Certificates could not be saved to the appropriate token. They were always stored in the NSS certificate database and in the case of a token we may not have access to it. This also affects de-duplication where other tokens are no longer examined.

The NSS p11-kit-proxy introduced in F29 makes extra tokens visible at all times which was confusing certmonger because in some cases it was trying to authenticate to the wrong token.

Note that most of the changes are simply moving code into deeper nesting. The big change in certsave-n.c is to find the right token and authenticate to it.

If no token is specified (for cert or key) then the internal NSS token is assumed.

The final change is related to the tests. Apparently $HOME/.rnd is required for some openssl commands but not created automatically? I just need to ensure it exists for the tests to pass.