Add X509CertificateBytes which uses CRYPTO_BUFFER instead of macOS-native certificate types.

net/cert/cert_verify_proc_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_mac.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 
@@ skipping 184 matching lines @@
       verified_chain.push_back(chain_cert);
     }
   }
   if (!verified_cert) {
     NOTREACHED();
     verify_result->cert_status |= CERT_STATUS_INVALID;
     return;
   }
 
   scoped_refptr<X509Certificate> verified_cert_with_chain =
-      X509Certificate::CreateFromHandle(verified_cert, verified_chain);
+      x509_util::CreateX509CertificateFromSecCertificate(verified_cert,
+                                                         verified_chain);
   if (verified_cert_with_chain)
     verify_result->verified_cert = std::move(verified_cert_with_chain);
   else
     verify_result->cert_status |= CERT_STATUS_INVALID;
 }
 
 // Returns true if the certificate uses MD2, MD4, MD5, or SHA1, and false
 // otherwise. A return of false also includes the case where the signature
 // algorithm couldn't be conclusively labeled as weak.
-bool CertUsesWeakHash(X509Certificate::OSCertHandle cert_handle) {
+bool CertUsesWeakHash(SecCertificateRef cert_handle) {
   x509_util::CSSMCachedCertificate cached_cert;
   OSStatus status = cached_cert.Init(cert_handle);
   if (status)
     return false;
 
   x509_util::CSSMFieldValue signature_field;
   status =
       cached_cert.GetField(&CSSMOID_X509V1SignatureAlgorithm, &signature_field);
   if (status || !signature_field.field())
     return false;
@@ skipping 383 matching lines @@
     // If there are no known roots, then an API failure occurred. For safety,
     // assume that all certificates are issued by known roots.
     if (known_roots_.empty())
       return true;
 
     CFIndex n = CFArrayGetCount(chain);
     if (n < 1)
       return false;
     SecCertificateRef root_ref = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(chain, n - 1)));
-    SHA256HashValue hash = X509Certificate::CalculateFingerprint256(root_ref);
+    SHA256HashValue hash = x509_util::CalculateFingerprint256(root_ref);
     return known_roots_.find(hash) != known_roots_.end();
   }
 
  private:
   friend struct base::LazyInstanceTraitsBase<OSXKnownRootHelper>;
 
   OSXKnownRootHelper() {
     CFArrayRef cert_array = NULL;
     OSStatus rv = SecTrustSettingsCopyCertificates(
         kSecTrustSettingsDomainSystem, &cert_array);
     if (rv != noErr) {
       LOG(ERROR) << "Unable to determine trusted roots; assuming all roots are "
                  << "trusted! Error " << rv;
       return;
     }
     base::ScopedCFTypeRef<CFArrayRef> scoped_array(cert_array);
     for (CFIndex i = 0, size = CFArrayGetCount(cert_array); i < size; ++i) {
       SecCertificateRef cert = reinterpret_cast<SecCertificateRef>(
           const_cast<void*>(CFArrayGetValueAtIndex(cert_array, i)));
-      known_roots_.insert(X509Certificate::CalculateFingerprint256(cert));
+      known_roots_.insert(x509_util::CalculateFingerprint256(cert));
     }
   }
 
   ~OSXKnownRootHelper() {}
 
   std::set<SHA256HashValue, SHA256HashValueLessThan> known_roots_;
 };
 
 base::LazyInstance<OSXKnownRootHelper>::Leaky g_known_roots =
     LAZY_INSTANCE_INITIALIZER;
@@ skipping 125 matching lines @@
           "/System/Library/Keychains/SystemRootCertificates.keychain",
           &keychain);
       if (status)
         return NetErrorFromOSStatus(status);
       ScopedCFTypeRef<SecKeychainRef> scoped_keychain(keychain);
 
       CFArrayInsertValueAtIndex(mutable_keychain_search_list, 0, keychain);
     }
 
     ScopedCFTypeRef<CFMutableArrayRef> cert_array(
-        cert->CreateOSCertChainForCert());
+        x509_util::CreateSecCertificateArrayForX509Certificate(cert));
+    if (!cert_array)
+      return ERR_CERT_INVALID;
 
     // Beginning with the certificate chain as supplied by the server, attempt
     // to verify the chain. If a failure is encountered, trim a certificate
     // from the end (so long as one remains) and retry, in the hope of forcing
     // OS X to find a better path.
     while (CFArrayGetCount(cert_array) > 0) {
       ScopedCFTypeRef<SecTrustRef> temp_ref;
       SecTrustResultType temp_trust_result = kSecTrustResultDeny;
       ScopedCFTypeRef<CFArrayRef> temp_chain;
       CSSM_TP_APPLE_EVIDENCE_INFO* temp_chain_info = NULL;
@@ skipping 282 matching lines @@
     // EV cert and it was covered by CRLSets or revocation checking passed.
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   }
 
   return OK;
 }
 
 }  // namespace net
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"