certs[fcerts] = CERT_DecodeDERCertificate(derCerts[i], PR_FALSE, NULL);
if ( keepCerts ) { certs[fcerts] = CERT_DecodeDERCertificate(derCerts[i], PR_FALSE, NULL); } else { certs[fcerts] = CERT_NewTempCertificate(certdb, derCerts[i], NULL, PR_FALSE, PR_TRUE); }
CERT_ImportCerts(CERTCertDBHandle *certdb, SECCertUsage usage,		 unsigned int ncerts, SECItem **derCerts,		 CERTCertificate ***retCerts, PRBool keepCerts,		 PRBool caOnly, char *nickname){    int i;    CERTCertificate **certs = NULL;    SECStatus rv;    int fcerts = 0;    if ( ncerts ) {	certs = (CERTCertificate**)PORT_ZAlloc(sizeof(CERTCertificate *) * ncerts );	if ( certs == NULL ) {	    return(SECFailure);	}    	/* decode all of the certs into the temporary DB */	for ( i = 0, fcerts= 0; i < ncerts; i++) {	    certs[fcerts] = CERT_DecodeDERCertificate(derCerts[i], PR_FALSE,						NULL);	    if (certs[fcerts]) fcerts++;	}	if ( keepCerts ) {	    for ( i = 0; i < fcerts; i++ ) {		SECKEY_UpdateCertPQG(certs[i]);		if(CERT_IsCACert(certs[i], NULL) && (fcerts > 1)) {		    /* if we are importing only a single cert and specifying		     * a nickname, we want to use that nickname if it a CA,		     * otherwise if there are more than one cert, we don't		     * know which cert it belongs to.		     */		    rv = PK11_ImportCert(PK11_GetInternalKeySlot(),certs[i],				CK_INVALID_HANDLE,NULL,PR_TRUE);		} else {		    rv = PK11_ImportCert(PK11_GetInternalKeySlot(),certs[i],				CK_INVALID_HANDLE,nickname,PR_TRUE);		}		if (rv == SECSuccess) {		    CERT_SaveImportedCert(certs[i], usage, caOnly, NULL);		}		/* don't care if it fails - keep going */	    }	}    }    if ( retCerts ) {	*retCerts = certs;    } else {	if (certs) {	    CERT_DestroyCertArray(certs, fcerts);	}    }    return(SECSuccess);    #if 0	/* dead code here - why ?? XXX */loser:    if ( retCerts ) {	*retCerts = NULL;    }    if ( certs ) {	CERT_DestroyCertArray(certs, ncerts);    }        return(SECFailure);#endif}