Nelson found this leak, as he described in bug 175161 comment 1. Read there for details.
Created attachment 104199 [details] [diff] [review] Patch v1 This patch fixes the leak using the information provided by Nelson.
Please remove the else line before must_free_cert = PR_TRUE; and outdent that line. Then r=nelsonb.
Checked in for Kai on NSS trunk.
Also checked in on NSS 3.6 branch.