diff --git a/mozilla/security/nss/cmd/cmdlib/cmdio.c b/mozilla/security/nss/cmd/cmdlib/cmdio.c
index f67830d950a..912e8927c6b 100644
--- a/mozilla/security/nss/cmd/cmdlib/cmdio.c
+++ b/mozilla/security/nss/cmd/cmdlib/cmdio.c
@@ -323,7 +323,7 @@ CMD_DumpOutput(NSSItem *output, CMDRunTimeData *rtData)
 	break;
     case CMDFileMode_Ascii:
 	outstr = NSSBase64_EncodeItem(NULL, NULL, 0, output);
-	PR_fprintf(fData->file, "%s", outstr);
+	PR_fprintf(fData->file, "%s\n", outstr);
 	NSS_ZFreeIf(outstr);
 	break;
     }
diff --git a/mozilla/security/nss/cmd/pkiutil/pkiobject.c b/mozilla/security/nss/cmd/pkiutil/pkiobject.c
index 1aa52339b3e..653a16354f3 100644
--- a/mozilla/security/nss/cmd/pkiutil/pkiobject.c
+++ b/mozilla/security/nss/cmd/pkiutil/pkiobject.c
@@ -35,6 +35,24 @@ get_object_class(char *type)
     return PKIUnknown;
 }
 
+static NSSKeyPairType
+get_key_pair_type(char *type)
+{
+    if (type == NULL) {
+	return NSSKeyPairType_Unknown;
+    }
+    if (strcmp(type, "rsa") == 0 || strcmp(type, "RSA") == 0) {
+	return NSSKeyPairType_RSA;
+    } else if (strcmp(type, "dsa") == 0 || strcmp(type, "DSA") == 0) {
+	return NSSKeyPairType_DSA;
+    } else if (strcmp(type, "dh") == 0 || strcmp(type, "DH") == 0 ||
+               strcmp(type, "Diffie-Hellman") == 0) {
+	return NSSKeyPairType_DH;
+    } else {
+	return NSSKeyPairType_Unknown;
+    }
+}
+
 /* XXX */
 static NSSItem *
 get_cert_serial_number(NSSCertificate *c)
@@ -548,6 +566,7 @@ import_private_key
   NSSTrustDomain *td,
   NSSToken *token,
   char *nickname,
+  char *keyTypeOpt,
   char *keypass,
   CMDRunTimeData *rtData
 )
@@ -555,11 +574,26 @@ import_private_key
     PRStatus status;
     NSSItem *encoding;
     NSSPrivateKey *vkey;
+    NSSKeyPairType keyPairType;
+
+    if (!keyTypeOpt) {
+	/* default to RSA */
+	keyPairType = NSSKeyPairType_RSA;
+    } else {
+	keyPairType = get_key_pair_type(keyTypeOpt);
+	if (keyPairType == NSSKeyPairType_Unknown) {
+	    PR_fprintf(PR_STDERR, "%s is not a valid key type.\n", 
+	                           keyTypeOpt);
+	    return PR_FAILURE;
+	}
+    }
 
     /* get the encoded key from the input source */
     encoding = CMD_GetInput(rtData);
     /* import into trust domain */
-    vkey = NSSTrustDomain_ImportEncodedPrivateKey(td, encoding, NULL,
+    vkey = NSSTrustDomain_ImportEncodedPrivateKey(td, encoding,
+                                                  keyPairType, 0, 0,
+                                                  NULL,
                                     CMD_PWCallbackForKeyEncoding(keypass), 
                                                   token/*, nickname */);
     if (vkey) {
@@ -581,6 +615,7 @@ ImportObject
   NSSToken *tokenOpt,
   char *objectTypeOpt,
   char *nickname,
+  char *keyTypeOpt,
   char *keypass,
   CMDRunTimeData *rtData
 )
@@ -601,7 +636,8 @@ ImportObject
     case PKIPublicKey:
 	break;
     case PKIPrivateKey:
-	status = import_private_key(td, token, nickname, keypass, rtData);
+	status = import_private_key(td, token, nickname, keyTypeOpt,
+	                            keypass, rtData);
 	break;
     case PKIUnknown:
 	status = PR_FAILURE;
@@ -681,6 +717,7 @@ export_certificate (
   CMDRunTimeData *rtData
 )
 {
+    PRStatus status = PR_FAILURE;
     NSSCertificate *cert, **certs;
     certs = NSSTrustDomain_FindCertificatesByNickname(td, nickname, 
                                                       NULL, 0, NULL);
@@ -689,9 +726,11 @@ export_certificate (
 	if (cert) {
 	    NSSDER *enc = nssCertificate_GetEncoding(cert);
 	    CMD_DumpOutput(enc, rtData);
+	    status = PR_SUCCESS;
 	}
 	NSSCertificateArray_Destroy(certs);
     }
+    return status;
 }
 
