Add CertErrors* parameter to the main Certificate parsing functions.

net/tools/cert_verify_tool/verify_using_path_builder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/tools/cert_verify_tool/verify_using_path_builder.h"
 
 #include <iostream>
 
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 134 matching lines @@
               << SubjectFromTrustAnchor(trust_anchor.get()) << "\n";
   }
 
   // Print the errors.
   if (!result_path->errors.empty()) {
     std::cout << "Errors:\n";
     std::cout << result_path->errors.ToDebugString() << "\n";
   }
 }
 
+scoped_refptr<net::ParsedCertificate> ParseCertificate(const CertInput& input) {
+  net::CertErrors errors;
+  scoped_refptr<net::ParsedCertificate> cert =
+      net::ParsedCertificate::Create(input.der_cert, {}, &errors);
+  if (!cert) {
+    PrintCertError("ERROR: ParsedCertificate failed:", input);
+    std::cout << errors.ToDebugString() << "\n";
+  }
+
+  // TODO(crbug.com/634443): Print errors if there are any on success too (i.e.
+  //                         warnings).
+
+  return cert;
+}
+
 }  // namespace
 
 // Verifies |target_der_cert| using CertPathBuilder.
 bool VerifyUsingPathBuilder(
     const CertInput& target_der_cert,
     const std::vector<CertInput>& intermediate_der_certs,
     const std::vector<CertInput>& root_der_certs,
     const base::Time at_time,
     const base::FilePath& dump_prefix_path) {
   base::Time::Exploded exploded_time;
   at_time.UTCExplode(&exploded_time);
   net::der::GeneralizedTime time = ConvertExplodedTime(exploded_time);
 
   net::TrustStoreCollection trust_store;
 
   net::TrustStoreInMemory trust_store_in_memory;
   trust_store.AddTrustStoreSynchronousOnly(&trust_store_in_memory);
   for (const auto& der_cert : root_der_certs) {
-    scoped_refptr<net::ParsedCertificate> cert =
-        net::ParsedCertificate::CreateFromCertificateCopy(der_cert.der_cert,
-                                                          {});
-    if (!cert)
-      PrintCertError("ERROR: ParsedCertificate failed:", der_cert);
-    else {
+    scoped_refptr<net::ParsedCertificate> cert = ParseCertificate(der_cert);
+    if (cert) {
       trust_store_in_memory.AddTrustAnchor(
           net::TrustAnchor::CreateFromCertificateNoConstraints(cert));
     }
   }
 
 #if defined(USE_NSS_CERTS)
   net::TrustStoreNSS trust_store_nss(trustSSL,
                                      base::ThreadTaskRunnerHandle::Get());
   trust_store.SetPrimaryTrustStore(&trust_store_nss);
 #else
   if (root_der_certs.empty()) {
     std::cerr << "NOTE: CertPathBuilder does not currently use OS trust "
                  "settings (--roots must be specified).\n";
   }
 #endif
 
   net::CertIssuerSourceStatic intermediate_cert_issuer_source;
   for (const auto& der_cert : intermediate_der_certs) {
-    scoped_refptr<net::ParsedCertificate> cert =
-        net::ParsedCertificate::CreateFromCertificateCopy(der_cert.der_cert,
-                                                          {});
-    if (!cert)
-      PrintCertError("ERROR: ParsedCertificate failed:", der_cert);
-    else
+    scoped_refptr<net::ParsedCertificate> cert = ParseCertificate(der_cert);
+    if (cert)
       intermediate_cert_issuer_source.AddCert(cert);
   }
 
   scoped_refptr<net::ParsedCertificate> target_cert =
-      net::ParsedCertificate::CreateFromCertificateCopy(
-          target_der_cert.der_cert, {});
-  if (!target_cert) {
-    PrintCertError("ERROR: ParsedCertificate failed:", target_der_cert);
+      ParseCertificate(target_der_cert);
+  if (!target_cert)
     return false;
-  }
 
   // Verify the chain.
   net::SimpleSignaturePolicy signature_policy(2048);
   net::CertPathBuilder::Result result;
   net::CertPathBuilder path_builder(target_cert, &trust_store,
                                     &signature_policy, time, &result);
   path_builder.AddCertIssuerSource(&intermediate_cert_issuer_source);
 
   // TODO(mattm): add command line flags to configure using CertIssuerSourceAia
   // (similar to VERIFY_CERT_IO_ENABLED flag for CertVerifyProc).
@@ skipping 37 matching lines @@
     if (!DumpParsedCertificateChain(
             dump_prefix_path.AddExtension(
                 FILE_PATH_LITERAL(".CertPathBuilder.pem")),
             result.paths[result.best_result_index]->path)) {
       return false;
     }
   }
 
   return result.HasValidPath();
 }