Use X509_STORE_CTX::untrusted, not X509_STORE_CTX::chain in CertVerifyCallback.

net/socket/ssl_client_socket_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OpenSSL binding for SSLClientSocket. The class layout and general principle
 // of operation is derived from SSLClientSocketNSS.
 
 #include "net/socket/ssl_client_socket_openssl.h"
 
 #include <openssl/err.h>
@@ skipping 1487 matching lines @@
 
 int SSLClientSocketOpenSSL::CertVerifyCallback(X509_STORE_CTX* store_ctx) {
   if (!completed_handshake_) {
     // If the first handshake hasn't completed then we accept any certificates
     // because we verify after the handshake.
     return 1;
   }
 
   CHECK(server_cert_.get());
 
-  PeerCertificateChain chain(store_ctx->chain);
+  PeerCertificateChain chain(store_ctx->untrusted);
   if (chain.IsValid() && server_cert_->Equals(chain.AsOSChain()))
     return 1;
 
   if (!chain.IsValid())
     LOG(ERROR) << "Received invalid certificate chain between handshakes";
   else
     LOG(ERROR) << "Server certificate changed between handshakes";
   return 0;
 }
 
@@ skipping 46 matching lines @@
   DVLOG(2) << "next protocol: '" << npn_proto_ << "' status: " << npn_status_;
   return SSL_TLSEXT_ERR_OK;
 }
 
 scoped_refptr<X509Certificate>
 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const {
   return server_cert_;
 }
 
 }  // namespace net