This change loads opencryptoki and uses the TPM for keygen tags.

net/socket/ssl_server_socket_nss.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_server_socket_nss.h"
 
 #if defined(OS_WIN)
 #include <winsock2.h>
 #endif
 
@@ skipping 284 matching lines @@
       CERT_GetDefaultCertDB(), &der_cert, NULL, PR_FALSE, PR_TRUE);
 
   // Get a key of SECKEYPrivateKey* structure.
   std::vector<uint8> key_vector;
   if (!key_->ExportPrivateKey(&key_vector)) {
     CERT_DestroyCertificate(cert);
     return ERR_UNEXPECTED;
   }
 
   SECKEYPrivateKeyStr* private_key = NULL;
-  PK11SlotInfo *slot = base::GetDefaultNSSKeySlot();
+  PK11SlotInfo *slot = base::GetPrivateNSSKeySlot();
   if (!slot) {
     CERT_DestroyCertificate(cert);
     return ERR_UNEXPECTED;
   }
 
   SECItem der_private_key_info;
   der_private_key_info.data =
       const_cast<unsigned char*>(&key_vector.front());
   der_private_key_info.len = key_vector.size();
   // The server's RSA private key must be imported into NSS with the
@@ skipping 360 matching lines @@
   // We must call EnsureOCSPInit() here, on the IO thread, to get the IO loop
   // by MessageLoopForIO::current().
   // X509Certificate::Verify() runs on a worker thread of CertVerifier.
   EnsureOCSPInit();
 #endif
 
   return OK;
 }
 
 }  // namespace net