Add X509CertificateBytes which uses CRYPTO_BUFFER instead of macOS-native certificate types.

build/config/crypto.gni

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # This file declares build flags for the SSL library configuration.
 #
 # TODO(brettw) this should probably be moved to src/crypto or somewhere, and
 # the global build dependency on it should be removed.
 #
 # PLEASE TRY TO AVOID ADDING FLAGS TO THIS FILE in cases where grit isn't
 # required. See the declare_args block of BUILDCONFIG.gn for advice on how
 # to set up feature flags.
 
 # True when we're using OpenSSL for representing certificates. When targeting
 # Android, the platform certificate library is used for certificate
 # verification. On NaCl, verification isn't supported. On other targets, this
 # flag also enables OpenSSL for certificate verification, but this configuration
 # is unsupported.
 use_openssl_certs = is_android || is_nacl
 
 # True if NSS is used for certificate handling. It is possible to use OpenSSL
 # for the crypto library, but NSS for the platform certificate library.
 use_nss_certs = is_linux
+
+# True if certificates are represented with DER byte buffers. This can be true
+# in addition to use_openssl_certs or use_nss_certs, in that case byte certs
+# are used internally but OpenSSL or NSS are used for certificate verification.
+# TODO(mattm): crbug.com/671420: Implement and enable this for all platforms.
+use_byte_certs = is_mac

[mattm, 2017/03/29 01:19:11]

My thought is to land the CL with this set to false, and then do the flag flip
in a separate CL. That way if anything needs to be reverted it can just revert
the flag flip CL. Then sometime later the old x509_certificate_mac and related
code could be deleted.

The other option would just be to rip out x509_certificate_mac and other old
code right away, and just deal with a big revert if it happens to be necessary.

Any opinions?