nss: Fix GetCertType returning SERVER_CERT for explicitly distrusted CA certs.

chrome/third_party/mozilla_security_manager/nsNSSCertHelper.cpp

Index: chrome/third_party/mozilla_security_manager/nsNSSCertHelper.cpp
diff --git a/chrome/third_party/mozilla_security_manager/nsNSSCertHelper.cpp b/chrome/third_party/mozilla_security_manager/nsNSSCertHelper.cpp
index 2f9a4e9e017e5064a1aa721dea83e59cc48a789c..56565fceaf77c39f23ae6b4f86b30f5eacfed25e 100644
--- a/chrome/third_party/mozilla_security_manager/nsNSSCertHelper.cpp
+++ b/chrome/third_party/mozilla_security_manager/nsNSSCertHelper.cpp
@@ -1056,12 +1056,10 @@ net::CertType GetCertType(CERTCertificate *cert) {
   nsNSSCertTrust trust(cert->trust);
   if (cert->nickname && trust.HasAnyUser())
     return net::USER_CERT;
-  if (trust.HasAnyCA())
+  if (trust.HasAnyCA() || CERT_IsCACert(cert, NULL))
     return net::CA_CERT;
   if (trust.HasPeer(PR_TRUE, PR_FALSE, PR_FALSE))
     return net::SERVER_CERT;
-  if (CERT_IsCACert(cert, NULL))
-    return net::CA_CERT;
   return net::UNKNOWN_CERT;
 }