diff --git a/mozilla/security/nss/lib/certdb/cert.h b/mozilla/security/nss/lib/certdb/cert.h
index 7f8cd9a7cbc..ce648cff8bd 100644
--- a/mozilla/security/nss/lib/certdb/cert.h
+++ b/mozilla/security/nss/lib/certdb/cert.h
@@ -34,7 +34,7 @@
 /*
  * cert.h - public data structures and prototypes for the certificate library
  *
- * $Id: cert.h,v 1.10 2001-05-22 22:01:32 wtc%netscape.com Exp $
+ * $Id: cert.h,v 1.11 2001-06-06 23:40:50 relyea%netscape.com Exp $
  */
 
 #ifndef _CERT_H_
@@ -996,6 +996,9 @@ CERT_MakeCANickname(CERTCertificate *cert);
 PRBool
 CERT_IsCACert(CERTCertificate *cert, unsigned int *rettype);
 
+PRBool
+CERT_IsCADERCert(SECItem *derCert, unsigned int *rettype);
+
 SECStatus
 CERT_SaveSMimeProfile(CERTCertificate *cert, SECItem *emailProfile,
 		      SECItem *profileTime);
diff --git a/mozilla/security/nss/lib/certdb/certdb.c b/mozilla/security/nss/lib/certdb/certdb.c
index d2fd7407d92..ed6ee28c083 100644
--- a/mozilla/security/nss/lib/certdb/certdb.c
+++ b/mozilla/security/nss/lib/certdb/certdb.c
@@ -34,7 +34,7 @@
 /*
  * Certificate handling code
  *
- * $Id: certdb.c,v 1.11 2001-04-24 21:27:40 relyea%netscape.com Exp $
+ * $Id: certdb.c,v 1.12 2001-06-06 23:40:51 relyea%netscape.com Exp $
  */
 
 #include "nssilock.h"
@@ -1692,6 +1692,22 @@ CERT_IsCACert(CERTCertificate *cert, unsigned int *rettype)
     return(ret);
 }
 
+
+PRBool
+CERT_IsCADERCert(SECItem *derCert, unsigned int *type) {
+    CERTCertificate *cert;
+    PRBool isCA;
+
+    cert = CERT_NewTempCertificate(CERT_GetDefaultCertDB(), derCert, NULL,
+	                                   PR_FALSE, PR_TRUE);
+    if (cert == NULL) return NULL;
+
+    isCA = CERT_IsCACert(cert,type);
+    CERT_DestroyCertificate (cert);
+    return isCA;
+}
+
+
 /*
  * is certa newer than certb?  If one is expired, pick the other one.
  */