Fix webui cert viewer showing wrong cert chain on NSS and no chain on OpenSSL.

chrome/browser/ui/certificate_dialogs.h

Index: chrome/browser/ui/certificate_dialogs.h
diff --git a/chrome/browser/ui/certificate_dialogs.h b/chrome/browser/ui/certificate_dialogs.h
index 9787ffc769774f118cbce5d66be215f9fe19984e..a7227ddb9b0c9a3dd85e82472c55d75dcbe67d57 100644
--- a/chrome/browser/ui/certificate_dialogs.h
+++ b/chrome/browser/ui/certificate_dialogs.h
@@ -20,6 +20,12 @@ void ShowCertSelectFileDialog(ui::SelectFileDialog* select_file_dialog,
 
 void ShowCertExportDialog(content::WebContents* web_contents,
                           gfx::NativeWindow parent,
-                          net::X509Certificate::OSCertHandle cert);
+                          net::X509Certificate* cert);

[Ryan Sleevi, 2014/07/10 02:50:18]

Since you're changing the type, it'd be "nicer" to pass a const-ref
scoped_refptr<>, since that's our signal "ownership may change here" (ala
scoped_ptr<>)

[mattm, 2014/07/10 22:57:59]

Done.

+
+void ShowCertExportDialog(
+    content::WebContents* web_contents,
+    gfx::NativeWindow parent,
+    net::X509Certificate::OSCertHandles::iterator certs_begin,
+    net::X509Certificate::OSCertHandles::iterator certs_end);

[Ryan Sleevi, 2014/07/08 02:18:36]

I'm a little confused by this.

I would think that ShowCertExportDialog(net::X509Certificate*) would be
sufficient, as that handles both single-cert and cert-chains. Have I missed
something?

It may be because I'm not familiar with the WebUI dialog here, but I would
think:

- If I click "View Certificate" from the Trust management dialog, only a single
certificate is exported
- If I click "View Certificate" from the status bubble, and click "Export
Certificate", then the entire chain is exported. Always. That is, it does not
depend on the current cert I've selected, it's always "the chain that I'm
viewing" that's exported.

Is that not the case today?

[mattm, 2014/07/08 02:39:47]

Yeah, if you select one of the other certs in the chain in the cert viewer, and
click export, it'll export from that one up.

[Ryan Sleevi, 2014/07/10 02:50:18]

I'm not sure why we did that, nor am I convinced we want that, but OK.

Any chance we can change this behaviour? Or do we need to punt to UI (who have
largely said "IDK whatever")

[mattm, 2014/07/10 22:57:59]

Firefox cert viewer does the same, and we copied their design. I guess we could
change it if you propose what the new UI should look like. Like I was saying
above it does make some sort of sense to me since selecting a cert in the chain
changes both which cert data is shown and which cert will be exported.

 
 #endif  // CHROME_BROWSER_UI_CERTIFICATE_DIALOGS_H_