Generate unique certificate nicknames on Linux/CrOS.

net/cert/nss_cert_database_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <cert.h>
 #include <certdb.h>
 #include <pk11pub.h>
 
 #include <algorithm>
 
@@ skipping 920 matching lines @@
       intermediate_certs[0], CA_CERT, NSSCertDatabase::TRUST_DEFAULT));
 
   // Server cert should verify.
   CertVerifyResult verify_result2;
   error = verify_proc->Verify(certs[0], "127.0.0.1", flags,
                               NULL, empty_cert_list_, &verify_result2);
   EXPECT_EQ(OK, error);
   EXPECT_EQ(0U, verify_result2.cert_status);
 }
 
+// Importing two certificates with the same issuer and subject common name,
+// but overall distinct subject names, should succeed and generate a unique
+// nickname for the second certificate.
+TEST_F(CertDatabaseNSSTest, ImportDuplicateCommonName) {
+  CertificateList certs =
+      CreateCertificateListFromFile(GetTestCertsDirectory(),
+                                    "duplicate_cn_1.pem",
+                                    X509Certificate::FORMAT_AUTO);
+  ASSERT_EQ(1U, certs.size());
+
+  EXPECT_EQ(0U, ListCertsInSlot(slot_->os_module_handle()).size());
+
+  // Import server cert with default trust.
+  NSSCertDatabase::ImportCertFailureList failed;
+  EXPECT_TRUE(cert_db_->ImportServerCert(
+      certs, NSSCertDatabase::TRUST_DEFAULT, &failed));
+  EXPECT_EQ(0U, failed.size());
+  EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
+            cert_db_->GetCertTrust(certs[0], SERVER_CERT));
+
+  CertificateList new_certs = ListCertsInSlot(slot_->os_module_handle());
+  ASSERT_EQ(1U, new_certs.size());
+
+  // Now attempt to import a different certificate with the same common name.
+  CertificateList certs2 =
+      CreateCertificateListFromFile(GetTestCertsDirectory(),
+                                    "duplicate_cn_2.pem",
+                                    X509Certificate::FORMAT_AUTO);
+  ASSERT_EQ(1U, certs2.size());
+
+  // Import server cert with default trust.
+  EXPECT_TRUE(cert_db_->ImportServerCert(
+      certs2, NSSCertDatabase::TRUST_DEFAULT, &failed));
+  EXPECT_EQ(0U, failed.size());
+  EXPECT_EQ(NSSCertDatabase::TRUST_DEFAULT,
+            cert_db_->GetCertTrust(certs2[0], SERVER_CERT));
+
+  new_certs = ListCertsInSlot(slot_->os_module_handle());
+  ASSERT_EQ(2U, new_certs.size());
+  EXPECT_STRNE(new_certs[0]->os_cert_handle()->nickname,
+               new_certs[1]->os_cert_handle()->nickname);
+}
+
 }  // namespace net