Make the private slot optional in NSSCertDatabase.

net/cert/nss_cert_database.cc

Index: net/cert/nss_cert_database.cc
diff --git a/net/cert/nss_cert_database.cc b/net/cert/nss_cert_database.cc
index 0d24ea6e03a52e23b6e36140ff7e08fa3084961a..9707973d753037b18914b71d569280282b38dfdd 100644
--- a/net/cert/nss_cert_database.cc
+++ b/net/cert/nss_cert_database.cc
@@ -84,8 +84,7 @@ NSSCertDatabase::NSSCertDatabase(crypto::ScopedPK11Slot public_slot,
       private_slot_(private_slot.Pass()),
       observer_list_(new ObserverListThreadSafe<Observer>),
       weak_factory_(this) {
-  DCHECK(public_slot_);
-  DCHECK(private_slot_);
+  CHECK(public_slot_);
 
   // This also makes sure that NSS has been initialized.
   CertDatabase* cert_db = CertDatabase::GetInstance();
@@ -141,6 +140,8 @@ crypto::ScopedPK11Slot NSSCertDatabase::GetPublicSlot() const {
 }
 
 crypto::ScopedPK11Slot NSSCertDatabase::GetPrivateSlot() const {
+  if (!private_slot_)
+    return crypto::ScopedPK11Slot();
   return crypto::ScopedPK11Slot(PK11_ReferenceSlot(private_slot_.get()));
 }