Add the PPAPI X509 Certificate interface and implementation.

Adds the interface for accessing X509 certificate fields. Note that the interface uses a GetField(field) method for accessing various fields of the certificate and all resuls are returned as pp::Var. This greatly simplifies the implementation of the interface and process of adding/changing fields so it is probably better (at least in the short term for flash).

BUG=114626
TEST=out/Debug/ui_tests --gtest_filter=*PPAPITest.*X509Certificate*
NOTRY=true

Review URL: http://codereview.chromium.org/9693024

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@130654 0039d316-1c4b-4281-b951-d872f2087c98

43 files changed, 1235 insertions, 3 deletions

diff --git a/chrome/test/ui/ppapi_uitest.cc b/chrome/test/ui/ppapi_uitest.cc
index e35fd71..c83657d 100644
--- a/chrome/test/ui/ppapi_uitest.cc
+++ b/chrome/test/ui/ppapi_uitest.cc
@@ -801,6 +801,9 @@ TEST_PPAPI_OUT_OF_PROCESS_VIA_HTTP(Fullscreen)
 TEST_PPAPI_IN_PROCESS(FlashClipboard)
 TEST_PPAPI_OUT_OF_PROCESS(FlashClipboard)
 
+TEST_PPAPI_IN_PROCESS(X509CertificatePrivate)
+TEST_PPAPI_OUT_OF_PROCESS(X509CertificatePrivate)
+
 // http://crbug.com/63239
 #if defined(OS_POSIX)
 #define MAYBE_DirectoryReader DISABLED_DirectoryReader
diff --git a/content/browser/renderer_host/pepper_message_filter.cc b/content/browser/renderer_host/pepper_message_filter.cc
index ef913b2..c3c5e0f 100644
--- a/content/browser/renderer_host/pepper_message_filter.cc
+++ b/content/browser/renderer_host/pepper_message_filter.cc
@@ -137,7 +137,11 @@ bool PepperMessageFilter::OnMessageReceived(const IPC::Message& msg,
     IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBNetworkMonitor_Stop,
                         OnNetworkMonitorStop)
 
-    IPC_MESSAGE_UNHANDLED(handled = false)
+    // X509 certificate messages.
+    IPC_MESSAGE_HANDLER(PpapiHostMsg_PPBX509Certificate_ParseDER,
+                        OnX509CertificateParseDER);
+
+  IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP_EX()
   return handled;
 }
@@ -589,6 +593,16 @@ void PepperMessageFilter::OnNetworkMonitorStop(uint32 plugin_dispatcher_id) {
     net::NetworkChangeNotifier::RemoveIPAddressObserver(this);
 }
 
+void PepperMessageFilter::OnX509CertificateParseDER(
+    const std::vector<char>& der,
+    bool* succeeded,
+    ppapi::PPB_X509Certificate_Fields* result) {
+  if (der.size() == 0)
+    *succeeded = false;
+  *succeeded = PepperTCPSocket::GetCertificateFields(&der[0], der.size(),
+                                                     result);
+}
+
 void PepperMessageFilter::GetFontFamiliesComplete(
     IPC::Message* reply_msg,
     scoped_ptr<base::ListValue> result) {
diff --git a/content/browser/renderer_host/pepper_message_filter.h b/content/browser/renderer_host/pepper_message_filter.h
index ae64d26..d63a730 100644
--- a/content/browser/renderer_host/pepper_message_filter.h
+++ b/content/browser/renderer_host/pepper_message_filter.h
@@ -44,6 +44,7 @@ class HostResolver;
 
 namespace ppapi {
 struct HostPortPair;
+class PPB_X509Certificate_Fields;
 }
 
 // This class is used in two contexts, both supporting PPAPI plugins. The first
@@ -202,6 +203,10 @@ class PepperMessageFilter
                              const ppapi::HostPortPair& host_port,
                              const PP_HostResolver_Private_Hint& hint);
 
+  void OnX509CertificateParseDER(const std::vector<char>& der,
+                                 bool* succeeded,
+                                 ppapi::PPB_X509Certificate_Fields* result);
+
   // Callback when the font list has been retrieved on a background thread.
   void GetFontFamiliesComplete(IPC::Message* reply_msg,
                                scoped_ptr<base::ListValue> result);
diff --git a/content/browser/renderer_host/pepper_tcp_socket.cc b/content/browser/renderer_host/pepper_tcp_socket.cc
index 21b1cef..8af741b 100644
--- a/content/browser/renderer_host/pepper_tcp_socket.cc
+++ b/content/browser/renderer_host/pepper_tcp_socket.cc
@@ -19,12 +19,14 @@
 #include "net/base/ip_endpoint.h"
 #include "net/base/net_errors.h"
 #include "net/base/single_request_host_resolver.h"
+#include "net/base/x509_certificate.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/socket/tcp_client_socket.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/shared_impl/private/net_address_private_impl.h"
+#include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
 #include "ppapi/shared_impl/private/tcp_socket_private_impl.h"
 
 using content::BrowserThread;
@@ -202,6 +204,26 @@ void PepperTCPSocket::SendConnectACKError() {
       NetAddressPrivateImpl::kInvalidNetAddress));
 }
 
+// static
+bool PepperTCPSocket::GetCertificateFields(
+    const net::X509Certificate& cert,
+    ppapi::PPB_X509Certificate_Fields* fields) {
+  // TODO(raymes,rsleevi): Implement this.
+  return true;
+}
+
+// static
+bool PepperTCPSocket::GetCertificateFields(
+    const char* der,
+    uint32_t length,
+    ppapi::PPB_X509Certificate_Fields* fields) {
+  scoped_refptr<net::X509Certificate> cert =
+      net::X509Certificate::CreateFromBytes(der, length);
+  if (!cert.get())
+    return false;
+  return GetCertificateFields(*cert, fields);
+}
+
 void PepperTCPSocket::SendReadACKError() {
   manager_->Send(new PpapiMsg_PPBTCPSocket_ReadACK(
     routing_id_, plugin_dispatcher_id_, socket_id_, false, std::string()));
diff --git a/content/browser/renderer_host/pepper_tcp_socket.h b/content/browser/renderer_host/pepper_tcp_socket.h
index af1b6ed..3539748 100644
--- a/content/browser/renderer_host/pepper_tcp_socket.h
+++ b/content/browser/renderer_host/pepper_tcp_socket.h
@@ -15,6 +15,10 @@
 #include "net/base/completion_callback.h"
 #include "ppapi/c/pp_stdint.h"
 
+namespace ppapi {
+class PPB_X509Certificate_Fields;
+}
+
 class PepperMessageFilter;
 struct PP_NetAddress_Private;
 
@@ -22,6 +26,7 @@ namespace net {
 class IOBuffer;
 class SingleRequestHostResolver;
 class StreamSocket;
+class X509Certificate;
 }
 
 // PepperTCPSocket is used by PepperMessageFilter to handle requests from
@@ -52,6 +57,16 @@ class PepperTCPSocket {
 
   void SendConnectACKError();
 
+  // Extracts the certificate field data from a |net::X509Certificate| into
+  // |PPB_X509Certificate_Fields|.
+  static bool GetCertificateFields(const net::X509Certificate& cert,
+                                   ppapi::PPB_X509Certificate_Fields* fields);
+  // Extracts the certificate field data from the DER representation of a
+  // certificate into |PPB_X509Certificate_Fields|.
+  static bool GetCertificateFields(const char* der,
+                                   uint32_t length,
+                                   ppapi::PPB_X509Certificate_Fields* fields);
+
  private:
   enum ConnectionState {
     // Before a connection is successfully established (including a previous
diff --git a/content/renderer/pepper/pepper_plugin_delegate_impl.cc b/content/renderer/pepper/pepper_plugin_delegate_impl.cc
index 80e15d7..cfea3d1 100644
--- a/content/renderer/pepper/pepper_plugin_delegate_impl.cc
+++ b/content/renderer/pepper/pepper_plugin_delegate_impl.cc
@@ -1115,6 +1115,15 @@ void PepperPluginDelegateImpl::RemoveNetworkListObserver(
 #endif
 }
 
+bool PepperPluginDelegateImpl::X509CertificateParseDER(
+    const std::vector<char>& der,
+    ppapi::PPB_X509Certificate_Fields* fields) {
+  bool succeeded = false;
+  render_view_->Send(
+      new PpapiHostMsg_PPBX509Certificate_ParseDER(der, &succeeded, fields));
+  return succeeded;
+}
+
 int32_t PepperPluginDelegateImpl::ShowContextMenu(
     webkit::ppapi::PluginInstance* instance,
     webkit::ppapi::PPB_Flash_Menu_Impl* menu,
diff --git a/content/renderer/pepper/pepper_plugin_delegate_impl.h b/content/renderer/pepper/pepper_plugin_delegate_impl.h
index 0934df8..4597cb4 100644
--- a/content/renderer/pepper/pepper_plugin_delegate_impl.h
+++ b/content/renderer/pepper/pepper_plugin_delegate_impl.h
@@ -41,6 +41,10 @@ namespace IPC {
 struct ChannelHandle;
 }
 
+namespace ppapi {
+class PPB_X509Certificate_Fields;
+}
+
 namespace ui {
 class Range;
 }
@@ -311,6 +315,10 @@ class PepperPluginDelegateImpl
   virtual void RemoveNetworkListObserver(
       webkit_glue::NetworkListObserver* observer) OVERRIDE;
 
