This applies GUIDs to certificate and key nicknames when

chrome/browser/chromeos/cros/onc_network_parser.h

Index: chrome/browser/chromeos/cros/onc_network_parser.h
diff --git a/chrome/browser/chromeos/cros/onc_network_parser.h b/chrome/browser/chromeos/cros/onc_network_parser.h
index 48fbe6191001fe22cd2a93a5683259379b1d6a9d..ee3bd656d71d66623a0f4edc6cc5f489e2efda09 100644
--- a/chrome/browser/chromeos/cros/onc_network_parser.h
+++ b/chrome/browser/chromeos/cros/onc_network_parser.h
@@ -9,6 +9,7 @@
 #include <string>
 
 #include "base/compiler_specific.h"  // for OVERRIDE
+#include "base/gtest_prod_util.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/values.h"
 #include "chrome/browser/chromeos/cros/network_parser.h"
@@ -19,6 +20,11 @@ class ListValue;
 class Value;
 }
 
+namespace net {
+class X509Certificate;
+typedef std::vector<scoped_refptr<X509Certificate> > CertificateList;
+}
+
 namespace chromeos {
 
 // This is a simple representation of the signature of an ONC typed
@@ -52,16 +58,17 @@ class OncNetworkParser : public NetworkParser {
   // Returns the number of networks in the "NetworkConfigs" list.
   int GetNetworkConfigsSize() const;
 
-  // Returns the number of certificates in the "Certificates" list.
-  int GetCertificatesSize() const;
-
   // Call to create the network by parsing network config in the nth position.
   // (0-based). Returns NULL if there's a parse error or if n is out of range.
   Network* ParseNetwork(int n);
 
+  // Returns the number of certificates in the "Certificates" list.
+  int GetCertificatesSize() const;
+
   // Call to parse and import the nth certificate in the certificate
-  // list.  Returns false on failure.
-  bool ParseCertificate(int n);
+  // list into the certificate store.  Returns a NULL refptr if
+  // there's a parse error or if n is out of range.
+  scoped_refptr<net::X509Certificate> ParseCertificate(int n);
 
   virtual Network* CreateNetworkFromInfo(const std::string& service_path,
       const base::DictionaryValue& info) OVERRIDE;
@@ -104,14 +111,27 @@ class OncNetworkParser : public NetworkParser {
                                const std::string& onc_type);
 
  private:
-  bool ParseServerOrCaCertificate(
+  FRIEND_TEST_ALL_PREFIXES(OncNetworkParserTest, TestAddClientCertificate);
+  FRIEND_TEST_ALL_PREFIXES(OncNetworkParserTest, TestAddServerCertificate);
+  FRIEND_TEST_ALL_PREFIXES(OncNetworkParserTest, TestAddAuthorityCertificate);
+  scoped_refptr<net::X509Certificate> ParseServerOrCaCertificate(
     int cert_index,
     const std::string& cert_type,
+    const std::string& guid,
     base::DictionaryValue* certificate);
-  bool ParseClientCertificate(
+  scoped_refptr<net::X509Certificate> ParseClientCertificate(
     int cert_index,
+    const std::string& guid,
     base::DictionaryValue* certificate);
 
+  // This lists the certificates that have the string |label| as their
+  // certificate nickname (exact match).
+  static void ListCertsWithNickname(const std::string& label,
+                                    net::CertificateList* result);

[wtc, 2011/12/10 00:58:43]

Nit: you should also rename the first input parameter to
|nickname| in these two functions, now that you have renamed
the functions.

Nit: I think "exact match" doesn't need to be mentioned.
(A substring match would be non-obvious.)

+  // This deletes any certificate that has the string |label| as its
+  // nickname (exact match).
+  static bool DeleteCertAndKeyByNickname(const std::string& label);
+
   // Error message from the JSON parser, if applicable.
   std::string parse_error_;