This applies GUIDs to certificate and key nicknames when

net/base/x509_util_nss.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_UTIL_NSS_H_
 #define NET_BASE_X509_UTIL_NSS_H_
 #pragma once
 
 #include <string>
 
 #include "base/time.h"
+#include "net/base/cert_type.h"
 
 typedef struct CERTCertificateStr CERTCertificate;
 typedef struct SECKEYPrivateKeyStr SECKEYPrivateKey;
 typedef struct SECKEYPublicKeyStr SECKEYPublicKey;
 
 
 namespace net {
 
+class X509Certificate;
+
 namespace x509_util {
 
 // Creates a self-signed certificate containing |public_key|.  Subject, serial
 // number and validity period are given as parameters.  The certificate is
 // signed by |private_key|. The hashing algorithm for the signature is SHA-1.
 // |subject| is a distinguished name defined in RFC4514.
 CERTCertificate* CreateSelfSignedCert(
     SECKEYPublicKey* public_key,
     SECKEYPrivateKey* private_key,
     const std::string& subject,
     uint32 serial_number,
     base::TimeDelta valid_duration);
 
+// Returns a default label for the cert based on its type.  On ChromeOS, this
+// will return the certificate's label if set, and generate a new label if not.
+std::string GetDefaultCertificateLabel(const X509Certificate* cert);
+
+// Gets which type of certificate this is, based on the certificate's

[wtc, 2011/12/08 00:07:43]

Nit: Gets => Returns

+// properties.
+CertType GetCertType(const X509Certificate* cert);
+
+// These are only defined on ChromeOS because it is the only platform where
+// we have a patched NSS that will set labels on certificates.
+#if defined(OS_CHROMEOS)
+// Set/get the label of this certificate.  This corresponds to the CKA_LABEL

[wtc, 2011/12/08 00:07:43]

Nit: Set/get => Sets/gets

+// attribute of the certificate.  Setting the label on the certificate also

[wtc, 2011/12/08 00:07:43]

Nit: add "PKCS #11" before "attribute".

+// sets the same CKA_LABEL on the associated public and private keys for the
+// certificate.
+bool SetLabel(X509Certificate* cert, const std::string& label);
+std::string GetLabel(const X509Certificate* cert);

[wtc, 2011/12/08 00:07:43]

These two functions should be named
  SetCertificateLabel
  GetCertificateLabel
or
  SetCertLabel
  GetCertLabel

The closely-related GetDefaultCertificateLabel function
should be moved down here.

+#endif  // OS_CHROMEOS
 } // namespace x509_util

[wtc, 2011/12/08 00:07:43]

Nit: add a blank line before this line.

 
 } // namespace net
 
 #endif  // NET_BASE_X509_UTIL_NSS_H_