nssrv = nssToken_ImportCertificate(tok, NULL, c, PR_TRUE);
NSSUTF8 *nickname = NSSCertificate_GetNickname(c, NULL); nssrv = nssToken_ImportCertificate(tok, NULL, c, nickname, PR_TRUE);
STAN_ChangeCertTrust(CERTCertificate *cc, CERTCertTrust *trust){    PRStatus nssrv;    NSSCertificate *c = STAN_GetNSSCertificate(cc);    NSSToken *tok;    NSSTrustDomain *td;    NSSTrust *nssTrust;    NSSArena *arena;    CERTCertTrust *oldTrust;    nssListIterator *tokens;    PRBool moving_object;    oldTrust = nssTrust_GetCERTCertTrustForCert(c, cc);    if (oldTrust) {	if (memcmp(oldTrust, trust, sizeof (CERTCertTrust)) == 0) {	    /* ... and the new trust is no different, done) */	    return PR_SUCCESS;	} else {	    /* take over memory already allocated in cc's arena */	    cc->trust = oldTrust;	}    } else {	cc->trust = PORT_ArenaAlloc(cc->arena, sizeof(CERTCertTrust));    }    memcpy(cc->trust, trust, sizeof(CERTCertTrust));    /* Set the NSSCerticate's trust */    arena = nssArena_Create();    if (!arena) return PR_FAILURE;    nssTrust = nss_ZNEW(arena, NSSTrust);    nssrv = nssPKIObject_Initialize(&nssTrust->object, arena, NULL, NULL);    if (nssrv != PR_SUCCESS) {	nssPKIObject_Destroy(&nssTrust->object);	return PR_FAILURE;    }    nssTrust->certificate = c;    nssTrust->serverAuth = get_stan_trust(trust->sslFlags, PR_FALSE);    nssTrust->clientAuth = get_stan_trust(trust->sslFlags, PR_TRUE);    nssTrust->emailProtection = get_stan_trust(trust->emailFlags, PR_FALSE);    nssTrust->codeSigning = get_stan_trust(trust->objectSigningFlags, PR_FALSE);    if (c->object.cryptoContext != NULL) {	/* The cert is in a context, set the trust there */	NSSCryptoContext *cc = c->object.cryptoContext;	nssrv = nssCryptoContext_ImportTrust(cc, nssTrust);	if (nssrv != PR_SUCCESS) {	    nssTrust_Destroy(nssTrust);	    return nssrv;	}	if (nssList_Count(c->object.instanceList) == 0) {	    /* The context is the only instance, finished */	    return nssrv;	}    }    td = STAN_GetDefaultTrustDomain();    if (PK11_IsReadOnly(cc->slot)) {	tokens = nssList_CreateIterator(td->tokenList);	if (!tokens) return PR_FAILURE;	for (tok  = (NSSToken *)nssListIterator_Start(tokens);	     tok != (NSSToken *)NULL;	     tok  = (NSSToken *)nssListIterator_Next(tokens))	{	    if (!PK11_IsReadOnly(tok->pk11slot)) break;	}	nssListIterator_Finish(tokens);	nssListIterator_Destroy(tokens);	moving_object = PR_TRUE;    } else {	/* by default, store trust on same token as cert if writeable */	tok = PK11Slot_GetNSSToken(cc->slot);	moving_object = PR_FALSE;    }    if (tok) {	if (moving_object) {	    /* this is kind of hacky.  the softoken needs the cert	     * object in order to store trust.  forcing it to be perm	     */	    nssrv = nssToken_ImportCertificate(tok, NULL, c, PR_TRUE);	    if (nssrv != PR_SUCCESS) return nssrv;	}	nssrv = nssToken_ImportTrust(tok, NULL, nssTrust, PR_TRUE);    } else {	nssrv = PR_FAILURE;    }    (void)nssTrust_Destroy(nssTrust);    return nssrv;}