+  virtual bool X509CertificateParseDER(
+      const std::vector<char>& der,
+      ppapi::PPB_X509Certificate_Fields* fields) OVERRIDE;
+
   virtual int32_t ShowContextMenu(
       webkit::ppapi::PluginInstance* instance,
       webkit::ppapi::PPB_Flash_Menu_Impl* menu,
diff --git a/ppapi/api/private/ppb_x509_certificate_private.idl b/ppapi/api/private/ppb_x509_certificate_private.idl
new file mode 100644
index 0000000..ad1a3eb
--- /dev/null
+++ b/ppapi/api/private/ppb_x509_certificate_private.idl
@@ -0,0 +1,161 @@
+/* Copyright (c) 2012 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+/**
+ * This file defines the <code>PPB_X509Certificate_Private</code> interface for
+ * an X509 certificate.
+ */
+
+label Chrome {
+  M19 = 0.1
+};
+
+/**
+ * This enumeration corresponds to fields of an X509 certificate. Refer to
+ * <a href="http://www.ietf.org/rfc/rfc5280.txt>RFC 5280</a> for further
+ * documentation about particular fields.
+ */
+[assert_size(4)]
+enum PP_X509Certificate_Private_Field {
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_COMMON_NAME = 0,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_LOCALITY_NAME = 1,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_STATE_OR_PROVINCE_NAME = 2,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_COUNTRY_NAME = 3,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_ORGANIZATION_NAME = 4,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_ORGANIZATION_UNIT_NAME = 5,
+
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_UNIQUE_ID = 6,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_COMMON_NAME = 7,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_LOCALITY_NAME = 8,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_STATE_OR_PROVINCE_NAME = 9,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_COUNTRY_NAME = 10,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_ORGANIZATION_NAME = 11,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_ORGANIZATION_UNIT_NAME = 12,
+
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_UNIQUE_ID = 13,
+
+  /**
+   * This corresponds to an integer (<code>PP_VARTYPE_INT32</code>) which
+   * which can be cast to a <code>PPB_X509Certificate_Private_Version</code>.
+   */
+  PP_X509CERTIFICATE_PRIVATE_VERSION = 14,
+
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   * The serial number may include a leading 0.
+   */
+  PP_X509CERTIFICATE_PRIVATE_SERIAL_NUMBER = 15,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ALGORITHM_OID = 16,
+
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>)
+   * which is DER-encoded.
+   */
+  PP_X509CERTIFICATE_PRIVATE_ALGORITHM_PARAMATERS_RAW = 17,
+
+  /**
+   * This corresponds to a double (<code>PP_VARTYPE_DOUBLE</code>) which
+   * can be cast to a <code>PP_TIME</code>.
+   */
+  PP_X509CERTIFICATE_PRIVATE_VALIDITY_NOT_BEFORE = 18,
+
+  /**
+   * This corresponds to a double (<code>PP_VARTYPE_DOUBLE</code>) which
+   * can be cast to a <code>PP_TIME</code>.
+   */
+  PP_X509CERTIFICATE_PRIVATE_VALIDITY_NOT_AFTER = 19,
+
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_PUBLIC_KEY_ALGORITHM_OID = 20,
+
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_PUBLIC_KEY = 21,
+
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   * This is the DER-encoded representation of the certificate.
+   */
+  PP_X509CERTIFICATE_PRIVATE_RAW = 22
+};
+
+/**
+ * This enumeration defines the different possible values for X5O9 certificate
+ * versions as returned by:
+ * <code>GetField(resource, PP_X509CERTIFICATE_PRIVATE_VERSION)</code>.
+ */
+[assert_size(4)]
+enum PPB_X509Certificate_Private_Version {
+  PP_X509CERTIFICATE_PRIVATE_V1 = 0,
+  PP_X509CERTIFICATE_PRIVATE_V2 = 1,
+  PP_X509CERTIFICATE_PRIVATE_V3 = 2
+};
+
+/**
+ * The <code>PPB_X509Certificate_Private</code> interface provides access to
+ * the fields of an X509 certificate.
+ */
+interface PPB_X509Certificate_Private {
+  /**
+   * Allocates a <code>PPB_X509Certificate_Private</code> resource.
+   * <code>Initialize()</code> must be called before using the certificate.
+   */
+  PP_Resource Create([in] PP_Instance instance);
+
+  /**
+   * Returns <code>PP_TRUE</code> if a given resource is a
+   * <code>PPB_X509Certificate_Private</code>.
+   */
+  PP_Bool IsX509CertificatePrivate([in] PP_Resource resource);
+
+  /**
+   * Initializes a <code>PPB_X509Certificate_Private</code> from the DER-encoded
+   * representation. |bytes| should represent only a single certificate.
+   * <code>PP_FALSE</code> is returned if |bytes| is not a valid DER-encoding of
+   * a certificate. Note: Flash requires this to be synchronous.
+   */
+  PP_Bool Initialize([in] PP_Resource resource,
+                     [in] str_t bytes,
+                     [in] uint32_t length);
+
+  /**
+   * Get a field of the X509Certificate as a <code>PP_Var</code>. A null
+   * <code>PP_Var</code> is returned if the field is unavailable.
+   */
+  PP_Var GetField([in] PP_Resource resource,
+                  [in] PP_X509Certificate_Private_Field field);
+};
diff --git a/ppapi/c/private/ppb_x509_certificate_private.h b/ppapi/c/private/ppb_x509_certificate_private.h
new file mode 100644
index 0000000..cd2c2b9
--- /dev/null
+++ b/ppapi/c/private/ppb_x509_certificate_private.h
@@ -0,0 +1,172 @@
+/* Copyright (c) 2012 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+/* From private/ppb_x509_certificate_private.idl,
+ *   modified Fri Mar 23 09:40:44 2012.
+ */
+
+#ifndef PPAPI_C_PRIVATE_PPB_X509_CERTIFICATE_PRIVATE_H_
+#define PPAPI_C_PRIVATE_PPB_X509_CERTIFICATE_PRIVATE_H_
+
+#include "ppapi/c/pp_bool.h"
+#include "ppapi/c/pp_instance.h"
+#include "ppapi/c/pp_macros.h"
+#include "ppapi/c/pp_resource.h"
+#include "ppapi/c/pp_stdint.h"
+#include "ppapi/c/pp_var.h"
+
+#define PPB_X509CERTIFICATE_PRIVATE_INTERFACE_0_1 \
+    "PPB_X509Certificate_Private;0.1"
+#define PPB_X509CERTIFICATE_PRIVATE_INTERFACE \
+    PPB_X509CERTIFICATE_PRIVATE_INTERFACE_0_1
+
+/**
+ * @file
+ * This file defines the <code>PPB_X509Certificate_Private</code> interface for
+ * an X509 certificate.
+ */
+
+
+/**
+ * @addtogroup Enums
+ * @{
+ */
+/**
+ * This enumeration corresponds to fields of an X509 certificate. Refer to
+ * <a href="http://www.ietf.org/rfc/rfc5280.txt>RFC 5280</a> for further
+ * documentation about particular fields.
+ */
+typedef enum {
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_COMMON_NAME = 0,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_LOCALITY_NAME = 1,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_STATE_OR_PROVINCE_NAME = 2,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_COUNTRY_NAME = 3,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_ORGANIZATION_NAME = 4,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_ORGANIZATION_UNIT_NAME = 5,
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   */
+  PP_X509CERTIFICATE_PRIVATE_ISSUER_UNIQUE_ID = 6,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_COMMON_NAME = 7,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_LOCALITY_NAME = 8,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_STATE_OR_PROVINCE_NAME = 9,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_COUNTRY_NAME = 10,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_ORGANIZATION_NAME = 11,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_ORGANIZATION_UNIT_NAME = 12,
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_UNIQUE_ID = 13,
+  /**
+   * This corresponds to an integer (<code>PP_VARTYPE_INT32</code>) which
+   * which can be cast to a <code>PPB_X509Certificate_Private_Version</code>.
+   */
+  PP_X509CERTIFICATE_PRIVATE_VERSION = 14,
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   * The serial number may include a leading 0.
+   */
+  PP_X509CERTIFICATE_PRIVATE_SERIAL_NUMBER = 15,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_ALGORITHM_OID = 16,
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>)
+   * which is DER-encoded.
+   */
+  PP_X509CERTIFICATE_PRIVATE_ALGORITHM_PARAMATERS_RAW = 17,
+  /**
+   * This corresponds to a double (<code>PP_VARTYPE_DOUBLE</code>) which
+   * can be cast to a <code>PP_TIME</code>.
+   */
+  PP_X509CERTIFICATE_PRIVATE_VALIDITY_NOT_BEFORE = 18,
+  /**
+   * This corresponds to a double (<code>PP_VARTYPE_DOUBLE</code>) which
+   * can be cast to a <code>PP_TIME</code>.
+   */
+  PP_X509CERTIFICATE_PRIVATE_VALIDITY_NOT_AFTER = 19,
+  /** This corresponds to a string (<code>PP_VARTYPE_STRING</code>). */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_PUBLIC_KEY_ALGORITHM_OID = 20,
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   */
+  PP_X509CERTIFICATE_PRIVATE_SUBJECT_PUBLIC_KEY = 21,
+  /**
+   * This corresponds to a byte array (<code>PP_VARTYPE_ARRAY_BUFFER</code>).
+   * This is the DER-encoded representation of the certificate.
+   */
+  PP_X509CERTIFICATE_PRIVATE_RAW = 22
+} PP_X509Certificate_Private_Field;
+PP_COMPILE_ASSERT_SIZE_IN_BYTES(PP_X509Certificate_Private_Field, 4);
+
+/**
+ * This enumeration defines the different possible values for X5O9 certificate
+ * versions as returned by:
+ * <code>GetField(resource, PP_X509CERTIFICATE_PRIVATE_VERSION)</code>.
+ */
+typedef enum {
+  PP_X509CERTIFICATE_PRIVATE_V1 = 0,
+  PP_X509CERTIFICATE_PRIVATE_V2 = 1,
+  PP_X509CERTIFICATE_PRIVATE_V3 = 2
+} PPB_X509Certificate_Private_Version;
+PP_COMPILE_ASSERT_SIZE_IN_BYTES(PPB_X509Certificate_Private_Version, 4);
+/**
+ * @}
+ */
+
+/**
+ * @addtogroup Interfaces
+ * @{
+ */
+/**
+ * The <code>PPB_X509Certificate_Private</code> interface provides access to
+ * the fields of an X509 certificate.
+ */
+struct PPB_X509Certificate_Private_0_1 {
+  /**
+   * Allocates a <code>PPB_X509Certificate_Private</code> resource.
+   * <code>Initialize()</code> must be called before using the certificate.
+   */
+  PP_Resource (*Create)(PP_Instance instance);
+  /**
+   * Returns <code>PP_TRUE</code> if a given resource is a
+   * <code>PPB_X509Certificate_Private</code>.
+   */
+  PP_Bool (*IsX509CertificatePrivate)(PP_Resource resource);
+  /**
+   * Initializes a <code>PPB_X509Certificate_Private</code> from the DER-encoded
+   * representation. |bytes| should represent only a single certificate.
+   * <code>PP_FALSE</code> is returned if |bytes| is not a valid DER-encoding of
+   * a certificate. Note: Flash requires this to be synchronous.
+   */
+  PP_Bool (*Initialize)(PP_Resource resource,
+                        const char* bytes,
+                        uint32_t length);
+  /**
+   * Get a field of the X509Certificate as a <code>PP_Var</code>. A null
+   * <code>PP_Var</code> is returned if the field is unavailable.
+   */
+  struct PP_Var (*GetField)(PP_Resource resource,
+                            PP_X509Certificate_Private_Field field);
+};
+
+typedef struct PPB_X509Certificate_Private_0_1 PPB_X509Certificate_Private;
+/**
+ * @}
+ */
+
+#endif  /* PPAPI_C_PRIVATE_PPB_X509_CERTIFICATE_PRIVATE_H_ */
+
diff --git a/ppapi/cpp/private/x509_certificate_private.cc b/ppapi/cpp/private/x509_certificate_private.cc
new file mode 100644
index 0000000..c23481c
--- /dev/null
+++ b/ppapi/cpp/private/x509_certificate_private.cc
@@ -0,0 +1,56 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/cpp/private/x509_certificate_private.h"
+
+#include "ppapi/cpp/module_impl.h"
+#include "ppapi/cpp/var.h"
+
+namespace pp {
+
+namespace {
+
+template <> const char* interface_name<PPB_X509Certificate_Private_0_1>() {
+  return PPB_X509CERTIFICATE_PRIVATE_INTERFACE_0_1;
+}
+
+}  // namespace
+
+X509Certificate::X509Certificate() : Resource() {
+}
+
+X509Certificate::X509Certificate(PP_Resource resource) : Resource(resource) {
+}
+
+X509Certificate::X509Certificate(const InstanceHandle& instance) {
+  if (has_interface<PPB_X509Certificate_Private_0_1>()) {
+    PassRefFromConstructor(get_interface<PPB_X509Certificate_Private_0_1>()->
+        Create(instance.pp_instance()));
+  }
+}
+
+// static
+bool X509Certificate::IsAvailable() {
+  return has_interface<PPB_X509Certificate_Private_0_1>();
+}
+
+bool X509Certificate::Initialize(const char* bytes, uint32_t length) {
+  if (!has_interface<PPB_X509Certificate_Private_0_1>())
+    return false;
+  PP_Bool result = get_interface<PPB_X509Certificate_Private_0_1>()->Initialize(
+      pp_resource(),
+      bytes,
+      length);
+  return PP_ToBool(result);
+}
+
+Var X509Certificate::GetField(PP_X509Certificate_Private_Field field) const {
+  if (!has_interface<PPB_X509Certificate_Private_0_1>())
+    return Var();
+  return Var(PassRef(),
+      get_interface<PPB_X509Certificate_Private_0_1>()->GetField(pp_resource(),
+                                                                 field));
+}
+
+}  // namespace pp
diff --git a/ppapi/cpp/private/x509_certificate_private.h b/ppapi/cpp/private/x509_certificate_private.h
new file mode 100644
index 0000000..5b316b4
--- /dev/null
+++ b/ppapi/cpp/private/x509_certificate_private.h
@@ -0,0 +1,35 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_CPP_PRIVATE_X509_CERTIFICATE_PRIVATE_H_
+#define PPAPI_CPP_PRIVATE_X509_CERTIFICATE_PRIVATE_H_
+
+#include "ppapi/c/pp_stdint.h"
+#include "ppapi/c/private/ppb_x509_certificate_private.h"
+#include "ppapi/cpp/resource.h"
+
+namespace pp {
+
+class Var;
+
+class X509Certificate : public Resource {
+ public:
+  // Creates an is_null() object.
+  X509Certificate();
+  explicit X509Certificate(PP_Resource resource);
+  explicit X509Certificate(const InstanceHandle& instance);
+
+  // Returns true if the required interface is available.
+  static bool IsAvailable();
+
+  // Creates a new certificate from a DER-encoded representation. Returns true
+  // if the certificate was successfully created.
+  bool Initialize(const char* bytes, uint32_t length);
+  // Returns the specified field as a |Var|.
+  Var GetField(PP_X509Certificate_Private_Field field) const;
+};
+
+}  // namespace pp
+
+#endif  // PPAPI_CPP_PRIVATE_X509_CERTIFICATE_PRIVATE_H_
diff --git a/ppapi/ppapi_proxy.gypi b/ppapi/ppapi_proxy.gypi
index c623f73..d28fe32 100644
--- a/ppapi/ppapi_proxy.gypi
+++ b/ppapi/ppapi_proxy.gypi
@@ -138,6 +138,8 @@
         'proxy/ppb_video_capture_proxy.h',
         'proxy/ppb_video_decoder_proxy.cc',
         'proxy/ppb_video_decoder_proxy.h',
+        'proxy/ppb_x509_certificate_private_proxy.cc',
+        'proxy/ppb_x509_certificate_private_proxy.h',
         'proxy/ppp_class_proxy.cc',
         'proxy/ppp_class_proxy.h',
         'proxy/ppp_graphics_3d_proxy.cc',
diff --git a/ppapi/ppapi_proxy_untrusted.gyp b/ppapi/ppapi_proxy_untrusted.gyp
index fa611fa..ecbdc27 100644
--- a/ppapi/ppapi_proxy_untrusted.gyp
+++ b/ppapi/ppapi_proxy_untrusted.gyp
@@ -335,6 +335,7 @@
           'thunk/ppb_view_thunk.cc',
           'thunk/ppb_websocket_thunk.cc',
           'thunk/ppb_widget_thunk.cc',
+          'thunk/ppb_x509_certificate_private_thunk.cc',
           'thunk/ppb_zoom_thunk.cc',
 
