ss->ssl3->hs.usedStepDownKey = PR_TRUE;
ss->ssl3.hs.usedStepDownKey = PR_TRUE;
ssl3_SendServerHelloSequence(sslSocket *ss){    const ssl3KEADef *kea_def;    SECStatus         rv;    SSL_TRC(3, ("%d: SSL3[%d]: begin send server_hello sequence",		SSL_GETPID(), ss->fd));    PORT_Assert( ssl_HaveSSL3HandshakeLock(ss) );    PORT_Assert( ssl_HaveXmitBufLock(ss) );    rv = ssl3_SendServerHello(ss);    if (rv != SECSuccess) {	return rv;	/* err code is set. */    }    rv = ssl3_SendCertificate(ss);    if (rv != SECSuccess) {	return rv;	/* error code is set. */    }    /* We have to do this after the call to ssl3_SendServerHello,     * because kea_def is set up by ssl3_SendServerHello().     */    kea_def = ss->ssl3->hs.kea_def;    ss->ssl3->hs.usedStepDownKey = PR_FALSE;    if (kea_def->is_limited && kea_def->exchKeyType == kt_rsa) {	/* see if we can legally use the key in the cert. */	int keyLen;  /* bytes */	keyLen = PK11_GetPrivateModulusLen(			    ss->serverCerts[kea_def->exchKeyType].serverKey);	if (keyLen > 0 &&	    keyLen * BPB <= kea_def->key_size_limit ) {	    /* XXX AND cert is not signing only!! */	    /* just fall through and use it. */	} else if (ss->stepDownKeyPair != NULL) {	    ss->ssl3->hs.usedStepDownKey = PR_TRUE;	    rv = ssl3_SendServerKeyExchange(ss);	    if (rv != SECSuccess) {		return rv;	/* err code was set. */	    }	} else {#ifndef HACKED_EXPORT_SERVER	    PORT_SetError(SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED);	    return rv;#endif	}#ifdef NSS_ENABLE_ECC    } else if ((kea_def->kea == kea_ecdhe_rsa) ||	       (kea_def->kea == kea_ecdhe_ecdsa)) {	rv = ssl3_SendServerKeyExchange(ss);	if (rv != SECSuccess) {	    return rv;	/* err code was set. */	}#endif /* NSS_ENABLE_ECC */    }    if (ss->requestCertificate) {	rv = ssl3_SendCertificateRequest(ss);	if (rv != SECSuccess) {	    return rv;		/* err code is set. */	}    }    rv = ssl3_SendServerHelloDone(ss);    if (rv != SECSuccess) {	return rv;		/* err code is set. */    }    ss->ssl3->hs.ws = (ss->requestCertificate) ? wait_client_cert                                               : wait_client_key;    return SECSuccess;}