1460284 - SSL error codes used by PK11 code, not found by non-SSL code. "error -12285: Unknown code ___P 3"

Status: NEW

(NSS :: Libraries, enhancement, P5)

Description

[Kai Engert [:KaiE:]]

While working on 430198 and testing invalid input, I got a surprising error output:
  error -12285: Unknown code ___P 3

That string is produced by PR_ErrorToString()

Code 12285 lives in the SSL error table, but wasn't registered.

Apparently, installation of the SSL error code table happens automatic when SSL sockets are used, but none are used in this scenario.

The error is set by pk11_FindObjectByTemplate()
  PORT_SetError(crv != CKR_OK ? PK11_MapError(crv) : SSL_ERROR_NO_CERTIFICATE);

Why does NSS use SSL error codes in code paths that are unrelated to SSL?
Wouldn't it be better to use a SEC_ error code?

We could change the code that is set, but on the other hand, I'm also worried about side effects, if existing code already expects this particular error code.

Comment 1

[Kai Engert [:KaiE:]]

The easiest workaround for my use case is to have certutil call a function that triggers init of the error table.

But the question is, how could this be solved in general. Always init the SSL error table, or change the PK11 code to avoid SSL error codes?