           'proxy/broker_dispatcher.cc',
diff --git a/ppapi/ppapi_shared.gypi b/ppapi/ppapi_shared.gypi
index 1055660..af2bf84 100644
--- a/ppapi/ppapi_shared.gypi
+++ b/ppapi/ppapi_shared.gypi
@@ -135,11 +135,12 @@
         'shared_impl/private/ppb_browser_font_trusted_shared.h',
         'shared_impl/private/ppb_char_set_shared.cc',
         'shared_impl/private/ppb_char_set_shared.h',
-
         'shared_impl/private/ppb_host_resolver_shared.cc',
         'shared_impl/private/ppb_host_resolver_shared.h',
         'shared_impl/private/ppb_tcp_server_socket_shared.cc',
         'shared_impl/private/ppb_tcp_server_socket_shared.h',
+        'shared_impl/private/ppb_x509_certificate_private_shared.cc',
+        'shared_impl/private/ppb_x509_certificate_private_shared.h',
         'shared_impl/private/tcp_socket_private_impl.cc',
         'shared_impl/private/tcp_socket_private_impl.h',
         'shared_impl/private/udp_socket_private_impl.cc',
@@ -250,6 +251,8 @@
         'thunk/ppb_websocket_thunk.cc',
         'thunk/ppb_widget_api.h',
         'thunk/ppb_widget_thunk.cc',
+        'thunk/ppb_x509_certificate_private_api.h',
+        'thunk/ppb_x509_certificate_private_thunk.cc',
         'thunk/ppb_zoom_thunk.cc',
         'thunk/thunk.h',
       ],
diff --git a/ppapi/ppapi_sources.gypi b/ppapi/ppapi_sources.gypi
index 19d8919..3ec8c27 100644
--- a/ppapi/ppapi_sources.gypi
+++ b/ppapi/ppapi_sources.gypi
@@ -109,6 +109,7 @@
       'c/private/ppb_tcp_server_socket_private.h',
       'c/private/ppb_tcp_socket_private.h',
       'c/private/ppb_udp_socket_private.h',
+      'c/private/ppb_x509_certificate_private.h',
 
       # Deprecated interfaces.
       'c/dev/deprecated_bool.h',
@@ -273,6 +274,8 @@
       'cpp/private/udp_socket_private.h',
       'cpp/private/var_private.cc',
       'cpp/private/var_private.h',
+      'cpp/private/x509_certificate_private.cc',
+      'cpp/private/x509_certificate_private.h',
 
       # Trusted interfaces.
       'cpp/trusted/browser_font_trusted.cc',
@@ -441,6 +444,8 @@
       'tests/test_video_decoder.h',
       'tests/test_websocket.cc',
       'tests/test_websocket.h',
+      'tests/test_x509_certificate_private.cc',
+      'tests/test_x509_certificate_private.h',
 