 static PRStatus
@@ -699,6 +738,7 @@ generate_salt(NSSItem *salt)
 {
     salt->data = NSS_GenerateRandom(16, NULL, NULL);
     salt->size = 16;
+    return PR_SUCCESS;
 }
 
 static PRStatus
@@ -709,6 +749,7 @@ export_private_key (
   CMDRunTimeData *rtData
 )
 {
+    PRStatus status = PR_FAILURE;
     NSSPrivateKey *vkey, **vkeys;
     NSSCertificate *ucert, **ucerts;
 
@@ -752,8 +793,10 @@ vkeys = NULL;
 	if (encKey) {
 	    CMD_DumpOutput(encKey, rtData);
 	    NSSItem_Destroy(encKey);
+	    status = PR_SUCCESS;
 	}
     }
+    return status;
 }
 
 PRStatus
diff --git a/mozilla/security/nss/cmd/pkiutil/pkiutil.c b/mozilla/security/nss/cmd/pkiutil/pkiutil.c
index 645990eb90d..bb3eb04a90d 100644
--- a/mozilla/security/nss/cmd/pkiutil/pkiutil.c
+++ b/mozilla/security/nss/cmd/pkiutil/pkiutil.c
@@ -74,6 +74,7 @@ enum {
     opt_TokenName,
     opt_InputFile,
     opt_Info,
+    opt_KeyType,
     opt_Nickname,
     opt_OutputFile,
     opt_Orphans,
@@ -128,6 +129,7 @@ static cmdCommandLineArg pkiutil_commands[] =
      CMDBIT(opt_ProfileDir) | 
      CMDBIT(opt_TokenName) | 
      CMDBIT(opt_InputFile) | 
+     CMDBIT(opt_KeyType) |
      CMDBIT(opt_Password) |
      CMDBIT(opt_Binary) | 
      CMDBIT(opt_Type) |
@@ -272,6 +274,7 @@ static cmdCommandLineOpt pkiutil_options[] =
  { /* opt_TokenName   */  'h', "token",    CMDArgReq },
  { /* opt_InputFile   */  'i', "infile",   CMDArgReq },
  { /* opt_Info        */   0 , "info",     CMDNoArg  },
+ { /* opt_KeyType     */  'k', "key-type", CMDArgReq },
  { /* opt_Nickname    */  'n', "nickname", CMDArgReq },
  { /* opt_OutputFile  */  'o', "outfile",  CMDArgReq },
  { /* opt_Orphans     */   0 , "orphans",  CMDNoArg  },
@@ -292,10 +295,11 @@ static char * pkiutil_options_help[] =
  "name of PKCS#11 token to use (default: internal)",
  "file for input (default: stdin)",
  "print object-specific information (token instances, etc.)",
+ "type of key (rsa|dsa|dh)",
  "nickname of object",
  "file for output (default: stdout)",
  "delete orphaned key pairs (keys not associated with a cert)",
- "specify a slot password at the command line"
+ "specify a slot password at the command line",
  "use raw (binary der-encoded) mode for I/O",
  "specify a certificate serial number",
  "trust level for certificate",
@@ -500,6 +504,7 @@ pkiutil_command_dispatcher(cmdCommand *pkiutil, int cmdToRun)
 	                      token,
 	                      pkiutil->opt[opt_Type].arg,
 	                      pkiutil->opt[opt_Nickname].arg,
+	                      pkiutil->opt[opt_KeyType].arg,
 	                      pkiutil->opt[opt_KeyPassword].arg,
 	                      &rtData);
 	break;
diff --git a/mozilla/security/nss/cmd/pkiutil/pkiutil.h b/mozilla/security/nss/cmd/pkiutil/pkiutil.h
index 52e334fe0db..65ece73b92d 100644
--- a/mozilla/security/nss/cmd/pkiutil/pkiutil.h
+++ b/mozilla/security/nss/cmd/pkiutil/pkiutil.h
@@ -21,6 +21,7 @@ ImportObject
   NSSToken *tokenOpt,
   char *objectTypeOpt,
   char *nickname,
+  char *keyTypeOpt,
   char *keypass,
   CMDRunTimeData *rtData
 );
diff --git a/mozilla/security/nss/lib/dev/ckhelper.c b/mozilla/security/nss/lib/dev/ckhelper.c
index 2e59c0eeb49..33064109758 100644
--- a/mozilla/security/nss/lib/dev/ckhelper.c
+++ b/mozilla/security/nss/lib/dev/ckhelper.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: ckhelper.c,v $ $Revision: 1.24.2.6 $ $Date: 2002-11-06 19:16:28 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: ckhelper.c,v $ $Revision: 1.24.2.7 $ $Date: 2002-11-14 20:39:13 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef NSSCKEPV_H
@@ -483,7 +483,7 @@ nss_key_pair_type_from_ck_attrib(CK_ATTRIBUTE_PTR attrib)
     switch (ckKeyType) {
     case CKK_RSA: return NSSKeyPairType_RSA;
     case CKK_DSA: return NSSKeyPairType_DSA;
-    case CKK_DH:  return NSSKeyPairType_DiffieHellman;
+    case CKK_DH:  return NSSKeyPairType_DH;
     default: break;
     }
     return NSSKeyPairType_Unknown;
@@ -951,6 +951,19 @@ nssCK_GetSymKeyType (
     }
 }
 
