Refactor client cert private key handling.

content/public/browser/client_certificate_delegate.h

Index: content/public/browser/client_certificate_delegate.h
diff --git a/content/public/browser/client_certificate_delegate.h b/content/public/browser/client_certificate_delegate.h
index d957fd995b3fc26665a5d49cbcae0011642d10c7..9b65fd84d16200e084e279382e78f195efbb8985 100644
--- a/content/public/browser/client_certificate_delegate.h
+++ b/content/public/browser/client_certificate_delegate.h
@@ -8,6 +8,7 @@
 #include "base/macros.h"
 
 namespace net {
+class SSLPrivateKey;
 class X509Certificate;
 }
 
@@ -21,10 +22,12 @@ class ClientCertificateDelegate {
   ClientCertificateDelegate() {}
   virtual ~ClientCertificateDelegate() {}
 
-  // Continue the request with |cert|. |cert| may be nullptr to continue without
-  // supplying a certificate. This decision will be remembered for future
-  // requests to the domain.
-  virtual void ContinueWithCertificate(net::X509Certificate* cert) = 0;
+  // Continue the request with |cert| and matching |key|. |cert| or |key| may

[davidben, 2017/06/01 23:41:25]

or => and?

[mattm, 2017/06/02 04:04:20]

It's possible for |cert| to be non-null and |key| to be null (eg, if
AcquirePrivateKey fails).  Maybe "and/or"?

[davidben, 2017/06/07 23:06:16]

Well, cert non-null and key null doesn't mean to continue without a certificate.
It means to fail really really deep in the stack with
ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY, which is kinda weird.

It's this bizarre thing here:
https://docs.google.com/document/d/13qJRJKczwMu6Cqw_xEkGhp_pZrJI7P2s-jNCjVUAg...

Maybe just leave it at |cert| may be nullptr [...] for the time being?

[mattm, 2017/06/08 21:47:55]

Done, thanks.

+  // be nullptr to continue without supplying a certificate. This decision will
+  // be remembered for future requests to the domain.
+  virtual void ContinueWithCertificate(
+      scoped_refptr<net::X509Certificate> cert,
+      scoped_refptr<net::SSLPrivateKey> key) = 0;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ClientCertificateDelegate);