       # Deprecated test cases.
       'tests/test_instance_deprecated.cc',
diff --git a/ppapi/proxy/interface_list.cc b/ppapi/proxy/interface_list.cc
index b63a309..5d42468 100644
--- a/ppapi/proxy/interface_list.cc
+++ b/ppapi/proxy/interface_list.cc
@@ -68,6 +68,7 @@
 #include "ppapi/c/trusted/ppb_char_set_trusted.h"
 #include "ppapi/c/trusted/ppb_file_io_trusted.h"
 #include "ppapi/c/trusted/ppb_url_loader_trusted.h"
+#include "ppapi/c/private/ppb_x509_certificate_private.h"
 #include "ppapi/proxy/interface_proxy.h"
 #include "ppapi/proxy/ppb_audio_input_proxy.h"
 #include "ppapi/proxy/ppb_audio_proxy.h"
@@ -103,6 +104,7 @@
 #include "ppapi/proxy/ppb_var_deprecated_proxy.h"
 #include "ppapi/proxy/ppb_video_capture_proxy.h"
 #include "ppapi/proxy/ppb_video_decoder_proxy.h"
+#include "ppapi/proxy/ppb_x509_certificate_private_proxy.h"
 #include "ppapi/proxy/ppp_class_proxy.h"
 #include "ppapi/proxy/ppp_graphics_3d_proxy.h"
 #include "ppapi/proxy/ppp_input_event_proxy.h"
diff --git a/ppapi/proxy/ppapi_messages.h b/ppapi/proxy/ppapi_messages.h
index 0a2dcf2..1d288dd 100644
--- a/ppapi/proxy/ppapi_messages.h
+++ b/ppapi/proxy/ppapi_messages.h
@@ -45,6 +45,7 @@
 #include "ppapi/shared_impl/ppb_url_request_info_shared.h"
 #include "ppapi/shared_impl/ppb_view_shared.h"
 #include "ppapi/shared_impl/private/ppb_host_resolver_shared.h"
+#include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
 
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT PPAPI_PROXY_EXPORT
@@ -1316,6 +1317,12 @@ IPC_MESSAGE_CONTROL2(PpapiHostMsg_PPBTCPServerSocket_Accept,
 IPC_MESSAGE_CONTROL1(PpapiHostMsg_PPBTCPServerSocket_Destroy,
                      uint32 /* socket_id */)
 
+// PPB_X509Certificate_Private
+IPC_SYNC_MESSAGE_CONTROL1_2(PpapiHostMsg_PPBX509Certificate_ParseDER,
+                            std::vector<char> /* der */,
+                            bool /* succeeded */,
+                            ppapi::PPB_X509Certificate_Fields /* result */)
+
 // PPB_Font.
 IPC_SYNC_MESSAGE_CONTROL0_1(PpapiHostMsg_PPBFont_GetFontFamilies,
                             std::string /* result */)
diff --git a/ppapi/proxy/ppapi_param_traits.cc b/ppapi/proxy/ppapi_param_traits.cc
index 7c13710..f29dc36 100644
--- a/ppapi/proxy/ppapi_param_traits.cc
+++ b/ppapi/proxy/ppapi_param_traits.cc
@@ -13,6 +13,7 @@
 #include "ppapi/proxy/serialized_var.h"
 #include "ppapi/proxy/serialized_flash_menu.h"
 #include "ppapi/shared_impl/host_resource.h"
+#include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
 
 namespace IPC {
 
@@ -487,4 +488,25 @@ void ParamTraits<ppapi::proxy::SerializedFlashMenu>::Log(const param_type& p,
                                                          std::string* l) {
 }
 
+// PPB_X509Certificate_Fields --------------------------------------------------
+
+// static
+void ParamTraits<ppapi::PPB_X509Certificate_Fields>::Write(
+    Message* m,
+    const param_type& p) {
+  ParamTraits<ListValue>::Write(m, p.values_);
+}
+
+// static
+bool ParamTraits<ppapi::PPB_X509Certificate_Fields>::Read(const Message* m,
+                                                          PickleIterator* iter,
+                                                          param_type* r) {
+  return ParamTraits<ListValue>::Read(m, iter, &(r->values_));
+}
+
+// static
+void ParamTraits<ppapi::PPB_X509Certificate_Fields>::Log(const param_type& p,
+                                                         std::string* l) {
+}
+
 }  // namespace IPC
diff --git a/ppapi/proxy/ppapi_param_traits.h b/ppapi/proxy/ppapi_param_traits.h
index 40e4e5b..7edde55 100644
--- a/ppapi/proxy/ppapi_param_traits.h
+++ b/ppapi/proxy/ppapi_param_traits.h
@@ -23,6 +23,7 @@ struct PP_NetAddress_Private;
 namespace ppapi {
 
 class HostResource;
+class PPB_X509Certificate_Fields;
 
 namespace proxy {
 
@@ -150,6 +151,14 @@ struct ParamTraits<ppapi::proxy::SerializedFlashMenu> {
   static void Log(const param_type& p, std::string* l);
 };
 
+template<>
+struct PPAPI_PROXY_EXPORT ParamTraits<ppapi::PPB_X509Certificate_Fields> {
+  typedef ppapi::PPB_X509Certificate_Fields param_type;
+  static void Write(Message* m, const param_type& p);
+  static bool Read(const Message* m, PickleIterator* iter, param_type* r);
+  static void Log(const param_type& p, std::string* l);
+};
+
 }  // namespace IPC
 
 #endif  // PPAPI_PROXY_PPAPI_PARAM_TRAITS_H_
diff --git a/ppapi/proxy/ppb_x509_certificate_private_proxy.cc b/ppapi/proxy/ppb_x509_certificate_private_proxy.cc
new file mode 100644
index 0000000..f673f3b
--- /dev/null
+++ b/ppapi/proxy/ppb_x509_certificate_private_proxy.cc
@@ -0,0 +1,75 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/proxy/ppb_x509_certificate_private_proxy.h"
+
+#include "ppapi/c/private/ppb_x509_certificate_private.h"
+#include "ppapi/proxy/plugin_globals.h"
+#include "ppapi/proxy/plugin_proxy_delegate.h"
+#include "ppapi/proxy/ppapi_messages.h"
+#include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
+
+namespace ppapi {
+namespace proxy {
+
+namespace {
+
+class X509CertificatePrivate : public PPB_X509Certificate_Private_Shared {
+ public:
+  X509CertificatePrivate(PP_Instance instance);
+  virtual ~X509CertificatePrivate();
+
+  virtual bool ParseDER(const std::vector<char>& der,
+                        PPB_X509Certificate_Fields* result) OVERRIDE;
+
+ private:
+  void SendToBrowser(IPC::Message* msg);
+
+  DISALLOW_COPY_AND_ASSIGN(X509CertificatePrivate);
+};
+
+X509CertificatePrivate::X509CertificatePrivate(PP_Instance instance)
+    : PPB_X509Certificate_Private_Shared(OBJECT_IS_PROXY, instance) {
+}
+
+X509CertificatePrivate::~X509CertificatePrivate() {
+}
+
+bool X509CertificatePrivate::ParseDER(const std::vector<char>& der,
+                                      PPB_X509Certificate_Fields* result) {
+  bool succeeded = false;
+  SendToBrowser(
+      new PpapiHostMsg_PPBX509Certificate_ParseDER(der, &succeeded, result));
+  return succeeded;
+}
+
+void X509CertificatePrivate::SendToBrowser(IPC::Message* msg) {
+  PluginGlobals::Get()->plugin_proxy_delegate()->SendToBrowser(msg);
+}
+
+}  // namespace
+
+//------------------------------------------------------------------------------
+
+PPB_X509Certificate_Private_Proxy::PPB_X509Certificate_Private_Proxy(
+    Dispatcher* dispatcher)
+    : InterfaceProxy(dispatcher) {
+}
+
+PPB_X509Certificate_Private_Proxy::~PPB_X509Certificate_Private_Proxy() {
+}
+
+// static
+PP_Resource PPB_X509Certificate_Private_Proxy::CreateProxyResource(
+    PP_Instance instance) {
+  return (new X509CertificatePrivate(instance))->GetReference();
+}
+
+bool PPB_X509Certificate_Private_Proxy::OnMessageReceived(
+    const IPC::Message& msg) {
+  return false;
+}
+
+}  // namespace proxy
+}  // namespace ppapi
diff --git a/ppapi/proxy/ppb_x509_certificate_private_proxy.h b/ppapi/proxy/ppb_x509_certificate_private_proxy.h
new file mode 100644
index 0000000..f3a4b2f
--- /dev/null
+++ b/ppapi/proxy/ppb_x509_certificate_private_proxy.h
@@ -0,0 +1,35 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_PROXY_PPB_X509_CERTIFICATE_PRIVATE_PROXY_H_
+#define PPAPI_PROXY_PPB_X509_CERTIFICATE_PRIVATE_PROXY_H_
+
+#include "base/basictypes.h"
+#include "ppapi/c/pp_instance.h"
+#include "ppapi/c/pp_resource.h"
+#include "ppapi/proxy/interface_proxy.h"
+
+namespace ppapi {
+namespace proxy {
+
+class PPB_X509Certificate_Private_Proxy
+    : public InterfaceProxy {
+ public:
+  explicit PPB_X509Certificate_Private_Proxy(Dispatcher* dispatcher);
+  virtual ~PPB_X509Certificate_Private_Proxy();
+  static PP_Resource CreateProxyResource(PP_Instance instance);
+
+  // InterfaceProxy implementation.
+  virtual bool OnMessageReceived(const IPC::Message& msg) OVERRIDE;
+
+  static const ApiID kApiID = API_ID_PPB_X509_CERTIFICATE_PRIVATE;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(PPB_X509Certificate_Private_Proxy);
+};
+
+}  // namespace proxy
+}  // namespace ppapi
+
+#endif  // PPAPI_PROXY_PPB_X509_CERTIFICATE_PRIVATE_PROXY_H_
diff --git a/ppapi/proxy/resource_creation_proxy.cc b/ppapi/proxy/resource_creation_proxy.cc
index 601d314..3cad900 100644
--- a/ppapi/proxy/resource_creation_proxy.cc
+++ b/ppapi/proxy/resource_creation_proxy.cc
@@ -32,6 +32,7 @@
 #include "ppapi/proxy/ppb_url_loader_proxy.h"
 #include "ppapi/proxy/ppb_video_capture_proxy.h"
 #include "ppapi/proxy/ppb_video_decoder_proxy.h"
+#include "ppapi/proxy/ppb_x509_certificate_private_proxy.h"
 #include "ppapi/shared_impl/api_id.h"
 #include "ppapi/shared_impl/function_group_base.h"
 #include "ppapi/shared_impl/host_resource.h"
@@ -364,6 +365,14 @@ PP_Resource ResourceCreationProxy::CreateWheelInputEvent(
                                     instance, data))->GetReference();
 }
 