+NSS_IMPLEMENT CK_KEY_TYPE
+nssCK_GetKeyPairType (
+  NSSKeyPairType keyType
+)
+{
+    switch (keyType) {
+    case NSSKeyPairType_RSA: return CKK_RSA;
+    case NSSKeyPairType_DSA: return CKK_DSA;
+    case NSSKeyPairType_DH:  return CKK_DH;
+    default:                 return -1;
+    }
+}
+
 NSS_IMPLEMENT void
 nss_SetGenericDeviceError (
   CK_RV ckrv
diff --git a/mozilla/security/nss/lib/dev/ckhelper.h b/mozilla/security/nss/lib/dev/ckhelper.h
index 9445dfae448..cf06e89ac31 100644
--- a/mozilla/security/nss/lib/dev/ckhelper.h
+++ b/mozilla/security/nss/lib/dev/ckhelper.h
@@ -41,7 +41,7 @@
 #define CKHELPER_H
 
 #ifdef DEBUG
-static const char CKHELPER_CVS_ID[] = "@(#) $RCSfile: ckhelper.h,v $ $Revision: 1.16.18.3 $ $Date: 2002-10-22 19:19:11 $ $Name: not supported by cvs2svn $";
+static const char CKHELPER_CVS_ID[] = "@(#) $RCSfile: ckhelper.h,v $ $Revision: 1.16.18.4 $ $Date: 2002-11-14 20:39:14 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef NSSCKT_H
@@ -205,6 +205,11 @@ nssCK_GetSymKeyType (
   NSSSymmetricKeyType keyType
 );
 
+NSS_EXTERN CK_KEY_TYPE
+nssCK_GetKeyPairType (
+  NSSKeyPairType keyType
+);
+
 PR_END_EXTERN_C
 
