nss: Fix GetCertType returning SERVER_CERT for explicitly distrusted CA certs.

chrome/third_party/mozilla_security_manager/nsNSSCertHelper.cpp

 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
  *
  * Software distributed under the License is distributed on an "AS IS" basis,
  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
@@ skipping 1038 matching lines @@
     }
     SECKEY_DestroyPublicKey(key);
   }
   return rv;
 }
 
 net::CertType GetCertType(CERTCertificate *cert) {
   nsNSSCertTrust trust(cert->trust);
   if (cert->nickname && trust.HasAnyUser())
     return net::USER_CERT;
-  if (trust.HasAnyCA())
+  if (trust.HasAnyCA() || CERT_IsCACert(cert, NULL))
     return net::CA_CERT;
   if (trust.HasPeer(PR_TRUE, PR_FALSE, PR_FALSE))
     return net::SERVER_CERT;
-  if (CERT_IsCACert(cert, NULL))
-    return net::CA_CERT;
   return net::UNKNOWN_CERT;
 }
 
 }  // namespace mozilla_security_manager