Use SecKeyCreateSignature on macOS 10.12 and later.

net/ssl/ssl_platform_key_mac.h

Index: net/ssl/ssl_platform_key_mac.h
diff --git a/net/ssl/ssl_platform_key_mac.h b/net/ssl/ssl_platform_key_mac.h
new file mode 100644
index 0000000000000000000000000000000000000000..adfa641a0e97c1f5f3daf849bd68f0078b59bc9c
--- /dev/null
+++ b/net/ssl/ssl_platform_key_mac.h
@@ -0,0 +1,27 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_SSL_SSL_PLATFORM_KEY_MAC_H_
+#define NET_SSL_SSL_PLATFORM_KEY_MAC_H_
+
+#include <Security/SecBase.h>
+
+#include "base/memory/ref_counted.h"
+#include "net/base/net_export.h"
+
+namespace net {
+
+class SSLPrivateKey;
+class X509Certificate;
+
+// Looks up the private key from |keychain| corresponding to |certificate|'s
+// public key and returns an SSLPrivateKey backed by the playform key. If

[Ryan Sleevi, 2016/12/13 22:21:07]

// Returns an SSLPrivateKey backed by the platform private key in |keychain|
// that corresponds to |certificate|'s public key

?

(It's pedantry, but it seems to be more direct/active)

[davidben, 2016/12/14 00:59:43]

Done. Also updated the ssl_platform_key.h copy.

+// |keychain| is nullptr, the user's default search list is used instead.

[Ryan Sleevi, 2016/12/13 22:21:07]

s/the user's/the process's/ ?

[davidben, 2016/12/14 00:59:43]

Done.

+NET_EXPORT_PRIVATE scoped_refptr<SSLPrivateKey>

[Ryan Sleevi, 2016/12/13 22:21:07]

Any documentation about threading?

e.g.

"Note: This function may block on external resources, and should generally only
be called on worker threads."

(Or something to the effect)

[davidben, 2016/12/14 00:59:43]

Unfortunately, this is currently called on the IO thread. :-/

To fix that, we need to do the thing where ClientCertStore vends out
"identities" which are certs + a handle which can be cashed in for one of these,
at which point I expect this will no longer be exposed and it'd be a funny
ClientCertStoreMac constructor or something.

+FetchClientCertPrivateKeyFromKeychain(X509Certificate* certificate,

[Ryan Sleevi, 2016/12/13 22:21:07]

nit: const? 

[davidben, 2016/12/14 00:59:43]

Done.

+                                      SecKeychainRef keychain);
+
+}  // namespace net
+
+#endif  // NET_SSL_SSL_PLATFORM_KEY_MAC_H_