 #endif /* CKHELPER_H */
diff --git a/mozilla/security/nss/lib/dev/dev.h b/mozilla/security/nss/lib/dev/dev.h
index 92bcc588f68..9bb3229b3dc 100644
--- a/mozilla/security/nss/lib/dev/dev.h
+++ b/mozilla/security/nss/lib/dev/dev.h
@@ -41,7 +41,7 @@
  */
 
 #ifdef DEBUG
-static const char DEV_CVS_ID[] = "@(#) $RCSfile: dev.h,v $ $Revision: 1.29.2.12 $ $Date: 2002-11-14 16:26:18 $ $Name: not supported by cvs2svn $";
+static const char DEV_CVS_ID[] = "@(#) $RCSfile: dev.h,v $ $Revision: 1.29.2.13 $ $Date: 2002-11-14 20:39:14 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef NSSCKT_H
@@ -379,7 +379,8 @@ nssSlot_CreateSession (
  * nssToken_GenerateSymmetricKey
  *
  *   ------ generic key stuff -------
- * nssToken_UnwrapKey
+ * nssToken_UnwrapPrivateKey
+ * nssToken_UnwrapSymmetricKey
  * nssToken_WrapKey
  * nssToken_DeriveKey
  *
@@ -658,7 +659,7 @@ nssToken_GenerateSymmetricKey (
 );
 
 NSS_EXTERN nssCryptokiObject *
-nssToken_UnwrapKey (
+nssToken_UnwrapPrivateKey (
   NSSToken *token,
   nssSession *session,
   const NSSAlgorithmAndParameters *ap,
@@ -666,7 +667,21 @@ nssToken_UnwrapKey (
   NSSItem *wrappedKey,
   PRBool asTokenObject,
   NSSOperations operations,
-  NSSProperties properties
+  NSSProperties properties,
+  NSSKeyPairType privKeyType
+);
+
+NSS_IMPLEMENT nssCryptokiObject *
+nssToken_UnwrapSymmetricKey (
+  NSSToken *token,
+  nssSession *session,
+  const NSSAlgorithmAndParameters *ap,
+  nssCryptokiObject *wrappingKey,
+  NSSItem *wrappedKey,
+  PRBool asTokenObject,
+  NSSOperations operations,
+  NSSProperties properties,
+  NSSSymmetricKeyType symKeyType
 );
 
 NSS_EXTERN NSSItem *
diff --git a/mozilla/security/nss/lib/dev/devtoken.c b/mozilla/security/nss/lib/dev/devtoken.c
index 827007168bd..d89f8bae96e 100644
--- a/mozilla/security/nss/lib/dev/devtoken.c
+++ b/mozilla/security/nss/lib/dev/devtoken.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: devtoken.c,v $ $Revision: 1.28.2.11 $ $Date: 2002-11-14 01:52:31 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: devtoken.c,v $ $Revision: 1.28.2.12 $ $Date: 2002-11-14 20:39:15 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef NSSCKEPV_H
@@ -1690,8 +1690,8 @@ prepare_output_buffer(NSSArena *arenaOpt, NSSItem *rvOpt,
     return rvOpt;
 }
 
-NSS_IMPLEMENT nssCryptokiObject *
-nssToken_UnwrapKey (
+static nssCryptokiObject *
+unwrap_key (
   NSSToken *token,
   nssSession *session,
   const NSSAlgorithmAndParameters *ap,
@@ -1699,7 +1699,9 @@ nssToken_UnwrapKey (
   NSSItem *wrappedKey,
   PRBool asTokenObject,
   NSSOperations operations,
-  NSSProperties properties
+  NSSProperties properties,
+  CK_OBJECT_CLASS keyClass,
+  CK_KEY_TYPE keyType
 )
 {
     CK_RV ckrv;
@@ -1712,8 +1714,6 @@ nssToken_UnwrapKey (
     void *epv = nssToken_GetCryptokiEPV(token);
     PRUint32 numLeft;
     PRUint32 numkt = sizeof(keyTemplate) / sizeof(keyTemplate[0]);
-    CK_OBJECT_CLASS class = CKO_PRIVATE_KEY; /* XXX */
-    CK_KEY_TYPE keyType = CKK_RSA; /* XXX */
 
     mechanism = nssAlgorithmAndParameters_GetMechanism(ap);
 
