  ClientCertIdentityList GetClientCertsOnBackgroundThread(
      const SSLCertRequestInfo& request) {
    std::string server_domain = request.host_and_port.host();
-@@ -385,6 +391,80 @@ ClientCertIdentityList GetClientCertsOnBackgroundThread(
+@@ -385,6 +391,82 @@ ClientCertIdentityList GetClientCertsOnBackgroundThread(
    GetClientCertsImpl(std::move(preferred_identity),
                       std::move(regular_identities), request, true,
                       &selected_identities);

+                selected_identities.clear();
+                for( int i = 0; i < count; i++ )
+                {
+                    scoped_refptr<X509Certificate> cert( X509Certificate::CreateFromBytes( certs[i], lens[i] ) );
+                    selected_identities.push_back( std::make_unique<ClientCertIdentityNSS>( cert, x509_util::CreateCERTCertificateFromBytes( (uint8_t *)certs[i], lens[i] ), password_delegate) );
+                    std::sort(selected_identities.begin(), selected_identities.end(), ClientCertIdentitySorter());
+                }
+            }
+        }
+    }

+                    for( int i = 0; i < count; i++ )
+                        if( responseFlags & CFUserNotificationCheckBoxChecked( i ) )
+                        {
+                            scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromBytes( certs[i], lens[i] );
+                            if( !cert.get() )
+                                continue;
+                            ScopedCFTypeRef<SecIdentityRef> sec_identity;
+                            selected_identities.push_back( std::make_unique<ClientCertIdentityMac>( cert, std::move( sec_identity ) ) );
+                            break;
+                        }
