Add X509CertificateBytes which uses CRYPTO_BUFFER instead of macOS-native certificate types.

net/cert/x509_util_mac.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_X509_UTIL_MAC_H_
 #define NET_CERT_X509_UTIL_MAC_H_
 
 #include <CoreFoundation/CFArray.h>
 #include <Security/Security.h>
 
 #include <string>
 
+#include "base/mac/scoped_cftyperef.h"
 #include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "net/base/hash_value.h"
 #include "net/base/net_export.h"
 
 namespace net {
 
+class X509Certificate;
+
 namespace x509_util {
 
+// Test that a given |cert_handle| is actually a valid X.509 certificate, and
+// return true if it is.
+//
+// On OS X, SecCertificateCreateFromData() does not return any errors if
+// called with invalid data, as long as data is present. The actual decoding
+// of the certificate does not happen until an API that requires a CSSM
+// handle is called. While SecCertificateGetCLHandle is the most likely
+// candidate, as it performs the parsing, it does not check whether the
+// parsing was actually successful. Instead, SecCertificateGetSubject is
+// used (supported since 10.3), as a means to check that the certificate
+// parsed as a valid X.509 certificate.
+bool NET_EXPORT IsValidSecCertificate(SecCertificateRef cert_handle);
+
+// Creates a SecCertificate handle from the DER-encoded representation.
+// Returns NULL on failure.
+base::ScopedCFTypeRef<SecCertificateRef> NET_EXPORT
+CreateSecCertificateFromBytes(const uint8_t* data, size_t length);
+
+// Returns a SecCertificate representing |cert|, or NULL on failure.
+base::ScopedCFTypeRef<SecCertificateRef> NET_EXPORT
+CreateSecCertificateFromX509Certificate(const X509Certificate* cert);
+
+// Returns a new CFMutableArrayRef containing this certificate and its
+// intermediate certificates in the form expected by Security.framework
+// and Keychain Services, or NULL on failure.
+// The first item in the array will be this certificate, followed by its
+// intermediates, if any.
+base::ScopedCFTypeRef<CFMutableArrayRef> NET_EXPORT
+CreateSecCertificateArrayForX509Certificate(X509Certificate* cert);
+
+// Creates an X509Certificate representing |sec_cert| with intermediates
+// |sec_chain|.
+scoped_refptr<X509Certificate> NET_EXPORT
+CreateX509CertificateFromSecCertificate(
+    SecCertificateRef sec_cert,
+    const std::vector<SecCertificateRef>& sec_chain);
+
+// Returns true if the certificate is self-signed.
+bool NET_EXPORT IsSelfSigned(SecCertificateRef cert_handle);
+
+// Calculates the SHA-256 fingerprint of the certificate.  Returns an empty
+// (all zero) fingerprint on failure.
+SHA256HashValue NET_EXPORT CalculateFingerprint256(SecCertificateRef cert);
+
 // Creates a security policy for certificates used as client certificates
 // in SSL.
 // If a policy is successfully created, it will be stored in
 // |*policy| and ownership transferred to the caller.
 OSStatus NET_EXPORT CreateSSLClientPolicy(SecPolicyRef* policy);
 
 // Create an SSL server policy. While certificate name validation will be
 // performed by SecTrustEvaluate(), it has the following limitations:
 // - Doesn't support IP addresses in dotted-quad literals (127.0.0.1)
 // - Doesn't support IPv6 addresses
@@ skipping 100 matching lines @@
   CSSM_HANDLE cached_cert_handle_;
 };
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"
 
 }  // namespace x509_util
 
 }  // namespace net
 
 #endif  // NET_CERT_X509_UTIL_MAC_H_