@@ -1724,10 +1724,7 @@ nssToken_UnwrapKey (
     } else {
 	NSS_CK_SET_ATTRIBUTE_ITEM(attr, CKA_TOKEN, &g_ck_false);
     }
-    /* XXX mondo hack, the private key alg is in the pki, but can't
-     *     access pkcs#8 via pkcs#11, doing this for testing only
-     */
-    NSS_CK_SET_ATTRIBUTE_VAR(attr, CKA_CLASS, class);
+    NSS_CK_SET_ATTRIBUTE_VAR(attr, CKA_CLASS, keyClass);
     NSS_CK_SET_ATTRIBUTE_VAR(attr, CKA_KEY_TYPE, keyType);
     if (operations) {
 	numLeft = numkt - (attr - keyTemplate);
@@ -1755,6 +1752,44 @@ nssToken_UnwrapKey (
     return unwrappedKey;
 }
 
+NSS_IMPLEMENT nssCryptokiObject *
+nssToken_UnwrapPrivateKey (
+  NSSToken *token,
+  nssSession *session,
+  const NSSAlgorithmAndParameters *ap,
+  nssCryptokiObject *wrappingKey,
+  NSSItem *wrappedKey,
+  PRBool asTokenObject,
+  NSSOperations operations,
+  NSSProperties properties,
+  NSSKeyPairType privKeyType
+)
+{
+    CK_KEY_TYPE keyType = nssCK_GetKeyPairType(privKeyType);
+    return unwrap_key(token, session, ap, wrappingKey, wrappedKey,
+                      asTokenObject, operations, properties,
+                      CKO_PRIVATE_KEY, keyType);
+}
+
+NSS_IMPLEMENT nssCryptokiObject *
+nssToken_UnwrapSymmetricKey (
+  NSSToken *token,
+  nssSession *session,
+  const NSSAlgorithmAndParameters *ap,
+  nssCryptokiObject *wrappingKey,
+  NSSItem *wrappedKey,
+  PRBool asTokenObject,
+  NSSOperations operations,
+  NSSProperties properties,
+  NSSSymmetricKeyType symKeyType
+)
+{
+    CK_KEY_TYPE keyType = nssCK_GetSymKeyType(symKeyType);
+    return unwrap_key(token, session, ap, wrappingKey, wrappedKey,
+                      asTokenObject, operations, properties,
+                      CKO_SECRET_KEY, keyType);
+}
+
 NSS_IMPLEMENT NSSItem *
 nssToken_WrapKey (
   NSSToken *token,
diff --git a/mozilla/security/nss/lib/dev/nssdevt.h b/mozilla/security/nss/lib/dev/nssdevt.h
index b4910921ac8..60ce331602f 100644
--- a/mozilla/security/nss/lib/dev/nssdevt.h
+++ b/mozilla/security/nss/lib/dev/nssdevt.h
@@ -35,7 +35,7 @@
 #define NSSDEVT_H
 
 #ifdef DEBUG
-static const char NSSDEVT_CVS_ID[] = "@(#) $RCSfile: nssdevt.h,v $ $Revision: 1.3.44.7 $ $Date: 2002-11-14 01:52:33 $ $Name: not supported by cvs2svn $";
+static const char NSSDEVT_CVS_ID[] = "@(#) $RCSfile: nssdevt.h,v $ $Revision: 1.3.44.8 $ $Date: 2002-11-14 20:39:16 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 /*
@@ -94,7 +94,7 @@ typedef enum
   NSSKeyPairType_Unknown = 0,
   NSSKeyPairType_RSA = 1,
   NSSKeyPairType_DSA = 2,
-  NSSKeyPairType_DiffieHellman = 3
+  NSSKeyPairType_DH = 3
 } NSSKeyPairType;
 
