Try #2: CertVerifyProcMac: Add Keychain re-ordering hack, check CRLsets in path pruning loop.

net/cert/x509_util_mac.cc

Index: net/cert/x509_util_mac.cc
diff --git a/net/cert/x509_util_mac.cc b/net/cert/x509_util_mac.cc
index 7971a733af07cbc3855ac9e1e649911f47a552bb..8933e1a5d7eea27c5d8a944ad21d38498a37ef6e 100644
--- a/net/cert/x509_util_mac.cc
+++ b/net/cert/x509_util_mac.cc
@@ -62,16 +62,18 @@ OSStatus CreateSSLClientPolicy(SecPolicyRef* policy) {
 
 OSStatus CreateSSLServerPolicy(const std::string& hostname,
                                SecPolicyRef* policy) {
-  CSSM_APPLE_TP_SSL_OPTIONS tp_ssl_options;
-  memset(&tp_ssl_options, 0, sizeof(tp_ssl_options));
-  tp_ssl_options.Version = CSSM_APPLE_TP_SSL_OPTS_VERSION;
   if (!hostname.empty()) {
+    CSSM_APPLE_TP_SSL_OPTIONS tp_ssl_options;
+    memset(&tp_ssl_options, 0, sizeof(tp_ssl_options));
+    tp_ssl_options.Version = CSSM_APPLE_TP_SSL_OPTS_VERSION;
     tp_ssl_options.ServerName = hostname.data();
     tp_ssl_options.ServerNameLen = hostname.size();
+
+    return CreatePolicy(&CSSMOID_APPLE_TP_SSL, &tp_ssl_options,
+                        sizeof(tp_ssl_options), policy);
   }
 
-  return CreatePolicy(&CSSMOID_APPLE_TP_SSL, &tp_ssl_options,
-                      sizeof(tp_ssl_options), policy);
+  return CreatePolicy(&CSSMOID_APPLE_TP_SSL, nullptr, 0U, policy);
 }
 
 OSStatus CreateBasicX509Policy(SecPolicyRef* policy) {