NSS_CK_SET_ATTRIBUTE_ITEM(cert_template, 0, &g_ck_class_cert);
NSSTrustDomain_FindBestCertificateByNickname(  NSSTrustDomain *td,  NSSUTF8 *name,  NSSTime *timeOpt, /* NULL for "now" */  NSSUsage *usage,  NSSPolicies *policiesOpt /* NULL for none */){    PRStatus nssrv;    NSSToken *tok;    CK_ATTRIBUTE cert_template[] =    {	{ CKA_CLASS, g_ck_class_cert.data, g_ck_class_cert.size },	{ CKA_LABEL, NULL,                 0                    }    };    struct get_best_cert_arg_str best;    CK_ULONG ctsize;    ctsize = (CK_ULONG)(sizeof(cert_template) / sizeof(cert_template[0]));    cert_template[1].pValue = (CK_VOID_PTR)name;    cert_template[1].ulValueLen = (CK_ULONG)nssUTF8_Length(name, &nssrv);    best.td = td;    best.cert = NULL;    best.time = (timeOpt) ? timeOpt : NSSTime_Now(NULL);    best.usage = usage;    best.policies = policiesOpt;    /* This will really be done through the search order, probably a     * token array     */    for (tok  = (NSSToken *)nssListIterator_Start(td->tokens);         tok != (NSSToken *)NULL;         tok  = (NSSToken *)nssListIterator_Next(td->tokens))    {	nssrv = nssToken_FindCertificatesByTemplate(tok, NULL, 	                                            cert_template, ctsize,                                                    get_best_cert, &best);	/* This is to workaround the fact that PKCS#11 doesn't specify	* whether the '\0' should be included.  XXX Is that still true?	*/	cert_template[1].ulValueLen++;	nssrv = nssToken_FindCertificatesByTemplate(tok, NULL, 	                                            cert_template, ctsize,                                                    get_best_cert, &best);	cert_template[1].ulValueLen--;    }    nssListIterator_Finish(td->tokens);    return best.cert;}