 typedef struct NSSRSAPublicKeyInfoStr
diff --git a/mozilla/security/nss/lib/pki/asymmkey.c b/mozilla/security/nss/lib/pki/asymmkey.c
index 5346fbe739a..6d507844124 100644
--- a/mozilla/security/nss/lib/pki/asymmkey.c
+++ b/mozilla/security/nss/lib/pki/asymmkey.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: asymmkey.c,v $ $Revision: 1.3.44.10 $ $Date: 2002-11-14 01:52:37 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: asymmkey.c,v $ $Revision: 1.3.44.11 $ $Date: 2002-11-14 20:39:19 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef BASE_H
@@ -359,6 +359,9 @@ NSSPrivateKey_Encode (
 NSS_IMPLEMENT NSSPrivateKey *
 nssPrivateKey_Decode (
   NSSBER *ber,
+  NSSKeyPairType keyPairType,
+  NSSOperations operations,
+  NSSProperties properties,
   NSSUTF8 *passwordOpt,
   NSSCallback *uhhOpt,
   NSSToken *destination,
@@ -433,8 +436,10 @@ nssPrivateKey_Decode (
     nssSlot_Destroy(slot);
 
     /* unwrap the private key with the PBE key */
-    vkey = nssToken_UnwrapKey(destination, session, wrapAP, 
-                              pbeKey, &epki.encData, PR_TRUE, 0, 0);
+    vkey = nssToken_UnwrapPrivateKey(destination, session, wrapAP, 
+                                     pbeKey, &epki.encData, PR_TRUE, 
+                                     operations, properties, 
+                                     keyPairType);
     if (!vkey) {
 	goto cleanup;
     }
diff --git a/mozilla/security/nss/lib/pki/nsspki.h b/mozilla/security/nss/lib/pki/nsspki.h
index 2a021a60516..4b3e64a300a 100644
--- a/mozilla/security/nss/lib/pki/nsspki.h
+++ b/mozilla/security/nss/lib/pki/nsspki.h
@@ -35,7 +35,7 @@
 #define NSSPKI_H
 
 #ifdef DEBUG
-static const char NSSPKI_CVS_ID[] = "@(#) $RCSfile: nsspki.h,v $ $Revision: 1.7.44.13 $ $Date: 2002-11-14 01:52:38 $ $Name: not supported by cvs2svn $";
+static const char NSSPKI_CVS_ID[] = "@(#) $RCSfile: nsspki.h,v $ $Revision: 1.7.44.14 $ $Date: 2002-11-14 20:39:20 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 /*
@@ -1585,6 +1585,9 @@ NSS_EXTERN NSSPrivateKey *
 NSSTrustDomain_ImportEncodedPrivateKey (
   NSSTrustDomain *td,
   NSSBER *ber,
+  NSSKeyPairType keyPairType,
+  NSSOperations operations,
+  NSSProperties properties,
   NSSUTF8 *passwordOpt, /* NULL will cause a callback */
   NSSCallback *uhhOpt,
   NSSToken *destination
diff --git a/mozilla/security/nss/lib/pki/pki.h b/mozilla/security/nss/lib/pki/pki.h
index 6ba7c5f9196..80093146a73 100644
--- a/mozilla/security/nss/lib/pki/pki.h
+++ b/mozilla/security/nss/lib/pki/pki.h
@@ -35,7 +35,7 @@
 #define PKI_H
 
 #ifdef DEBUG
-static const char PKI_CVS_ID[] = "@(#) $RCSfile: pki.h,v $ $Revision: 1.11.18.8 $ $Date: 2002-11-14 01:52:40 $ $Name: not supported by cvs2svn $";
+static const char PKI_CVS_ID[] = "@(#) $RCSfile: pki.h,v $ $Revision: 1.11.18.9 $ $Date: 2002-11-14 20:39:21 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef NSSDEVT_H
@@ -240,6 +240,9 @@ nssPrivateKey_AddRef (
 NSS_EXTERN NSSPrivateKey *
 nssPrivateKey_Decode (
   NSSBER *ber,
+  NSSKeyPairType keyPairType,
+  NSSOperations operations,
+  NSSProperties properties,
   NSSUTF8 *passwordOpt,
   NSSCallback *uhhOpt,
   NSSToken *destination,
diff --git a/mozilla/security/nss/lib/pki/trustdomain.c b/mozilla/security/nss/lib/pki/trustdomain.c
index 618925a72ae..5bfc8677a05 100644
--- a/mozilla/security/nss/lib/pki/trustdomain.c
+++ b/mozilla/security/nss/lib/pki/trustdomain.c
@@ -32,7 +32,7 @@
  */
 
