Extract IsKnownRoot() functionality for testing if a certificate is a

net/cert/known_roots_nss.h

Index: net/cert/known_roots_nss.h
diff --git a/net/cert/known_roots_nss.h b/net/cert/known_roots_nss.h
new file mode 100644
index 0000000000000000000000000000000000000000..7d8d6e742745c5fe1839bd107e34e956aa9a2adb
--- /dev/null
+++ b/net/cert/known_roots_nss.h
@@ -0,0 +1,20 @@
+// Copyright (c) 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_CERT_KNOWN_ROOTS_NSS_H_
+#define NET_CERT_KNOWN_ROOTS_NSS_H_
+
+#include <certt.h>

[mattm, 2017/04/20 02:14:12]

typedef struct CERTCertificateStr CERTCertificate;

[eroman, 2017/04/20 17:30:59]

Done.

+
+#include "net/base/net_export.h"
+
+namespace net {
+
+// IsKnownRoot returns true if the given certificate is one that we believe
+// is a standard (as opposed to user-installed) root.
+bool IsKnownRoot(CERTCertificate* root);
+
+}  // namespace net
+
+#endif  // NET_CERT_KNOWN_ROOTS_NSS_H_