--- a/security/manager/ssl/nsIPK11Token.idl
+++ b/security/manager/ssl/nsIPK11Token.idl
@@ -11,16 +11,18 @@ interface nsIPK11Token : nsISupports
 {
   /*
    * The name of the token
    */
   [must_use]
   readonly attribute AUTF8String tokenName;
   [must_use]
   readonly attribute AUTF8String tokenLabel;
+  [must_use]
+  readonly attribute boolean isInternalKeyToken;
   /**
    * Manufacturer ID of the token.
    */
   [must_use]
   readonly attribute AUTF8String tokenManID;
   /**
    * Hardware version of the token.
    */

--- a/security/manager/ssl/nsPK11TokenDB.cpp
+++ b/security/manager/ssl/nsPK11TokenDB.cpp
@@ -102,16 +102,24 @@ nsPK11Token::GetTokenName(/*out*/ nsACSt
 
 NS_IMETHODIMP
 nsPK11Token::GetTokenLabel(/*out*/ nsACString& tokenLabel)
 {
   return GetAttributeHelper(mTokenLabel, tokenLabel);
 }
 
 NS_IMETHODIMP
+nsPK11Token::GetIsInternalKeyToken(/*out*/ bool* _retval)
+{
+  NS_ENSURE_ARG_POINTER(_retval);
+  *_retval = PK11_IsInternalKeySlot(mSlot.get());
+  return NS_OK;
+}
+
+NS_IMETHODIMP
 nsPK11Token::GetTokenManID(/*out*/ nsACString& tokenManufacturerID)
 {
   return GetAttributeHelper(mTokenManufacturerID, tokenManufacturerID);
 }
 
 NS_IMETHODIMP
 nsPK11Token::GetTokenHWVersion(/*out*/ nsACString& tokenHWVersion)
 {

--- a/security/manager/ssl/tests/unit/test_pkcs11_slot.js
+++ b/security/manager/ssl/tests/unit/test_pkcs11_slot.js
@@ -30,14 +30,15 @@ function run_test() {
         "Actual and expected status should match");
   equal(testSlot.tokenName, "Test PKCS11 Tokeñ 2 Label",
         "Actual and expected token name should match");
 
   let testToken = testSlot.getToken();
   notEqual(testToken, null, "getToken() should succeed");
   equal(testToken.tokenLabel, "Test PKCS11 Tokeñ 2 Label",
         "Spot check: the actual and expected test token labels should be equal");
+  ok(!testToken.isInternalKeyToken, "This token is not the internal key token");
 
   testSlot = testModule.findSlotByName("Empty PKCS11 Slot");
   equal(testSlot.tokenName, null, "Empty slot is empty");
   equal(testSlot.status, Ci.nsIPKCS11Slot.SLOT_NOT_PRESENT,
         "Actual and expected status should match");
 }

--- a/security/manager/ssl/tests/unit/test_pkcs11_token.js
+++ b/security/manager/ssl/tests/unit/test_pkcs11_token.js
@@ -72,16 +72,17 @@ function checkPasswordFeaturesAndResetPa
   ok(!token.isLoggedIn(), "Token should be logged out of after reset");
 }
 
 function run_test() {
   let tokenDB = Cc["@mozilla.org/security/pk11tokendb;1"]
                   .getService(Ci.nsIPK11TokenDB);
   let token = tokenDB.getInternalKeyToken();
   notEqual(token, null, "The internal token should be present");
+  ok(token.isInternalKeyToken, "The internal token should be represented as such");
 
   checkBasicAttributes(token);
 
   ok(!token.isLoggedIn(), "Token should not be logged into yet");
   // Test that attempting to log out even when the token was not logged into
   // does not result in an error.
   token.logoutSimple();
   ok(!token.isLoggedIn(), "Token should still not be logged into");

--- a/security/nss.symbols
+++ b/security/nss.symbols
@@ -394,16 +394,17 @@ PK11_ImportEncryptedPrivateKeyInfoAndRet
 PK11_ImportPublicKey
 PK11_ImportSymKey
 PK11_InitPin
 PK11_IsDisabled
 PK11_IsFIPS
 PK11_IsFriendly
 PK11_IsHW
 PK11_IsInternal
+PK11_IsInternalKeySlot
 PK11_IsLoggedIn
 PK11_IsPresent
 PK11_IsReadOnly
 PK11_IsRemovable
 PK11_KeyForCertExists
 PK11_KeyGen
 PK11_KeyGenWithTemplate
 PK11_ListCerts