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: trustdomain.c,v $ $Revision: 1.42.16.12 $ $Date: 2002-11-14 01:52:41 $ $Name: not supported by cvs2svn $";
+static const char CVS_ID[] = "@(#) $RCSfile: trustdomain.c,v $ $Revision: 1.42.16.13 $ $Date: 2002-11-14 20:39:21 $ $Name: not supported by cvs2svn $";
 #endif /* DEBUG */
 
 #ifndef DEV_H
@@ -474,25 +474,35 @@ NSS_IMPLEMENT NSSPrivateKey *
 nssTrustDomain_ImportEncodedPrivateKey (
   NSSTrustDomain *td,
   NSSBER *ber,
+  NSSKeyPairType keyPairType,
+  NSSOperations operations,
+  NSSProperties properties,
   NSSUTF8 *passwordOpt,
   NSSCallback *uhhOpt,
   NSSToken *destination
 )
 {
-    return nssPrivateKey_Decode(ber, passwordOpt, uhhOpt, destination, td);
+    return nssPrivateKey_Decode(ber, keyPairType, 
+                                operations, properties, 
+                                passwordOpt, uhhOpt, destination, td);
 }
 
 NSS_IMPLEMENT NSSPrivateKey *
 NSSTrustDomain_ImportEncodedPrivateKey (
   NSSTrustDomain *td,
   NSSBER *ber,
+  NSSKeyPairType keyPairType,
+  NSSOperations operations,
+  NSSProperties properties,
   NSSUTF8 *passwordOpt,
   NSSCallback *uhhOpt,
   NSSToken *destination
 )
 {
-    return nssTrustDomain_ImportEncodedPrivateKey(td, ber, passwordOpt,
-                                                  uhhOpt, destination);
+    return nssTrustDomain_ImportEncodedPrivateKey(td, ber, keyPairType,
+                                                  operations, properties, 
+                                                  passwordOpt, uhhOpt, 
+                                                  destination);
 }
 
 NSS_IMPLEMENT NSSPublicKey *
diff --git a/mozilla/security/nss/tests/stan/stan.sh b/mozilla/security/nss/tests/stan/stan.sh
index 467d69ad036..c9ac003611b 100644
--- a/mozilla/security/nss/tests/stan/stan.sh
+++ b/mozilla/security/nss/tests/stan/stan.sh
@@ -127,6 +127,23 @@ pkiu()
   return $RET
 }
 
+pkiuf()
+{
+  echo ""
+  echo ">>>>>>>>>>>>>> ${PKIU_ACTION} <<<<<<<<<<<<<<"
+  echo "pkiutil $*"
+  pkiutil $*
+  RET=$?
+  if [ "$RET" -ne ${FAILURE_CODE} ]; then
+    CERTFAILED=$RET
+    html_failed "<TR><TD>${PKIU_ACTION} ($RET) " 
+    cert_log "ERROR: ${PKIU_ACTION} failed $RET"
+  else
+    html_passed "<TR><TD>${PKIU_ACTION}"
+  fi
+  return $RET
+}
+
 cert_init
 cd ${HOSTDIR}
 cp ${QADIR}/stan/*.b64 .
@@ -172,4 +189,60 @@ if [ "$RET" -ne 0 ]; then
   Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
 fi
 
