Generate unique certificate nicknames on Linux/CrOS.

net/cert/nss_cert_database_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cert.h>
 #include <certdb.h>
 #include <pk11pub.h>
 
 #include <algorithm>
 
@@ skipping 920 matching lines @@
       intermediate_certs[0], CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
 
   // Server cert should verify.
   CertVerifyResult verify_result2;
   error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
                               NULL, empty_cert_list_, &verify_result2);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result2.cert_status);
 }
 
+// Importing two certificates with the same issuer and common name, but

[wtc, 2013/05/22 20:58:45]

Could you clarify whether the "common name" is the issuer's
or subject's?

+// distinct subject names, should succeed and generate a unique nickname for
+// the second certificate.

[wtc, 2013/05/22 20:58:45]

The test doesn't check the nicknames are different, right?

[Ryan Sleevi, 2013/05/22 23:20:19]

Fixed.

+TEST_F(CertDatabaseNSSTest, ImportDuplicateCommonName) {
+  CertificateList certs =
+      CreateCertificateListFromFile(GetTestCertsDirectory(),
+                                    "duplicate_cn_1.pem",
+                                    X509Certificate::FORMAT_AUTO);
+  ASSERT_EQ(1U, certs.size());
+
+  EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size());
+
+  // Import server cert with default trust.
+  NSSCertDatabase::ImportCertFailureList failed;
+  EXPECT_TRUE(cert_db_->ImportServerCert(
+      certs, NSSCertDatabase::TRUST_DEFAULT, &failed));
+  EXPECT_EQ(0U, failed.size());
+  EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
+            cert_db_->GetCertTrust(certs[0], SERVER_CERT));
+
+  CertificateList new_certs = ListCertsInSlot(slot_->os_module_handle());
+  ASSERT_EQ(1U, new_certs.size());
+
+  // Now attempt to issue a different version with the same common name.

[wtc, 2013/05/22 20:58:45]

What does "issue a different version" mean?

[Ryan Sleevi, 2013/05/22 23:20:19]

typo
s/issue/import/
s/version/certificate/

+  CertificateList certs2 =
+      CreateCertificateListFromFile(GetTestCertsDirectory(),
+                                    "duplicate_cn_2.pem",
+                                    X509Certificate::FORMAT_AUTO);
+  ASSERT_EQ(1U, certs2.size());
+
+  // Import server cert with default trust.
+  EXPECT_TRUE(cert_db_->ImportServerCert(
+      certs2, NSSCertDatabase::TRUST_DEFAULT, &failed));
+  EXPECT_EQ(0U, failed.size());
+  EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
+            cert_db_->GetCertTrust(certs2[0], SERVER_CERT));
+
+  EXPECT_EQ(2U, ListCertsInSlot(slot_->os_module_handle()).size());
+}
+
 }  // namespace net