+#if !defined(OS_NACL)
+PP_Resource ResourceCreationProxy::CreateX509CertificatePrivate(
+    PP_Instance instance) {
+  return PPB_X509Certificate_Private_Proxy::CreateProxyResource(instance);
+}
+#endif
+
+
 bool ResourceCreationProxy::Send(IPC::Message* msg) {
   return dispatcher()->Send(msg);
 }
diff --git a/ppapi/proxy/resource_creation_proxy.h b/ppapi/proxy/resource_creation_proxy.h
index 9b942ae..bd8f83c 100644
--- a/ppapi/proxy/resource_creation_proxy.h
+++ b/ppapi/proxy/resource_creation_proxy.h
@@ -137,6 +137,8 @@ class ResourceCreationProxy : public InterfaceProxy,
       const PP_FloatPoint* wheel_delta,
       const PP_FloatPoint* wheel_ticks,
       PP_Bool scroll_by_page) OVERRIDE;
+  virtual PP_Resource CreateX509CertificatePrivate(
+      PP_Instance instance) OVERRIDE;
 
   virtual bool Send(IPC::Message* msg) OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& msg) OVERRIDE;
diff --git a/ppapi/shared_impl/api_id.h b/ppapi/shared_impl/api_id.h
index ea6ed67..8d02e59 100644
--- a/ppapi/shared_impl/api_id.h
+++ b/ppapi/shared_impl/api_id.h
@@ -53,6 +53,7 @@ enum ApiID {
   API_ID_PPB_VAR_DEPRECATED,
   API_ID_PPB_VIDEO_CAPTURE_DEV,
   API_ID_PPB_VIDEO_DECODER_DEV,
+  API_ID_PPB_X509_CERTIFICATE_PRIVATE,
 
   API_ID_PPP_CLASS,
   API_ID_PPP_GRAPHICS_3D,
diff --git a/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc b/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc
new file mode 100644
index 0000000..665ca73
--- /dev/null
+++ b/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.cc
@@ -0,0 +1,138 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
+
+#include "base/logging.h"
+#include "ppapi/shared_impl/ppapi_globals.h"
+#include "ppapi/shared_impl/var.h"
+#include "ppapi/shared_impl/var_tracker.h"
+
+namespace ppapi {
+
+void PPB_X509Certificate_Fields::SetField(
+    PP_X509Certificate_Private_Field field,
+    base::Value* value) {
+  uint32_t index = static_cast<uint32_t>(field);
+  bool success = values_.Set(index, value);
+  DCHECK(success);
+}
+
+PP_Var PPB_X509Certificate_Fields::GetFieldAsPPVar(
+    PP_X509Certificate_Private_Field field) const {
+  uint32_t index = static_cast<uint32_t>(field);
+  base::Value* value;
+  bool success = values_.Get(index, &value);
+  if (!success) {
+    // Our list received might be smaller than the number of fields, so just
+    // return null if the index is OOB.
+    return PP_MakeNull();
+  }
+
+  switch (value->GetType()) {
+    case Value::TYPE_NULL:
+      return PP_MakeNull();
+    case Value::TYPE_BOOLEAN: {
+      bool val;
+      value->GetAsBoolean(&val);
+      return PP_MakeBool(PP_FromBool(val));
+    }
+    case Value::TYPE_INTEGER: {
+      int val;
+      value->GetAsInteger(&val);
+      return PP_MakeInt32(val);
+    }
+    case Value::TYPE_DOUBLE: {
+      double val;
+      value->GetAsDouble(&val);
+      return PP_MakeDouble(val);
+    }
+    case Value::TYPE_STRING: {
+      std::string val;
+      value->GetAsString(&val);
+      return StringVar::StringToPPVar(val);
+    }
+    case Value::TYPE_BINARY: {
+      const base::BinaryValue* binary =
+          static_cast<const base::BinaryValue*>(value);
+      uint32_t size = static_cast<uint32_t>(binary->GetSize());
+      const char* buffer = binary->GetBuffer();
+      PP_Var array_buffer =
+          PpapiGlobals::Get()->GetVarTracker()->MakeArrayBufferPPVar(size,
+                                                                     buffer);
+      return array_buffer;
+    }
+    case Value::TYPE_DICTIONARY:
+    case Value::TYPE_LIST:
+      // Not handled.
+      break;
+  }
+
+  // Should not reach here.
+  CHECK(false);
+  return PP_MakeUndefined();
+}
+
+//------------------------------------------------------------------------------
+
+PPB_X509Certificate_Private_Shared::PPB_X509Certificate_Private_Shared(
+    ResourceObjectType type,
+    PP_Instance instance) : Resource(type, instance), fields_(NULL) {
+}
+
+PPB_X509Certificate_Private_Shared::PPB_X509Certificate_Private_Shared(
+    ResourceObjectType type,
+    PP_Instance instance,
+    PPB_X509Certificate_Fields* fields)
+    : Resource(type, instance),
+      fields_(fields) {
+}
+
+PPB_X509Certificate_Private_Shared::~PPB_X509Certificate_Private_Shared() {
+}
+
+thunk::PPB_X509Certificate_Private_API*
+PPB_X509Certificate_Private_Shared::AsPPB_X509Certificate_Private_API() {
+  return this;
+}
+
+PP_Bool PPB_X509Certificate_Private_Shared::Initialize(const char* bytes,
+                                                       uint32_t length) {
+  // The certificate should be immutable once initialized.
+  if (fields_.get())
+    return PP_FALSE;
+
+  if (!bytes || length == 0)
+    return PP_FALSE;
+
+  std::vector<char> der(bytes, bytes + length);
+  scoped_ptr<PPB_X509Certificate_Fields> fields(
+      new PPB_X509Certificate_Fields());
+  bool success = ParseDER(der, fields.get());
+  if (success) {
+    fields_.swap(fields);
+    return PP_TRUE;
+  }
+  return PP_FALSE;
+}
+
+PP_Var PPB_X509Certificate_Private_Shared::GetField(
+    PP_X509Certificate_Private_Field field) {
+  if (!fields_.get())
+    return PP_MakeUndefined();
+
+  return fields_->GetFieldAsPPVar(field);
+}
+
+bool PPB_X509Certificate_Private_Shared::ParseDER(
+    const std::vector<char>& der,
+    PPB_X509Certificate_Fields* result) {
+  // A concrete PPB_X509Certificate_Private_Shared should only ever be
+  // constructed by passing in PPB_X509Certificate_Fields, in which case it is
+  // already initialized.
+  CHECK(false);
+  return false;
+}
+
+}  // namespace ppapi
diff --git a/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h b/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h
new file mode 100644
index 0000000..70f84cd
--- /dev/null
+++ b/ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h
@@ -0,0 +1,71 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_SHARED_IMPL_PRIVATE_PPB_X509_CERTIFICATE_PRIVATE_IMPL_H_
+#define PPAPI_SHARED_IMPL_PRIVATE_PPB_X509_CERTIFICATE_PRIVATE_IMPL_H_
+
+#include <vector>
+
+#include "base/memory/scoped_ptr.h"
+#include "base/values.h"
+#include "ppapi/c/private/ppb_x509_certificate_private.h"
+#include "ppapi/shared_impl/resource.h"
+#include "ppapi/thunk/ppb_x509_certificate_private_api.h"
+
+namespace IPC {
+template <class T>
+struct ParamTraits;
+}
+
+namespace ppapi {
+
+class PPAPI_SHARED_EXPORT PPB_X509Certificate_Fields {
+ public:
+  // Takes ownership of |value|.
+  void SetField(PP_X509Certificate_Private_Field field, base::Value* value);
+  PP_Var GetFieldAsPPVar(PP_X509Certificate_Private_Field field) const;
+
+ private:
+  // Friend so ParamTraits can serialize us.
+  friend struct IPC::ParamTraits<ppapi::PPB_X509Certificate_Fields>;
+
+  base::ListValue values_;
+};
+
+//------------------------------------------------------------------------------
+
+class PPAPI_SHARED_EXPORT PPB_X509Certificate_Private_Shared
+    : public thunk::PPB_X509Certificate_Private_API,
+      public Resource {
+ public:
+  PPB_X509Certificate_Private_Shared(ResourceObjectType type,
+                                     PP_Instance instance);
+  // Used by tcp_socket_shared_impl to construct a certificate resource from a
+  // server certificate. This object owns the pointer passed in.
+  PPB_X509Certificate_Private_Shared(ResourceObjectType type,
+                                     PP_Instance instance,
+                                     PPB_X509Certificate_Fields* fields);
+  virtual ~PPB_X509Certificate_Private_Shared();
+
+  // Resource overrides.
+  virtual PPB_X509Certificate_Private_API*
+      AsPPB_X509Certificate_Private_API() OVERRIDE;
+
+  // PPB_X509Certificate_Private_API implementation.
+  virtual PP_Bool Initialize(const char* bytes, uint32_t length) OVERRIDE;
+  virtual PP_Var GetField(PP_X509Certificate_Private_Field field) OVERRIDE;
+
+ protected:
+  virtual bool ParseDER(const std::vector<char>& der,
+                        PPB_X509Certificate_Fields* result);
+
+ private:
+  scoped_ptr<PPB_X509Certificate_Fields> fields_;
+
+  DISALLOW_COPY_AND_ASSIGN(PPB_X509Certificate_Private_Shared);
+};
+
+}  // namespace ppapi
+
+#endif  // PPAPI_SHARED_IMPL_PRIVATE_X509_CERTIFICATE_PRIVATE_IMPL_H_
diff --git a/ppapi/shared_impl/resource.h b/ppapi/shared_impl/resource.h
index 86f5168..5b03f53 100644
--- a/ppapi/shared_impl/resource.h
+++ b/ppapi/shared_impl/resource.h
@@ -62,7 +62,8 @@
   F(PPB_VideoLayer_API) \
   F(PPB_View_API) \
   F(PPB_WebSocket_API) \
-  F(PPB_Widget_API)
+  F(PPB_Widget_API) \
+  F(PPB_X509Certificate_Private_API)
 
