This applies GUIDs to certificate and key nicknames when

net/base/x509_util_nss.h

Index: net/base/x509_util_nss.h
diff --git a/net/base/x509_util_nss.h b/net/base/x509_util_nss.h
index 82dd4f9c417b0321ec80aef2a595350367a56a8f..997c87b26c6ab6dbcedf139bf0211ef7268764c1 100644
--- a/net/base/x509_util_nss.h
+++ b/net/base/x509_util_nss.h
@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/time.h"
+#include "net/base/cert_type.h"
 
 typedef struct CERTCertificateStr CERTCertificate;
 typedef struct SECKEYPrivateKeyStr SECKEYPrivateKey;
@@ -17,6 +18,8 @@ typedef struct SECKEYPublicKeyStr SECKEYPublicKey;
 
 namespace net {
 
+class X509Certificate;
+
 namespace x509_util {
 
 // Creates a self-signed certificate containing |public_key|.  Subject, serial
@@ -30,6 +33,24 @@ CERTCertificate* CreateSelfSignedCert(
     uint32 serial_number,
     base::TimeDelta valid_duration);
 
+// Returns a default label for the cert based on its type.  On ChromeOS, this
+// will return the certificate's label if set, and generate a new label if not.
+std::string GetDefaultCertificateLabel(const X509Certificate* cert);
+
+// Gets which type of certificate this is, based on the certificate's

[wtc, 2011/12/08 00:07:43]

Nit: Gets => Returns

+// properties.
+CertType GetCertType(const X509Certificate* cert);
+
+// These are only defined on ChromeOS because it is the only platform where
+// we have a patched NSS that will set labels on certificates.
+#if defined(OS_CHROMEOS)
+// Set/get the label of this certificate.  This corresponds to the CKA_LABEL

[wtc, 2011/12/08 00:07:43]

Nit: Set/get => Sets/gets

+// attribute of the certificate.  Setting the label on the certificate also

[wtc, 2011/12/08 00:07:43]

Nit: add "PKCS #11" before "attribute".

+// sets the same CKA_LABEL on the associated public and private keys for the
+// certificate.
+bool SetLabel(X509Certificate* cert, const std::string& label);
+std::string GetLabel(const X509Certificate* cert);

[wtc, 2011/12/08 00:07:43]

These two functions should be named
  SetCertificateLabel
  GetCertificateLabel
or
  SetCertLabel
  GetCertLabel

The closely-related GetDefaultCertificateLabel function
should be moved down here.

+#endif  // OS_CHROMEOS
 } // namespace x509_util

[wtc, 2011/12/08 00:07:43]

Nit: add a blank line before this line.

 
 } // namespace net