This change loads opencryptoki and uses the TPM for keygen tags.

net/base/cert_database_nss.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_database.h"
 
 #include <cert.h>
 #include <certdb.h>
 #include <keyhi.h>
 #include <pk11pub.h>
@@ skipping 91 matching lines @@
        !CERT_LIST_END(node, cert_list);
        node = CERT_LIST_NEXT(node)) {
     certs->push_back(X509Certificate::CreateFromHandle(
         node->cert,
         X509Certificate::SOURCE_LONE_CERT_IMPORT,
         X509Certificate::OSCertHandles()));
   }
   CERT_DestroyCertList(cert_list);
 }
 
-CryptoModule* CertDatabase::GetDefaultModule() const {
+CryptoModule* CertDatabase::GetPublicModule() const {
   CryptoModule* module =
-      CryptoModule::CreateFromHandle(base::GetDefaultNSSKeySlot());
-  // The module is already referenced when returned from GetDefaultNSSKeymodule,
-  // so we need to deref it once.
+      CryptoModule::CreateFromHandle(base::GetPublicNSSKeySlot());
+  // The module is already referenced when returned from
+  // GetPublicNSSKeySlot, so we need to deref it once.
   PK11_FreeSlot(module->os_module_handle());
 
   return module;
+}
+
+CryptoModule* CertDatabase::GetPrivateModule() const {
+  CryptoModule* module =
+      CryptoModule::CreateFromHandle(base::GetPrivateNSSKeySlot());
+  // The module is already referenced when returned from
+  // GetPrivateNSSKeySlot, so we need to deref it once.
+  PK11_FreeSlot(module->os_module_handle());
+
+  return module;
 }
 
 void CertDatabase::ListModules(CryptoModuleList* modules, bool need_rw) const {
   modules->clear();
 
   PK11SlotList* slot_list = NULL;
   // The wincx arg is unused since we don't call PK11_SetIsLoggedInFunc.
   slot_list = PK11_GetAllTokens(CKM_INVALID_MECHANISM,
                                 need_rw ? PR_TRUE : PR_FALSE,  // needRW
                                 PR_TRUE,  // loadCerts (unused)
@@ skipping 114 matching lines @@
   }
   return true;
 }
 
 bool CertDatabase::IsReadOnly(const X509Certificate* cert) const {
   PK11SlotInfo* slot = cert->os_cert_handle()->slot;
   return slot && PK11_IsReadOnly(slot);
 }
 
 }  // namespace net