(void)STAN_GetCERTCertificate(c);
if (STAN_GetCERTCertificate(c) == NULL) { return PR_FAILURE; }
nssBestCertificate_Callback(  NSSCertificate *c,   void *arg){    nssBestCertificateCB *best = (nssBestCertificateCB *)arg;    nssDecodedCert *dc, *bestdc;    dc = nssCertificate_GetDecoding(c);    if (!best->cert) {	/* usage */	if (best->usage->anyUsage) {	    best->cert = nssCertificate_AddRef(c);	} else {#ifdef NSS_3_4_CODE	    /* For this to work in NSS 3.4, we have to go out and fill in	     * all of the CERTCertificate fields.  Why?  Because the	     * matchUsage function calls CERT_IsCACert, which needs to know	     * what the trust values are for the cert.	     * Ignore the returned pointer, the refcount is in c anyway.	     */	    (void)STAN_GetCERTCertificate(c);#endif	    if (dc->matchUsage(dc, best->usage)) {		best->cert = nssCertificate_AddRef(c);	    }	}	return PR_SUCCESS;    }    bestdc = nssCertificate_GetDecoding(best->cert);    /* time */    if (bestdc->isValidAtTime(bestdc, best->time)) {	/* The current best cert is valid at time */	if (!dc->isValidAtTime(dc, best->time)) {	    /* If the new cert isn't valid at time, it's not better */	    return PR_SUCCESS;	}    } else {	/* The current best cert is not valid at time */	if (dc->isValidAtTime(dc, best->time)) {	    /* If the new cert is valid at time, it's better */	    NSSCertificate_Destroy(best->cert);	    best->cert = nssCertificate_AddRef(c);	    return PR_SUCCESS;	}    }    /* either they are both valid at time, or neither valid; take the newer */    /* XXX later -- defer to policies */    if (!bestdc->isNewerThan(bestdc, dc)) {	NSSCertificate_Destroy(best->cert);	best->cert = nssCertificate_AddRef(c);    }    /* policies */    return PR_SUCCESS;}