case certUsageVerifyCA:
CERT_KeyUsageAndTypeForCertUsage(SECCertUsage usage,				 PRBool ca,				 unsigned int *retKeyUsage,				 unsigned int *retCertType){    unsigned int requiredKeyUsage = 0;    unsigned int requiredCertType = 0;        if ( ca ) {	switch ( usage ) {	  case certUsageSSLServerWithStepUp:	    requiredKeyUsage = KU_NS_GOVT_APPROVED | KU_KEY_CERT_SIGN;	    requiredCertType = NS_CERT_TYPE_SSL_CA;	    break;	  case certUsageSSLClient:	    requiredKeyUsage = KU_KEY_CERT_SIGN;	    requiredCertType = NS_CERT_TYPE_SSL_CA;	    break;	  case certUsageSSLServer:	    requiredKeyUsage = KU_KEY_CERT_SIGN;	    requiredCertType = NS_CERT_TYPE_SSL_CA;	    break;	  case certUsageSSLCA:	    requiredKeyUsage = KU_KEY_CERT_SIGN;	    requiredCertType = NS_CERT_TYPE_SSL_CA;	    break;	  case certUsageEmailSigner:	    requiredKeyUsage = KU_KEY_CERT_SIGN;	    requiredCertType = NS_CERT_TYPE_EMAIL_CA;	    break;	  case certUsageEmailRecipient:	    requiredKeyUsage = KU_KEY_CERT_SIGN;	    requiredCertType = NS_CERT_TYPE_EMAIL_CA;	    break;	  case certUsageObjectSigner:	    requiredKeyUsage = KU_KEY_CERT_SIGN;	    requiredCertType = NS_CERT_TYPE_OBJECT_SIGNING_CA;	    break;	  case certUsageAnyCA:	  case certUsageStatusResponder:	    requiredKeyUsage = KU_KEY_CERT_SIGN;	    requiredCertType = NS_CERT_TYPE_OBJECT_SIGNING_CA |		NS_CERT_TYPE_EMAIL_CA |		    NS_CERT_TYPE_SSL_CA;	    break;	  default:	    PORT_Assert(0);	    goto loser;	}    } else {	switch ( usage ) {	  case certUsageSSLClient:	    requiredKeyUsage = KU_DIGITAL_SIGNATURE;	    requiredCertType = NS_CERT_TYPE_SSL_CLIENT;	    break;	  case certUsageSSLServer:	    requiredKeyUsage = KU_KEY_AGREEMENT_OR_ENCIPHERMENT;	    requiredCertType = NS_CERT_TYPE_SSL_SERVER;	    break;	  case certUsageSSLServerWithStepUp:	    requiredKeyUsage = KU_KEY_AGREEMENT_OR_ENCIPHERMENT |		KU_NS_GOVT_APPROVED;	    requiredCertType = NS_CERT_TYPE_SSL_SERVER;	    break;	  case certUsageSSLCA:	    requiredKeyUsage = KU_KEY_CERT_SIGN;	    requiredCertType = NS_CERT_TYPE_SSL_CA;	    break;	  case certUsageEmailSigner:	    requiredKeyUsage = KU_DIGITAL_SIGNATURE;	    requiredCertType = NS_CERT_TYPE_EMAIL;	    break;	  case certUsageEmailRecipient:	    requiredKeyUsage = KU_KEY_AGREEMENT_OR_ENCIPHERMENT;	    requiredCertType = NS_CERT_TYPE_EMAIL;	    break;	  case certUsageObjectSigner:	    requiredKeyUsage = KU_DIGITAL_SIGNATURE;	    requiredCertType = NS_CERT_TYPE_OBJECT_SIGNING;	    break;	  case certUsageStatusResponder:	    requiredKeyUsage = KU_DIGITAL_SIGNATURE;	    requiredCertType = EXT_KEY_USAGE_STATUS_RESPONDER;	    break;	  default:	    PORT_Assert(0);	    goto loser;	}    }    if ( retKeyUsage != NULL ) {	*retKeyUsage = requiredKeyUsage;    }    if ( retCertType != NULL ) {	*retCertType = requiredCertType;    }    return(SECSuccess);loser:    return(SECFailure);}