This applies GUIDs to certificate and key nicknames when

net/base/cert_database_nss.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
 #include <secmod.h>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "crypto/nss_util.h"
 #include "crypto/nss_util_internal.h"
 #include "net/base/crypto_module.h"
 #include "net/base/net_errors.h"
 #include "net/base/x509_certificate.h"
+#include "net/base/x509_util_nss.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertificateDB.h"
 #include "net/third_party/mozilla_security_manager/nsNSSCertTrust.h"
 #include "net/third_party/mozilla_security_manager/nsPKCS12Blob.h"
 
 // In NSS 3.13, CERTDB_VALID_PEER was renamed CERTDB_TERMINAL_RECORD. So we use
 // the new name of the macro.
 #if !defined(CERTDB_TERMINAL_RECORD)
 #define CERTDB_TERMINAL_RECORD CERTDB_VALID_PEER
 #endif
 
@@ skipping 29 matching lines @@
   PK11_FreeSlot(slot);
 
   return OK;
 }
 
 int CertDatabase::AddUserCert(X509Certificate* cert_obj) {
   CERTCertificate* cert = cert_obj->os_cert_handle();
   PK11SlotInfo* slot = NULL;
   std::string nickname;
 
-  // Create a nickname for this certificate.
-  // We use the scheme used by Firefox:
-  // --> <subject's common name>'s <issuer's common name> ID.
-
-  std::string username, ca_name;
-  char* temp_username = CERT_GetCommonName(&cert->subject);
-  char* temp_ca_name = CERT_GetCommonName(&cert->issuer);
-  if (temp_username) {
-    username = temp_username;
-    PORT_Free(temp_username);
-  }
-  if (temp_ca_name) {
-    ca_name = temp_ca_name;
-    PORT_Free(temp_ca_name);
-  }
-  nickname = username + "'s " + ca_name + " ID";
-
   {
     crypto::AutoNSSWriteLock lock;
-    slot = PK11_ImportCertForKey(cert,
-                                 const_cast<char*>(nickname.c_str()),
-                                 NULL);
+    slot = PK11_ImportCertForKey(

[wtc, 2011/12/08 00:07:43]

Please add a CHECK (non-debug assertion) here to assert that
x509_util::GetCertType(root) is USER_CERT.

[Greg Spencer (Chromium), 2011/12/09 18:51:38]

Now that we are supplying the cert type to GetDefaultNickname (as it is now
called), I don't think the CHECK is needed.

+        cert,
+        x509_util::GetDefaultCertificateLabel(cert_obj).c_str(),
+        NULL);
   }
 
   if (!slot) {
     LOG(ERROR) << "Couldn't import user certificate.";
     return ERR_ADD_USER_CERT_FAILED;
   }
   PK11_FreeSlot(slot);
   CertDatabase::NotifyObserversOfUserCertAdded(cert_obj);
   return OK;
 }
@@ skipping 53 matching lines @@
                                     PR_FALSE);  // restart
   }
 
   PK11_FreeSlotList(slot_list);
 }
 
 int CertDatabase::ImportFromPKCS12(
     CryptoModule* module,
     const std::string& data,
     const string16& password,
-    bool is_extractable) {
+    bool is_extractable,
+    net::CertificateList* imported_certs) {
   int result = psm::nsPKCS12Blob_Import(module->os_module_handle(),
                                         data.data(), data.size(),
                                         password,
-                                        is_extractable);
+                                        is_extractable,
+                                        imported_certs);
   if (result == net::OK)
     CertDatabase::NotifyObserversOfUserCertAdded(NULL);
 
   return result;
 }
 
 int CertDatabase::ExportToPKCS12(
     const CertificateList& certs,
     const string16& password,
     std::string* output) const {
@@ skipping 142 matching lines @@
     }
   } else {
     if (SEC_DeletePermCertificate(cert->os_cert_handle())) {
       LOG(ERROR) << "SEC_DeletePermCertificate failed: " << PORT_GetError();
       return false;
     }
   }
   return true;
 }
 
-bool CertDatabase::DeleteCertAndKeyByLabel(const std::string& label) {
-  // TODO(gspencer):Find the certificate with the given CKA_LABEL
-  // (nickname), and delete it.
-  NOTIMPLEMENTED();
-  return false;
-}
-
 bool CertDatabase::IsReadOnly(const X509Certificate* cert) const {
   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
   return slot && PK11_IsReadOnly(slot);
 }
 
 }  // namespace net