if (CERT_FindSubjectKeyIDExten(c, &skid) == SECSuccess) {
if (CERT_FindSubjectKeyIDExtension(c, &skid) == SECSuccess) {
nss3certificate_matchIdentifier(nssDecodedCert *dc, void *id){    CERTCertificate *c = (CERTCertificate *)dc->data;    CERTAuthKeyID *authKeyID = (CERTAuthKeyID *)id;    SECItem skid;    nssCertIDMatch match = nssCertIDMatch_Unknown;    /* keyIdentifier */    if (authKeyID->keyID.len > 0) {	if (CERT_FindSubjectKeyIDExten(c, &skid) == SECSuccess) {	    PRBool skiEqual;	    skiEqual = SECITEM_ItemsAreEqual(&authKeyID->keyID, &skid);	    PORT_Free(skid.data);	    if (skiEqual) {		/* change the state to positive match, but keep going */		match = nssCertIDMatch_Yes;	    } else {		/* exit immediately on failure */		return nssCertIDMatch_No;	    }	} /* else fall through */    }    /* issuer/serial (treated as pair) */    if (authKeyID->authCertIssuer) {	SECItem *caName = NULL;	SECItem *caSN = &authKeyID->authCertSerialNumber;	caName = (SECItem *)CERT_GetGeneralNameByType(	                                        authKeyID->authCertIssuer,						certDirectoryName, PR_TRUE);	if (caName == NULL) {	    /* this is some kind of error, so treat it as unknown */	    return nssCertIDMatch_Unknown;	}	if (SECITEM_ItemsAreEqual(&c->derIssuer, caName) &&	    SECITEM_ItemsAreEqual(&c->serialNumber, caSN)) 	{	    /* change the state to positive match, but keep going */	    match = nssCertIDMatch_Yes;	} else {	    /* exit immediately on failure */	    return nssCertIDMatch_No;	}    }    /* If the issued cert has a keyIdentifier field with a value, but     * this issuer cert does not have a subjectKeyID extension, and     * the issuer/serial number fields of the authKeyID extension     * are empty, the state will be Unknown.  Otherwise it should have     * been set to Yes.     */    return match;}