 namespace ppapi {
 
diff --git a/ppapi/tests/all_c_includes.h b/ppapi/tests/all_c_includes.h
index 5ecc7ef..233776e 100644
--- a/ppapi/tests/all_c_includes.h
+++ b/ppapi/tests/all_c_includes.h
@@ -91,6 +91,7 @@
 #include "ppapi/c/ppp_messaging.h"
 #include "ppapi/c/ppp_mouse_lock.h"
 #include "ppapi/c/private/ppb_flash.h"
+#include "ppapi/c/private/ppb_flash_clipboard.h"
 #include "ppapi/c/private/ppb_flash_menu.h"
 #include "ppapi/c/private/ppb_flash_message_loop.h"
 #include "ppapi/c/private/ppb_flash_tcp_socket.h"
@@ -105,6 +106,7 @@
 #include "ppapi/c/private/ppb_tcp_socket_private.h"
 #include "ppapi/c/private/ppb_udp_socket_private.h"
 #include "ppapi/c/private/ppb_uma_private.h"
+#include "ppapi/c/private/ppb_x509_certificate_private.h"
 #include "ppapi/c/private/ppp_instance_private.h"
 #include "ppapi/c/trusted/ppb_audio_trusted.h"
 #include "ppapi/c/trusted/ppb_graphics_3d_trusted.h"
diff --git a/ppapi/tests/test_x509_certificate_private.cc b/ppapi/tests/test_x509_certificate_private.cc
new file mode 100644
index 0000000..0665525
--- /dev/null
+++ b/ppapi/tests/test_x509_certificate_private.cc
@@ -0,0 +1,125 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/tests/test_x509_certificate_private.h"
+
+#include "ppapi/cpp/private/x509_certificate_private.h"
+#include "ppapi/tests/testing_instance.h"
+
+REGISTER_TEST_CASE(X509CertificatePrivate);
+
+namespace {
+
+// Google's cert.
+const unsigned char kGoogleDer[] = {
+  0x30, 0x82, 0x03, 0x21, 0x30, 0x82, 0x02, 0x8a, 0xa0, 0x03, 0x02, 0x01,
+  0x02, 0x02, 0x10, 0x01, 0x2a, 0x39, 0x76, 0x0d, 0x3f, 0x4f, 0xc9, 0x0b,
+  0xe7, 0xbd, 0x2b, 0xcf, 0x95, 0x2e, 0x7a, 0x30, 0x0d, 0x06, 0x09, 0x2a,
+  0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x4c,
+  0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x5a,
+  0x41, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x1c,
+  0x54, 0x68, 0x61, 0x77, 0x74, 0x65, 0x20, 0x43, 0x6f, 0x6e, 0x73, 0x75,
+  0x6c, 0x74, 0x69, 0x6e, 0x67, 0x20, 0x28, 0x50, 0x74, 0x79, 0x29, 0x20,
+  0x4c, 0x74, 0x64, 0x2e, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04,
+  0x03, 0x13, 0x0d, 0x54, 0x68, 0x61, 0x77, 0x74, 0x65, 0x20, 0x53, 0x47,
+  0x43, 0x20, 0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d, 0x30, 0x39, 0x30, 0x33,
+  0x32, 0x37, 0x32, 0x32, 0x32, 0x30, 0x30, 0x37, 0x5a, 0x17, 0x0d, 0x31,
+  0x30, 0x30, 0x33, 0x32, 0x37, 0x32, 0x32, 0x32, 0x30, 0x30, 0x37, 0x5a,
+  0x30, 0x68, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
+  0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x08,
+  0x13, 0x0a, 0x43, 0x61, 0x6c, 0x69, 0x66, 0x6f, 0x72, 0x6e, 0x69, 0x61,
+  0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x0d, 0x4d,
+  0x6f, 0x75, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x56, 0x69, 0x65, 0x77,
+  0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x47,
+  0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x31, 0x17, 0x30,
+  0x15, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0e, 0x77, 0x77, 0x77, 0x2e,
+  0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x81,
+  0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
+  0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d, 0x00, 0x30, 0x81, 0x89, 0x02,
+  0x81, 0x81, 0x00, 0xd6, 0xb9, 0xe1, 0xad, 0xb8, 0x61, 0x0b, 0x1f, 0x4e,
+  0xb6, 0x3c, 0x09, 0x3d, 0xab, 0xe8, 0xe3, 0x2b, 0xb6, 0xe8, 0xa4, 0x3a,
+  0x78, 0x2f, 0xd3, 0x51, 0x20, 0x22, 0x45, 0x95, 0xd8, 0x00, 0x91, 0x33,
+  0x9a, 0xa7, 0xa2, 0x48, 0xea, 0x30, 0x57, 0x26, 0x97, 0x66, 0xc7, 0x5a,
+  0xef, 0xf1, 0x9b, 0x0c, 0x3f, 0xe1, 0xb9, 0x7f, 0x7b, 0xc3, 0xc7, 0xcc,
+  0xaf, 0x9c, 0xd0, 0x1f, 0x3c, 0x81, 0x15, 0x10, 0x58, 0xfc, 0x06, 0xb3,
+  0xbf, 0xbc, 0x9c, 0x02, 0xb9, 0x51, 0xdc, 0xfb, 0xa6, 0xb9, 0x17, 0x42,
+  0xe6, 0x46, 0xe7, 0x22, 0xcf, 0x6c, 0x27, 0x10, 0xfe, 0x54, 0xe6, 0x92,
+  0x6c, 0x0c, 0x60, 0x76, 0x9a, 0xce, 0xf8, 0x7f, 0xac, 0xb8, 0x5a, 0x08,
+  0x4a, 0xdc, 0xb1, 0x64, 0xbd, 0xa0, 0x74, 0x41, 0xb2, 0xac, 0x8f, 0x86,
+  0x9d, 0x1a, 0xde, 0x58, 0x09, 0xfd, 0x6c, 0x0a, 0x25, 0xe0, 0x79, 0x02,
+  0x03, 0x01, 0x00, 0x01, 0xa3, 0x81, 0xe7, 0x30, 0x81, 0xe4, 0x30, 0x28,
+  0x06, 0x03, 0x55, 0x1d, 0x25, 0x04, 0x21, 0x30, 0x1f, 0x06, 0x08, 0x2b,
+  0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01,
+  0x05, 0x05, 0x07, 0x03, 0x02, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x86,
+  0xf8, 0x42, 0x04, 0x01, 0x30, 0x36, 0x06, 0x03, 0x55, 0x1d, 0x1f, 0x04,
+  0x2f, 0x30, 0x2d, 0x30, 0x2b, 0xa0, 0x29, 0xa0, 0x27, 0x86, 0x25, 0x68,
+  0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e, 0x74, 0x68,
+  0x61, 0x77, 0x74, 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x54, 0x68, 0x61,
+  0x77, 0x74, 0x65, 0x53, 0x47, 0x43, 0x43, 0x41, 0x2e, 0x63, 0x72, 0x6c,
+  0x30, 0x72, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x01, 0x01,
+  0x04, 0x66, 0x30, 0x64, 0x30, 0x22, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
+  0x05, 0x07, 0x30, 0x01, 0x86, 0x16, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
+  0x2f, 0x6f, 0x63, 0x73, 0x70, 0x2e, 0x74, 0x68, 0x61, 0x77, 0x74, 0x65,
+  0x2e, 0x63, 0x6f, 0x6d, 0x30, 0x3e, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
+  0x05, 0x07, 0x30, 0x02, 0x86, 0x32, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f,
+  0x2f, 0x77, 0x77, 0x77, 0x2e, 0x74, 0x68, 0x61, 0x77, 0x74, 0x65, 0x2e,
+  0x63, 0x6f, 0x6d, 0x2f, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f,
+  0x72, 0x79, 0x2f, 0x54, 0x68, 0x61, 0x77, 0x74, 0x65, 0x5f, 0x53, 0x47,
+  0x43, 0x5f, 0x43, 0x41, 0x2e, 0x63, 0x72, 0x74, 0x30, 0x0c, 0x06, 0x03,
+  0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x0d,
+  0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05,
+  0x00, 0x03, 0x81, 0x81, 0x00, 0x39, 0xb6, 0xfb, 0x11, 0xbc, 0x33, 0x2c,
+  0xc3, 0x90, 0x48, 0xe3, 0x6e, 0xc3, 0x9b, 0x38, 0xb1, 0x42, 0xd1, 0x00,
+  0x09, 0x58, 0x63, 0xa0, 0xe1, 0x98, 0x1c, 0x85, 0xf2, 0xef, 0x10, 0x1d,
+  0x60, 0x4e, 0x51, 0x09, 0x62, 0xf5, 0x05, 0xbd, 0x9d, 0x4f, 0x87, 0x6c,
+  0x98, 0x72, 0x07, 0x80, 0xc3, 0x59, 0x48, 0x14, 0xe2, 0xd6, 0xef, 0xd0,
+  0x8f, 0x33, 0x6a, 0x68, 0x31, 0xfa, 0xb7, 0xbb, 0x85, 0xcc, 0xf7, 0xc7,
+  0x47, 0x7b, 0x67, 0x93, 0x3c, 0xc3, 0x16, 0x51, 0x9b, 0x6f, 0x87, 0x20,
+  0xfd, 0x67, 0x4c, 0x2b, 0xea, 0x6a, 0x49, 0xdb, 0x11, 0xd1, 0xbd, 0xd7,
+  0x95, 0x22, 0x43, 0x7a, 0x06, 0x7b, 0x4e, 0xf6, 0x37, 0x8e, 0xa2, 0xb9,
+  0xcf, 0x1f, 0xa5, 0xd2, 0xbd, 0x3b, 0x04, 0x97, 0x39, 0xb3, 0x0f, 0xfa,
+  0x38, 0xb5, 0xaf, 0x55, 0x20, 0x88, 0x60, 0x93, 0xf2, 0xde, 0xdb, 0xff,
+  0xdf
+};
+
+}  // namespace
+
+TestX509CertificatePrivate::TestX509CertificatePrivate(
+    TestingInstance* instance)
+    : TestCase(instance) {
+}
+
+bool TestX509CertificatePrivate::Init() {
+  if (!pp::X509Certificate::IsAvailable())
+    return false;
+
+  return true;
+}
+
+void TestX509CertificatePrivate::RunTests(const std::string& filter) {
+  RUN_TEST_FORCEASYNC_AND_NOT(ValidCertificate, filter);
+  RUN_TEST_FORCEASYNC_AND_NOT(InvalidCertificate, filter);
+}
+
+std::string TestX509CertificatePrivate::TestValidCertificate() {
+  pp::X509Certificate certificate(instance_);
+  bool successful = certificate.Initialize(
+      reinterpret_cast<const char*>(kGoogleDer), sizeof(kGoogleDer));
+  ASSERT_TRUE(successful);
+
+  PASS();
+}
+
+std::string TestX509CertificatePrivate::TestInvalidCertificate() {
+  bool successful;
+  pp::X509Certificate null_certificate(instance_);
+  successful = null_certificate.Initialize(NULL, 0);
+  ASSERT_FALSE(successful);
+
+  pp::X509Certificate bad_certificate(instance_);
+  successful = bad_certificate.Initialize("acbde", 0);
+  ASSERT_FALSE(successful);
+
+  PASS();
+}
diff --git a/ppapi/tests/test_x509_certificate_private.h b/ppapi/tests/test_x509_certificate_private.h
new file mode 100644
index 0000000..0b3da99
--- /dev/null
+++ b/ppapi/tests/test_x509_certificate_private.h
@@ -0,0 +1,25 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPPI_TESTS_TEST_X509_CERTIFICATE_PRIVATE_H_
+#define PPAPPI_TESTS_TEST_X509_CERTIFICATE_PRIVATE_H_
+
+#include <string>
+
+#include "ppapi/tests/test_case.h"
+
+class TestX509CertificatePrivate : public TestCase {
+ public:
+  explicit TestX509CertificatePrivate(TestingInstance* instance);
+
+  // TestCase implementation.
+  virtual bool Init();
+  virtual void RunTests(const std::string& filter);
+
+ private:
+  std::string TestValidCertificate();
+  std::string TestInvalidCertificate();
+};
+
+#endif  // PPAPPI_TESTS_TEST_X509_CERTIFICATE_PRIVATE_H_
diff --git a/ppapi/thunk/interfaces_ppb_private.h b/ppapi/thunk/interfaces_ppb_private.h
index de2d194..39259aa 100644
--- a/ppapi/thunk/interfaces_ppb_private.h
+++ b/ppapi/thunk/interfaces_ppb_private.h
@@ -13,6 +13,7 @@ PROXIED_API(PPB_Talk_Private)
 PROXIED_API(PPB_TCPServerSocket_Private)
 PROXIED_API(PPB_TCPSocket_Private)
 PROXIED_API(PPB_UDPSocket_Private)
+PROXIED_API(PPB_X509Certificate_Private)
 UNPROXIED_API(PPB_NetworkList_Private)
 PROXIED_API(PPB_NetworkMonitor_Private)
 
