*WIP* Store NSS slots per profile. Move keygen to chrome.

net/cert/cert_verify_proc_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_nss.h"
 
 #include <string>
 #include <vector>
 
 #include <cert.h>
@@ skipping 441 matching lines @@
     in_param.type = cert_pi_trustAnchors;
     in_param.value.pointer.chain = additional_trust_anchors;
     cvin.push_back(in_param);
     in_param.type = cert_pi_useOnlyTrustAnchors;
     in_param.value.scalar.b = PR_FALSE;
     cvin.push_back(in_param);
   }
   in_param.type = cert_pi_end;
   cvin.push_back(in_param);
 
+  // XXX can't specify slots here

[Ryan Sleevi, 2013/06/28 17:01:59]

Curious what/why you mentioned this?

[mattm, 2013/09/12 21:46:32]

Was just looking at places that would care about using the correct slot. For
Issue 218627 (Honor trust roots per-profile) this cert verification stuff seemed
relevant, but I'm not familiar with the API mentioned in #0 of that bug. Doing
that would be a different CL anyway though.

   SECStatus rv = CERT_PKIXVerifyCert(cert_handle, certificateUsageSSLServer,
                                      &cvin[0], cvout, NULL);
   if (rv != SECSuccess) {
     rv = RetryPKIXVerifyCertWithWorkarounds(cert_handle, num_policy_oids,
                                             cert_io_enabled, &cvin, cvout);
   }
   return rv;
 }
 
 // PKIXVerifyCert calls this function to work around some bugs in
@@ skipping 400 matching lines @@
   if ((flags & CertVerifier::VERIFY_EV_CERT) && is_ev_candidate &&
       VerifyEV(cert_handle, flags, crl_set, metadata, ev_policy_oid,
                trust_anchors.get())) {
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   }
 
   return OK;
 }
 
 }  // namespace net