ParsedCertificate::DataSource::EXTERNAL_REFERENCE, {});
     CHECK(cert);
-    // TODO(crbug.com/635200): Support anchor constraints, and initialize the
-    // anchor using constraints from the self-signed certificate.
+    // Enforce pathlen constraints and policies defined on the root certificate.
     scoped_refptr<net::TrustAnchor> anchor =
-        net::TrustAnchor::CreateFromCertificateNoConstraints(std::move(cert));
+        net::TrustAnchor::CreateFromCertificateWithConstraints(std::move(cert));
     CHECK(anchor);
     store_.AddTrustAnchor(std::move(anchor));
   }
 
   net::TrustStore store_;
   DISALLOW_COPY_AND_ASSIGN(CastCRLTrustStore);
 };
 
 // Converts a uint64_t unix timestamp to net::der::GeneralizedTime.
 bool ConvertTimeSeconds(uint64_t seconds,
@@ skipping 269 matching lines @@
 }
 
 std::unique_ptr<CastCRL> ParseAndVerifyCRLForTest(
     const std::string& crl_proto,
     const base::Time& time,
     net::TrustStore* trust_store) {
   return ParseAndVerifyCRL(crl_proto, time, trust_store);
 }
 
 }  // namespace cast_certificate