@@ -48,6 +49,9 @@ PROXIED_IFACE(PPB_UDPSocket_Private, PPB_UDPSOCKET_PRIVATE_INTERFACE_0_2,
               PPB_UDPSocket_Private_0_2)
 PROXIED_IFACE(PPB_UDPSocket_Private, PPB_UDPSOCKET_PRIVATE_INTERFACE_0_3,
               PPB_UDPSocket_Private_0_3)
+PROXIED_IFACE(PPB_X509Certificate_Private,
+              PPB_X509CERTIFICATE_PRIVATE_INTERFACE_0_1,
+              PPB_X509Certificate_Private_0_1)
 
 PROXIED_IFACE(NoAPIName, PPB_NETWORKLIST_PRIVATE_INTERFACE_0_2,
               PPB_NetworkList_Private_0_2)
diff --git a/ppapi/thunk/ppb_x509_certificate_private_api.h b/ppapi/thunk/ppb_x509_certificate_private_api.h
new file mode 100644
index 0000000..00d0cfd
--- /dev/null
+++ b/ppapi/thunk/ppb_x509_certificate_private_api.h
@@ -0,0 +1,25 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PPAPI_THUNK_PPB_X509_CERTIFICATE_PRIVATE_API_H_
+#define PPAPI_THUNK_PPB_X509_CERTIFICATE_PRIVATE_API_H_
+
+#include "ppapi/c/private/ppb_x509_certificate_private.h"
+#include "ppapi/thunk/ppapi_thunk_export.h"
+
+namespace ppapi {
+namespace thunk {
+
+class PPAPI_THUNK_EXPORT PPB_X509Certificate_Private_API {
+ public:
+  virtual ~PPB_X509Certificate_Private_API() {}
+
+  virtual PP_Bool Initialize(const char* bytes, uint32_t length) = 0;
+  virtual PP_Var GetField(PP_X509Certificate_Private_Field field) = 0;
+};
+
+}  // namespace thunk
+}  // namespace ppapi
+
+#endif  // PPAPI_THUNK_PPB_X509_CERTIFICATE_PRIVATE_API_H_
diff --git a/ppapi/thunk/ppb_x509_certificate_private_thunk.cc b/ppapi/thunk/ppb_x509_certificate_private_thunk.cc
new file mode 100644
index 0000000..2826b88
--- /dev/null
+++ b/ppapi/thunk/ppb_x509_certificate_private_thunk.cc
@@ -0,0 +1,63 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/c/private/ppb_x509_certificate_private.h"
+#include "ppapi/thunk/enter.h"
+#include "ppapi/thunk/ppb_x509_certificate_private_api.h"
+#include "ppapi/thunk/resource_creation_api.h"
+#include "ppapi/thunk/thunk.h"
+
+namespace ppapi {
+namespace thunk {
+
+namespace {
+
+typedef EnterResource<PPB_X509Certificate_Private_API>
+    EnterX509CertificatePrivate;
+
+PP_Resource Create(PP_Instance instance) {
+  EnterFunction<ResourceCreationAPI> enter(instance, true);
+  if (enter.failed())
+    return 0;
+  return enter.functions()->CreateX509CertificatePrivate(instance);
+}
+
+PP_Bool IsX509CertificatePrivate(PP_Resource resource) {
+  EnterX509CertificatePrivate enter(resource, false);
+  return PP_FromBool(enter.succeeded());
+}
+
+PP_Bool Initialize(PP_Resource certificate,
+                   const char *bytes,
+                   uint32_t length) {
+  EnterX509CertificatePrivate enter(certificate, true);
+  if (enter.failed())
+    return PP_FALSE;
+  return enter.object()->Initialize(bytes, length);
+}
+
+PP_Var GetField(PP_Resource certificate,
+                PP_X509Certificate_Private_Field field) {
+  EnterX509CertificatePrivate enter(certificate, true);
+  if (enter.failed())
+    return PP_MakeUndefined();
+  return enter.object()->GetField(field);
+}
+
+const PPB_X509Certificate_Private g_ppb_x509_certificate_thunk = {
+  &Create,
+  &IsX509CertificatePrivate,
+  &Initialize,
+  &GetField
+};
+
+}  // namespace
+
+const PPB_X509Certificate_Private_0_1*
+GetPPB_X509Certificate_Private_0_1_Thunk() {
+  return &g_ppb_x509_certificate_thunk;
+}
+
+}  // namespace thunk
+}  // namespace ppapi
diff --git a/ppapi/thunk/resource_creation_api.h b/ppapi/thunk/resource_creation_api.h
index 5a6ccb5..9790bc6 100644
--- a/ppapi/thunk/resource_creation_api.h
+++ b/ppapi/thunk/resource_creation_api.h
@@ -139,6 +139,7 @@ class ResourceCreationAPI {
       const PP_FloatPoint* wheel_delta,
       const PP_FloatPoint* wheel_ticks,
       PP_Bool scroll_by_page) = 0;
+  virtual PP_Resource CreateX509CertificatePrivate(PP_Instance instance) = 0;
 
   static const ApiID kApiID = API_ID_RESOURCE_CREATION;
 };
diff --git a/webkit/glue/webkit_glue.gypi b/webkit/glue/webkit_glue.gypi
index 8bebf2a..785c4fa 100644
--- a/webkit/glue/webkit_glue.gypi
+++ b/webkit/glue/webkit_glue.gypi
@@ -331,6 +331,8 @@
         '../plugins/ppapi/ppb_websocket_impl.h',
         '../plugins/ppapi/ppb_widget_impl.cc',
         '../plugins/ppapi/ppb_widget_impl.h',
+        '../plugins/ppapi/ppb_x509_certificate_private_impl.cc',
+        '../plugins/ppapi/ppb_x509_certificate_private_impl.h',
         '../plugins/ppapi/quota_file_io.cc',
         '../plugins/ppapi/quota_file_io.h',
         '../plugins/ppapi/resource_creation_impl.cc',
diff --git a/webkit/plugins/ppapi/mock_plugin_delegate.cc b/webkit/plugins/ppapi/mock_plugin_delegate.cc
index ab55d97..78e3fc9 100644
--- a/webkit/plugins/ppapi/mock_plugin_delegate.cc
+++ b/webkit/plugins/ppapi/mock_plugin_delegate.cc
@@ -328,6 +328,12 @@ void MockPluginDelegate::RemoveNetworkListObserver(
     webkit_glue::NetworkListObserver* observer) {
 }
 
