if (isCA && cert->trust && (cert->trust->sslFlags | cert->trust->emailFlags | cert->trust->objectSigningFlags)) { return(SECSuccess); }
CERT_SaveImportedCert(CERTCertificate *cert, SECCertUsage usage,		      PRBool caOnly, char *nickname){    SECStatus rv;    PRBool saveit;    CERTCertTrust trust;    PRBool isCA;    unsigned int certtype;        isCA = CERT_IsCACert(cert, NULL);    if ( caOnly && ( !isCA ) ) {	return(SECSuccess);    }        saveit = PR_TRUE;        PORT_Memset((void *)&trust, 0, sizeof(trust));    certtype = cert->nsCertType;    /* if no CA bits in cert type, then set all CA bits */    if ( isCA && ( ! ( certtype & NS_CERT_TYPE_CA ) ) ) {	certtype |= NS_CERT_TYPE_CA;    }    /* if no app bits in cert type, then set all app bits */    if ( ( !isCA ) && ( ! ( certtype & NS_CERT_TYPE_APP ) ) ) {	certtype |= NS_CERT_TYPE_APP;    }    switch ( usage ) {      case certUsageEmailSigner:      case certUsageEmailRecipient:	if ( isCA ) {	    if ( certtype & NS_CERT_TYPE_EMAIL_CA ) {		trust.emailFlags = CERTDB_VALID_CA;	    }	} else {	    if ( cert->emailAddr == NULL ) {		saveit = PR_FALSE;	    }	    	    if ( certtype & NS_CERT_TYPE_EMAIL ) {		trust.emailFlags = CERTDB_VALID_PEER;		if ( ! ( cert->rawKeyUsage & KU_KEY_ENCIPHERMENT ) ) {		    /* don't save it if KeyEncipherment is not allowed */		    saveit = PR_FALSE;		}	    }	}	break;      case certUsageUserCertImport:	if ( isCA ) {	    if ( certtype & NS_CERT_TYPE_SSL_CA ) {		trust.sslFlags = CERTDB_VALID_CA;	    }	    	    if ( certtype & NS_CERT_TYPE_EMAIL_CA ) {		trust.emailFlags = CERTDB_VALID_CA;	    }	    	    if ( certtype & NS_CERT_TYPE_OBJECT_SIGNING_CA ) {		trust.objectSigningFlags = CERTDB_VALID_CA;	    }	    	} else {	    if ( certtype & NS_CERT_TYPE_SSL_CLIENT ) {		trust.sslFlags = CERTDB_VALID_PEER;	    }	    	    if ( certtype & NS_CERT_TYPE_EMAIL ) {		trust.emailFlags = CERTDB_VALID_PEER;	    }	    	    if ( certtype & NS_CERT_TYPE_OBJECT_SIGNING ) {		trust.objectSigningFlags = CERTDB_VALID_PEER;	    }	}	break;      case certUsageAnyCA:	trust.sslFlags = CERTDB_VALID_CA;	break;      case certUsageSSLCA:	trust.sslFlags = CERTDB_VALID_CA | 			CERTDB_TRUSTED_CA | CERTDB_TRUSTED_CLIENT_CA;	break;      default:	/* XXX added to quiet warnings; no other cases needed? */	break;    }    if ( saveit ) {	rv = CERT_ChangeCertTrust(cert->dbhandle, cert, &trust);	if ( rv != SECSuccess ) {	    goto loser;	}    }    rv = SECSuccess;    goto done;loser:    rv = SECFailure;done:    return(rv);}