Try #2: CertVerifyProcMac: Add Keychain re-ordering hack, check CRLsets in path pruning loop.

net/cert/x509_util_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_util_mac.h"
 
 #include "base/logging.h"
 #include "third_party/apple_apsl/cssmapplePriv.h"
 
 namespace net {
@@ skipping 44 matching lines @@
   memset(&tp_ssl_options, 0, sizeof(tp_ssl_options));
   tp_ssl_options.Version = CSSM_APPLE_TP_SSL_OPTS_VERSION;
   tp_ssl_options.Flags |= CSSM_APPLE_TP_SSL_CLIENT;
 
   return CreatePolicy(&CSSMOID_APPLE_TP_SSL, &tp_ssl_options,
                       sizeof(tp_ssl_options), policy);
 }
 
 OSStatus CreateSSLServerPolicy(const std::string& hostname,
                                SecPolicyRef* policy) {
-  CSSM_APPLE_TP_SSL_OPTIONS tp_ssl_options;
-  memset(&tp_ssl_options, 0, sizeof(tp_ssl_options));
-  tp_ssl_options.Version = CSSM_APPLE_TP_SSL_OPTS_VERSION;
   if (!hostname.empty()) {
+    CSSM_APPLE_TP_SSL_OPTIONS tp_ssl_options;
+    memset(&tp_ssl_options, 0, sizeof(tp_ssl_options));
+    tp_ssl_options.Version = CSSM_APPLE_TP_SSL_OPTS_VERSION;
     tp_ssl_options.ServerName = hostname.data();
     tp_ssl_options.ServerNameLen = hostname.size();
+
+    return CreatePolicy(&CSSMOID_APPLE_TP_SSL, &tp_ssl_options,
+                        sizeof(tp_ssl_options), policy);
   }
 
-  return CreatePolicy(&CSSMOID_APPLE_TP_SSL, &tp_ssl_options,
-                      sizeof(tp_ssl_options), policy);
+  return CreatePolicy(&CSSMOID_APPLE_TP_SSL, nullptr, 0U, policy);
 }
 
 OSStatus CreateBasicX509Policy(SecPolicyRef* policy) {
   return CreatePolicy(&CSSMOID_APPLE_X509_BASIC, NULL, 0, policy);
 }
 
 OSStatus CreateRevocationPolicies(bool enable_revocation_checking,
                                   bool enable_ev_checking,
                                   CFMutableArrayRef policies) {
   OSStatus status = noErr;
@@ skipping 144 matching lines @@
   CSSM_CL_CertAbortQuery(cl_handle_, results_handle);
   field->Reset(cl_handle_, oid, field_ptr);
   return CSSM_OK;
 }
 
 }  // namespace x509_util
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"
 
 }  // namespace net