Allow the TrustStore interface to return matching intermediates, and identify distrusted certs.

net/cert/internal/cert_errors.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/cert_errors.h"
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_split.h"
 #include "base/strings/stringprintf.h"
@@ skipping 153 matching lines @@
   std::string result;
 
   for (size_t i = 0; i < cert_errors_.size(); ++i) {
     // Pretty print the current CertErrors. If there were no errors/warnings,
     // then continue.
     const CertErrors& errors = cert_errors_[i];
     std::string cert_errors_string = errors.ToDebugString();
     if (cert_errors_string.empty())
       continue;
 
-    // Add a header for the CertErrors that describes which certificate they
-    // apply to.
-    //
-    // TODO(eroman): Show the subject for trust anchor (which currently uses the
-    // bucket cert_errors_[certs.size()]).
+    // Add a header that identifies which certificate this CertErrors pertains
+    // to.
     std::string cert_name_debug_str;
     if (i < certs.size() && certs[i]) {
       RDNSequence subject;
       if (ParseName(certs[i]->tbs().subject_tlv, &subject) &&
           ConvertToRFC2253(subject, &cert_name_debug_str)) {
         cert_name_debug_str = " (" + cert_name_debug_str + ")";
       }
     }
 
     result +=
@@ skipping 10 matching lines @@
   if (!other_errors.empty()) {
     result += "----- Other errors (not certificate specific) -----\n";
     result += other_errors;
     result += "\n";
   }
 
   return result;
 }
 
 }  // namespace net