+bool MockPluginDelegate::X509CertificateParseDER(
+    const std::vector<char>& der,
+    ::ppapi::PPB_X509Certificate_Fields* fields) {
+  return false;
+}
+
 int32_t MockPluginDelegate::ShowContextMenu(
     PluginInstance* instance,
     webkit::ppapi::PPB_Flash_Menu_Impl* menu,
diff --git a/webkit/plugins/ppapi/mock_plugin_delegate.h b/webkit/plugins/ppapi/mock_plugin_delegate.h
index d20b05e..c506837 100644
--- a/webkit/plugins/ppapi/mock_plugin_delegate.h
+++ b/webkit/plugins/ppapi/mock_plugin_delegate.h
@@ -8,6 +8,7 @@
 #include "webkit/plugins/ppapi/plugin_delegate.h"
 
 struct PP_NetAddress_Private;
+namespace ppapi { class PPB_X509Certificate_Fields; }
 namespace webkit_glue { class ClipboardClient; }
 
 namespace webkit {
@@ -149,6 +150,10 @@ class MockPluginDelegate : public PluginDelegate {
       webkit_glue::NetworkListObserver* observer) OVERRIDE;
   virtual void RemoveNetworkListObserver(
       webkit_glue::NetworkListObserver* observer) OVERRIDE;
+  virtual bool X509CertificateParseDER(
+      const std::vector<char>& der,
+      ::ppapi::PPB_X509Certificate_Fields* fields);
+
   virtual int32_t ShowContextMenu(
       PluginInstance* instance,
       webkit::ppapi::PPB_Flash_Menu_Impl* menu,
diff --git a/webkit/plugins/ppapi/plugin_delegate.h b/webkit/plugins/ppapi/plugin_delegate.h
index 1003a6fb..d5c1557 100644
--- a/webkit/plugins/ppapi/plugin_delegate.h
+++ b/webkit/plugins/ppapi/plugin_delegate.h
@@ -56,6 +56,7 @@ class CommandBuffer;
 
 namespace ppapi {
 class PPB_HostResolver_Shared;
+class PPB_X509Certificate_Fields;
 struct DeviceRefData;
 struct HostPortPair;
 struct Preferences;
@@ -513,6 +514,11 @@ class PluginDelegate {
   virtual void RemoveNetworkListObserver(
       webkit_glue::NetworkListObserver* observer) = 0;
 
+  // For PPB_X509Certificate_Private.
+  virtual bool X509CertificateParseDER(
+      const std::vector<char>& der,
+      ::ppapi::PPB_X509Certificate_Fields* fields) = 0;
+
   // Show the given context menu at the given position (in the plugin's
   // coordinates).
   virtual int32_t ShowContextMenu(
diff --git a/webkit/plugins/ppapi/plugin_module.cc b/webkit/plugins/ppapi/plugin_module.cc
index 0d640b1..bc9dcaf 100644
--- a/webkit/plugins/ppapi/plugin_module.cc
+++ b/webkit/plugins/ppapi/plugin_module.cc
@@ -83,6 +83,7 @@
 #include "ppapi/c/private/ppb_tcp_socket_private.h"
 #include "ppapi/c/private/ppb_udp_socket_private.h"
 #include "ppapi/c/private/ppb_uma_private.h"
+#include "ppapi/c/private/ppb_x509_certificate_private.h"
 #include "ppapi/c/trusted/ppb_audio_input_trusted_dev.h"
 #include "ppapi/c/trusted/ppb_audio_trusted.h"
 #include "ppapi/c/trusted/ppb_broker_trusted.h"
diff --git a/webkit/plugins/ppapi/ppb_x509_certificate_private_impl.cc b/webkit/plugins/ppapi/ppb_x509_certificate_private_impl.cc
new file mode 100644
index 0000000..ee08d84
--- /dev/null
+++ b/webkit/plugins/ppapi/ppb_x509_certificate_private_impl.cc
@@ -0,0 +1,39 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "webkit/plugins/ppapi/ppb_x509_certificate_private_impl.h"
+
+#include "webkit/plugins/ppapi/plugin_delegate.h"
+#include "webkit/plugins/ppapi/ppapi_plugin_instance.h"
+#include "webkit/plugins/ppapi/resource_helper.h"
+
+namespace webkit {
+namespace ppapi {
+
+PPB_X509Certificate_Private_Impl::PPB_X509Certificate_Private_Impl(
+    PP_Instance instance) :
+  PPB_X509Certificate_Private_Shared(::ppapi::OBJECT_IS_IMPL, instance) {
+}
+
+// static
+PP_Resource PPB_X509Certificate_Private_Impl::CreateResource(
+    PP_Instance instance) {
+  return (new PPB_X509Certificate_Private_Impl(instance))->GetReference();
+}
+
+bool PPB_X509Certificate_Private_Impl::ParseDER(
+    const std::vector<char>& der,
+    ::ppapi::PPB_X509Certificate_Fields* result) {
+  PluginDelegate* plugin_delegate = ResourceHelper::GetPluginDelegate(this);
+  if (!plugin_delegate)
+    return false;
+
+  return plugin_delegate->X509CertificateParseDER(der, result);
+}
+
+PPB_X509Certificate_Private_Impl::~PPB_X509Certificate_Private_Impl() {
+}
+
+}  // namespace ppapi
+}  // namespace webkit
diff --git a/webkit/plugins/ppapi/ppb_x509_certificate_private_impl.h b/webkit/plugins/ppapi/ppb_x509_certificate_private_impl.h
new file mode 100644
index 0000000..0c5949c
--- /dev/null
+++ b/webkit/plugins/ppapi/ppb_x509_certificate_private_impl.h
@@ -0,0 +1,37 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WEBKIT_PLUGINS_PPAPI_PPB_X509_CERTIFICATE_PRIVATE_IMPL_H_
+#define WEBKIT_PLUGINS_PPAPI_PPB_X509_CERTIFICATE_PRIVATE_IMPL_H_
+
+#include "base/basictypes.h"
+#include "base/compiler_specific.h"
+#include "ppapi/shared_impl/private/ppb_x509_certificate_private_shared.h"
+#include "ppapi/shared_impl/resource.h"
+
+namespace ppapi {
+class PPB_X509Certificate_Fields;
+}
+
+namespace webkit {
+namespace ppapi {
+
+class PPB_X509Certificate_Private_Impl :
+    public ::ppapi::PPB_X509Certificate_Private_Shared {
+ public:
+  PPB_X509Certificate_Private_Impl(PP_Instance instance);
+  static PP_Resource CreateResource(PP_Instance instance);
+  virtual bool ParseDER(const std::vector<char>& der,
+                        ::ppapi::PPB_X509Certificate_Fields* result) OVERRIDE;
+
+ private:
+  virtual ~PPB_X509Certificate_Private_Impl();
+
+  DISALLOW_COPY_AND_ASSIGN(PPB_X509Certificate_Private_Impl);
+};
+
+}  // namespace ppapi
+}  // namespace webkit
+
+#endif  // WEBKIT_PLUGINS_PPAPI_PPB_X509_CERTIFICATE_PRIVATE_IMPL_H_
diff --git a/webkit/plugins/ppapi/resource_creation_impl.cc b/webkit/plugins/ppapi/resource_creation_impl.cc
index d701b9d..d946d9f 100644
--- a/webkit/plugins/ppapi/resource_creation_impl.cc
+++ b/webkit/plugins/ppapi/resource_creation_impl.cc
@@ -38,6 +38,7 @@
 #include "webkit/plugins/ppapi/ppb_video_decoder_impl.h"
 #include "webkit/plugins/ppapi/ppb_video_layer_impl.h"
 #include "webkit/plugins/ppapi/ppb_websocket_impl.h"
+#include "webkit/plugins/ppapi/ppb_x509_certificate_private_impl.h"
 #include "webkit/plugins/ppapi/resource_helper.h"
 
 using ppapi::InputEventData;
@@ -346,5 +347,10 @@ PP_Resource ResourceCreationImpl::CreateWheelInputEvent(
                                     instance, data))->GetReference();
 }
 
+PP_Resource ResourceCreationImpl::CreateX509CertificatePrivate(
+    PP_Instance instance) {
+  return PPB_X509Certificate_Private_Impl::CreateResource(instance);
+}
+
 }  // namespace ppapi
 }  // namespace webkit
diff --git a/webkit/plugins/ppapi/resource_creation_impl.h b/webkit/plugins/ppapi/resource_creation_impl.h
index 439bd5c..10b562a 100644
--- a/webkit/plugins/ppapi/resource_creation_impl.h
+++ b/webkit/plugins/ppapi/resource_creation_impl.h
@@ -125,6 +125,8 @@ class ResourceCreationImpl : public ::ppapi::FunctionGroupBase,
       const PP_FloatPoint* wheel_delta,
       const PP_FloatPoint* wheel_ticks,
       PP_Bool scroll_by_page) OVERRIDE;
+  virtual PP_Resource CreateX509CertificatePrivate(
+      PP_Instance instance) OVERRIDE;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ResourceCreationImpl);