Make the private slot optional in NSSCertDatabase.

net/cert/nss_cert_database.h

Index: net/cert/nss_cert_database.h
diff --git a/net/cert/nss_cert_database.h b/net/cert/nss_cert_database.h
index f1611698e391584eb4be398e57f1fc345a8deb6c..b8f128ccd677505c61f0fc18a5063ba5b99e93d1 100644
--- a/net/cert/nss_cert_database.h
+++ b/net/cert/nss_cert_database.h
@@ -107,7 +107,8 @@ class NET_EXPORT NSSCertDatabase {
   // as doing so requires making opinionated decisions about where to store
   // data, and instead prefer to be passed an existing NSSCertDatabase
   // instance.
-  // Both slots must not be NULL but can be identical.
+  // |public_slot| must not be NULL, |private_slot| can be NULL. Both slots can
+  // be identical.
   NSSCertDatabase(crypto::ScopedPK11Slot public_slot,
                   crypto::ScopedPK11Slot private_slot);
   virtual ~NSSCertDatabase();
@@ -144,6 +145,7 @@ class NET_EXPORT NSSCertDatabase {
   crypto::ScopedPK11Slot GetPublicSlot() const;
 
   // Get the default slot for private key or mixed private/public key data.
+  // Can return NULL.
   crypto::ScopedPK11Slot GetPrivateSlot() const;
 
   // Get the default module for public key data.