CERT_DestroyCertificate(cert);
myAuthCertificate(void *arg, PRFileDesc *socket,                   PRBool checksig, PRBool isServer) {	SECCertUsage        certUsage;	CERTCertificate *   cert;	void *              pinArg;	char *              hostName;	SECStatus           secStatus;	if (!arg || !socket) {		errWarn("myAuthCertificate");		return SECFailure;	}	/* Define how the cert is being used based upon the isServer flag. */	certUsage = isServer ? certUsageSSLClient : certUsageSSLServer;	cert = SSL_PeerCertificate(socket);		pinArg = SSL_RevealPinArg(socket);	secStatus = CERT_VerifyCertNow((CERTCertDBHandle *)arg,	                               cert,	                               checksig,	                               certUsage,	                               pinArg);	/* If this is a server, we're finished. */	if (isServer || secStatus != SECSuccess) {		return secStatus;	}	/* Certificate is OK.  Since this is the client side of an SSL	 * connection, we need to verify that the name field in the cert	 * matches the desired hostname.  This is our defense against	 * man-in-the-middle attacks.	 */	/* SSL_RevealURL returns a hostName, not an URL. */	hostName = SSL_RevealURL(socket);	if (hostName && hostName[0]) {		secStatus = CERT_VerifyCertName(cert, hostName);	} else {		PR_SetError(SSL_ERROR_BAD_CERT_DOMAIN, 0);		secStatus = SECFailure;	}	if (hostName)		PR_Free(hostName);	return secStatus;}