+PKIU_ACTION="List Certs"
+pkiu -L -d ${SERVERDIR}
+if [ "$RET" -ne 0 ]; then
+  Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
+fi
+
+PKIU_ACTION="Attempt Validation of Server Cert (FAIL)"
+FAILURE_CODE=255
+pkiuf -V -d ${SERVERDIR} -n stanCert -u cv
+if [ "$RET" -ne ${FAILURE_CODE} ]; then
+  Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
+fi
+
+PKIU_ACTION="Set Root Cert Trust"
+pkiu -M -d ${SERVERDIR} -n stanRoot -u CV
+if [ "$RET" -ne 0 ]; then
+  Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
+fi
+
+PKIU_ACTION="Validate Server Cert"
+pkiu -V -d ${SERVERDIR} -n stanCert -u cv
+if [ "$RET" -ne 0 ]; then
+  Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
+fi
+
+PKIU_ACTION="Export Copy of Server Cert"
+pkiu -E -d ${SERVERDIR} -n stanCert --type cert -a -o stanCertCopy.b64
+if [ "$RET" -ne 0 ]; then
+  Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
+fi
+
+PKIU_ACTION="Import Expired Cert"
+pkiu ${PKIU_IMPORT} -n stanExpired -i stanExpired.b64
+if [ "$RET" -ne 0 ]; then
+  Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
+fi
+
+PKIU_ACTION="Attempt Validation of Expired Cert (FAIL)"
+FAILURE_CODE=255
+pkiuf -V -d ${SERVERDIR} -n stanExpired -u cv
+if [ "$RET" -ne ${FAILURE_CODE} ]; then
+  Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
+fi
+
+PKIU_ACTION="Delete Expired Cert"
+pkiu -D -d ${SERVERDIR} -n stanExpired 
+if [ "$RET" -ne 0 ]; then
+  Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
+fi
+
+PKIU_ACTION="List Certs"
+pkiu -L -d ${SERVERDIR}
+if [ "$RET" -ne 0 ]; then
+  Exit 6 "Fatal - failed ${PKIU_ACTION} [$RET]"
+fi
+
 cert_cleanup
diff --git a/mozilla/security/nss/tests/stan/stanExpired.b64 b/mozilla/security/nss/tests/stan/stanExpired.b64
new file mode 100644
index 00000000000..ff08c3e3943
--- /dev/null
+++ b/mozilla/security/nss/tests/stan/stanExpired.b64
@@ -0,0 +1,11 @@
+MIICATCCAWqgAwIBAgIEZWcRQDANBgkqhkiG9w0BAQQFADAzMQswCQYDVQQIEwJT
+UDENMAsGA1UEChMEU3RhbjEVMBMGA1UEAxMMVGVzdGluZyBDQSAxMB4XDTAxMTEx
+NDE4MDg1M1oXDTAyMDgxNDE4MDg1M1owMzELMAkGA1UECBMCU1AxDTALBgNVBAoT
+BFN0YW4xFTATBgNVBAMTDEV4cGlyZWQgQ2VydDCBnzANBgkqhkiG9w0BAQEFAAOB
+jQAwgYkCgYEAljP7L17O29XWzbQIUqMfGIfhi7sQcs9+j8Qvs2ck1TPrbkkORD2D
+CXx9sj9CNWF3kwZ31fCfjxj2ZT3bYJDAip6aozHUaJlHCA/JVwSLbaJXcV94uTfQ
+lo3DRG11ZQJXUUrP0V/l4w6y8Yuqyj/dOYrX+UsQrvTCX1zuAJocCukCAwEAAaMi
+MCAwEQYJYIZIAYb4QgEBBAQDAgbAMAsGA1UdDwQEAwIDmDANBgkqhkiG9w0BAQQF
+AAOBgQCARJvR0P/CjSfTxqNgYhAVzkfadv3LvA4Yyf93MMlfG260yWybyOBHh6ck
+YtdEVyyQ7mdGDPatqEMyX4Zhd4x4VeuFWGbHs2DGRiTp/vNkXk2+flnaOoyU2brX
+a8RqQN9zsCeZOuE5CM3jC87GiLLJWjdsxqwEaKnESACRtf59Ww==