What labels does NSS use to identify certificates?
NSS can use the CKA_LABEL attribute to identify user certificates (see previous question) and presents this label to the user. Therefore, each user certificate must have some label associated with it. The label for a token certificate is presented to the user as follows: token label:certificate label. This implies that each token label should be unique and meaningful to the user, and that each certificate label should be unique to the token. NSS gets the value of the CKA_LABEL attribute from the token. Labels should not have any trailing blank characters.