Update NSS to NSS_3_16_RC0.

nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_cert.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * pkix_pl_cert.c
  *
  * Certificate Object Functions
  *
  */
 
@@ skipping 3117 matching lines @@
 }
 
 /*
  * FUNCTION: PKIX_PL_Cert_CheckNameConstraints
  * (see comments in pkix_pl_pki.h)
  */
 PKIX_Error *
 PKIX_PL_Cert_CheckNameConstraints(
         PKIX_PL_Cert *cert,
         PKIX_PL_CertNameConstraints *nameConstraints,
+        PKIX_Boolean treatCommonNameAsDNSName,
         void *plContext)
 {
         PKIX_Boolean checkPass = PKIX_TRUE;
         CERTGeneralName *nssSubjectNames = NULL;
         PLArenaPool *arena = NULL;
 
         PKIX_ENTER(CERT, "PKIX_PL_Cert_CheckNameConstraints");
         PKIX_NULLCHECK_ONE(cert);
 
         if (nameConstraints != NULL) {
 
                 arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
                 if (arena == NULL) {
                         PKIX_ERROR(PKIX_OUTOFMEMORY);
                 }
 
-                /* This NSS call returns both Subject and  Subject Alt Names */
+                /* This NSS call returns Subject Alt Names. If
+                 * treatCommonNameAsDNSName is true, it also returns the
+                 * Subject Common Name
+                 */
                 PKIX_CERT_DEBUG
                     ("\t\tCalling CERT_GetConstrainedCertificateNames\n");
                 nssSubjectNames = CERT_GetConstrainedCertificateNames
-                        (cert->nssCert, arena, PR_TRUE);
+                        (cert->nssCert, arena, treatCommonNameAsDNSName);
 
                 PKIX_CHECK(pkix_pl_CertNameConstraints_CheckNameSpaceNssNames
                         (nssSubjectNames,
                         nameConstraints,
                         &checkPass,
                         plContext),
                         PKIX_CERTNAMECONSTRAINTSCHECKNAMESPACENSSNAMESFAILED);
 
                 if (checkPass != PKIX_TRUE) {
                         PKIX_ERROR(PKIX_CERTFAILEDNAMECONSTRAINTSCHECKING);
@@ skipping 534 matching lines @@
         CERTCertificate **pnssCert, 
         void *plContext)
 {
     PKIX_ENTER(CERT, "PKIX_PL_Cert_GetNssCert");
     PKIX_NULLCHECK_TWO(cert, pnssCert);
 
     *pnssCert = CERT_DupCertificate(cert->nssCert);
 
     PKIX_RETURN(CERT);
 }