Work around GTE CyberTrust/Baltimore CyberTrust cross-signing issues

net/cert/test_root_certs.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_TEST_ROOT_CERTS_H_
 #define NET_CERT_TEST_ROOT_CERTS_H_
 
 #include "base/lazy_instance.h"
 #include "base/memory/ref_counted.h"
 #include "build/build_config.h"
@@ skipping 45 matching lines @@
   // Returns true if there are no certificates that have been marked trusted.
   bool IsEmpty() const;
 
 #if defined(OS_MACOSX) && !defined(OS_IOS)
   CFArrayRef temporary_roots() const { return temporary_roots_; }
 
   // Modifies the root certificates of |trust_ref| to include the
   // certificates stored in |temporary_roots_|. If IsEmpty() is true, this
   // does not modify |trust_ref|.
   OSStatus FixupSecTrustRef(SecTrustRef trust_ref) const;
+
+  // Configures whether or not the default/system root store should also
+  // be trusted. By default, this is true, indicating that the TestRootCerts
+  // are used in addition to OS trust store.
+  void SetAllowSystemTrust(bool allow_system_trust);
+
 #elif defined(OS_WIN)
   HCERTSTORE temporary_roots() const { return temporary_roots_; }
 
   // Returns an HCERTCHAINENGINE suitable to be used for certificate
   // validation routines, or NULL to indicate that the default system chain
   // engine is appropriate. The caller is responsible for freeing the
   // returned HCERTCHAINENGINE.
   HCERTCHAINENGINE GetChainEngine() const;
 #endif
 
  private:
   friend struct base::DefaultLazyInstanceTraits<TestRootCerts>;
 
   TestRootCerts();
   ~TestRootCerts();
 
   // Performs platform-dependent initialization.
   void Init();
 
 #if defined(USE_NSS) || defined(OS_IOS)
   // It is necessary to maintain a cache of the original certificate trust
   // settings, in order to restore them when Clear() is called.
   class TrustEntry;
   std::list<TrustEntry*> trust_cache_;
 #elif defined(OS_WIN)
   HCERTSTORE temporary_roots_;
 #elif defined(OS_MACOSX)
   base::mac::ScopedCFTypeRef<CFMutableArrayRef> temporary_roots_;
+  bool allow_system_trust_;
 #endif
 
 #if defined(OS_WIN) || defined(USE_OPENSSL)
   // True if there are no temporarily trusted root certificates.
   bool empty_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(TestRootCerts);
 };
 
@@ skipping 14 matching lines @@
 
  private:
   scoped_refptr<X509Certificate> cert_;
 
   DISALLOW_COPY_AND_ASSIGN(ScopedTestRoot);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_TEST_ROOT_CERTS_H_