if ((ss->ssl3->hs.kea_def->kea == kea_ecdhe_rsa) || (ss->ssl3->hs.kea_def->kea == kea_dhe_rsa)) {
if ((ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) || (ss->ssl3.hs.kea_def->kea == kea_dhe_rsa)) {
ssl3_SendCertificate(sslSocket *ss){    SECStatus            rv;    CERTCertificateList *certChain;    int                  len 		= 0;    int                  i;    SSL3KEAType          certIndex;#ifdef NISCC_TEST    SECItem              fakeCert;    int                  ndex           = -1;#endif    SSL_TRC(3, ("%d: SSL3[%d]: send certificate handshake",		SSL_GETPID(), ss->fd));    PORT_Assert( ssl_HaveXmitBufLock(ss));    PORT_Assert( ssl_HaveSSL3HandshakeLock(ss));    if (ss->sec.localCert)    	CERT_DestroyCertificate(ss->sec.localCert);    if (ss->sec.isServer) {	sslServerCerts * sc = NULL;	/* XXX SSLKEAType isn't really a good choice for 	 * indexing certificates (it breaks when we deal	 * with (EC)DHE-* cipher suites. This hack ensures	 * the RSA cert is picked for (EC)DHE-RSA.	 * Revisit this when we add server side support	 * for ECDHE-ECDSA or client-side authentication	 * using EC certificates.	 */	if ((ss->ssl3->hs.kea_def->kea == kea_ecdhe_rsa) ||	    (ss->ssl3->hs.kea_def->kea == kea_dhe_rsa)) {	    certIndex = kt_rsa;	} else {	    certIndex = ss->ssl3->hs.kea_def->exchKeyType;	}	sc                    = ss->serverCerts + certIndex;	certChain             = sc->serverCertChain;	ss->sec.authKeyBits   = sc->serverKeyBits;	ss->sec.authAlgorithm = ss->ssl3->hs.kea_def->signKeyType;	ss->sec.localCert     = CERT_DupCertificate(sc->serverCert);    } else {	certChain          = ss->ssl3->clientCertChain;	ss->sec.localCert = CERT_DupCertificate(ss->ssl3->clientCertificate);    }#ifdef NISCC_TEST    rv = get_fake_cert(&fakeCert, &ndex);#endif    if (certChain) {	for (i = 0; i < certChain->len; i++) {#ifdef NISCC_TEST	    if (fakeCert.len > 0 && i == ndex) {		len += fakeCert.len + 3;	    } else {		len += certChain->certs[i].len + 3;	    }#else	    len += certChain->certs[i].len + 3;#endif	}    }    rv = ssl3_AppendHandshakeHeader(ss, certificate, len + 3);    if (rv != SECSuccess) {	return rv; 		/* err set by AppendHandshake. */    }    rv = ssl3_AppendHandshakeNumber(ss, len, 3);    if (rv != SECSuccess) {	return rv; 		/* err set by AppendHandshake. */    }    for (i = 0; i < certChain->len; i++) {#ifdef NISCC_TEST	if (fakeCert.len > 0 && i == ndex) {	    rv = ssl3_AppendHandshakeVariable(ss, fakeCert.data, fakeCert.len, 	                                      3);	    SECITEM_FreeItem(&fakeCert, PR_FALSE);	} else {	    rv = ssl3_AppendHandshakeVariable(ss, certChain->certs[i].data,					      certChain->certs[i].len, 3);	}#else	rv = ssl3_AppendHandshakeVariable(ss, certChain->certs[i].data,					  certChain->certs[i].len, 3);#endif	if (rv != SECSuccess) {	    return rv; 		/* err set by AppendHandshake. */	}    }    return SECSuccess;}