--- a/security/manager/pki/resources/content/certManager.js
+++ b/security/manager/pki/resources/content/certManager.js
@@ -268,16 +268,17 @@ function backupCerts() {
   var bundle = document.getElementById("pippki_bundle");
   var fp = Cc[nsFilePicker].createInstance(nsIFilePicker);
   fp.init(window,
           bundle.getString("chooseP12BackupFileDialog"),
           nsIFilePicker.modeSave);
   fp.appendFilter(bundle.getString("file_browse_PKCS12_spec"),
                   "*.p12");
   fp.appendFilters(nsIFilePicker.filterAll);
+  fp.defaultExtension = "p12";
   fp.open(rv => {
     if (rv == nsIFilePicker.returnOK || rv == nsIFilePicker.returnReplace) {
       certdb.exportPKCS12File(fp.file, selected_certs.length, selected_certs);
     }
   });
 }
 
 function backupAllCerts() {

--- a/security/manager/ssl/ScopedNSSTypes.h
+++ b/security/manager/ssl/ScopedNSSTypes.h
@@ -351,11 +351,18 @@ MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(Un
 
 MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniqueSGNDigestInfo,
                                       SGNDigestInfo,
                                       SGN_DestroyDigestInfo)
 
 MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniqueVFYContext,
                                       VFYContext,
                                       internal::VFY_DestroyContext_true)
+
+MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniqueSEC_PKCS12DecoderContext,
+                                      SEC_PKCS12DecoderContext,
+                                      SEC_PKCS12DecoderFinish)
+MOZ_TYPE_SPECIFIC_UNIQUE_PTR_TEMPLATE(UniqueSEC_PKCS12ExportContext,
+                                      SEC_PKCS12ExportContext,
+                                      SEC_PKCS12DestroyExportContext)
 } // namespace mozilla
 
 #endif // ScopedNSSTypes_h

--- a/security/manager/ssl/nsNSSComponent.cpp
+++ b/security/manager/ssl/nsNSSComponent.cpp
@@ -2640,16 +2640,31 @@ setPassword(PK11SlotInfo* slot, nsIInter
     if (canceled) {
       return NS_ERROR_NOT_AVAILABLE;
     }
   }
 
   return NS_OK;
 }
 
+// NSS will call this during PKCS12 export to potentially switch the endianness
+// of the characters of `inBuf` to big (network) endian. Since we already did
+// that in nsPKCS12Blob::stringToBigEndianBytes, we just perform a memcpy here.
+extern "C" {
+PRBool
+pkcs12StringEndiannessConversion(PRBool, unsigned char* inBuf,
+                                 unsigned int inBufLen, unsigned char* outBuf,
+                                 unsigned int, unsigned int* outBufLen, PRBool)
+{
+  *outBufLen = inBufLen;
+  memcpy(outBuf, inBuf, inBufLen);
+  return true;
+}
+}
+
 namespace mozilla {
 namespace psm {
 
 nsresult
 InitializeCipherSuite()
 {
   MOZ_ASSERT(NS_IsMainThread(),
              "InitializeCipherSuite() can only be accessed on the main thread");
@@ -2675,17 +2690,17 @@ InitializeCipherSuite()
   // Enable ciphers for PKCS#12
   SEC_PKCS12EnableCipher(PKCS12_RC4_40, 1);
   SEC_PKCS12EnableCipher(PKCS12_RC4_128, 1);
   SEC_PKCS12EnableCipher(PKCS12_RC2_CBC_40, 1);
   SEC_PKCS12EnableCipher(PKCS12_RC2_CBC_128, 1);
   SEC_PKCS12EnableCipher(PKCS12_DES_56, 1);
   SEC_PKCS12EnableCipher(PKCS12_DES_EDE3_168, 1);
   SEC_PKCS12SetPreferredCipher(PKCS12_DES_EDE3_168, 1);
-  PORT_SetUCS2_ASCIIConversionFunction(pip_ucs2_ascii_conversion_fn);
+  PORT_SetUCS2_ASCIIConversionFunction(pkcs12StringEndiannessConversion);
 
   // PSM enforces a minimum RSA key size of 1024 bits, which is overridable.
   // NSS has its own minimum, which is not overridable (the default is 1023
   // bits). This sets the NSS minimum to 512 bits so users can still connect to
   // devices like wifi routers with woefully small keys (they would have to add
   // an override to do so, but they already do for such devices).
   NSS_OptionSet(NSS_RSA_MIN_KEY_SIZE, 512);
 

--- a/security/manager/ssl/nsNSSHelper.h
+++ b/security/manager/ssl/nsNSSHelper.h
@@ -1,56 +1,35 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef NSS_HELPER_
-#define NSS_HELPER_
+#ifndef nsNSSHelper_h
+#define nsNSSHelper_h
 
 #include "nsIInterfaceRequestor.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "pk11func.h"
 
-//
-// Implementation of an nsIInterfaceRequestor for use
-// as context for NSS calls
-//
+// Implementation of an nsIInterfaceRequestor for use as context for NSS calls.
 class PipUIContext : public nsIInterfaceRequestor
 {
 public:
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIINTERFACEREQUESTOR
 
   PipUIContext();
 
 protected:
   virtual ~PipUIContext();
 };
 
-//
-// Function to get the implementor for a certain set of NSS
-// specific dialogs.
-//
-
+// Function to get the implementor for a certain set of NSS specific dialogs.
 nsresult
 getNSSDialogs(void **_result, REFNSIID aIID, const char *contract);
 
-extern "C" {
-// a "fake" unicode conversion function
-PRBool
-pip_ucs2_ascii_conversion_fn(PRBool toUnicode,
-                             unsigned char *inBuf,
-                             unsigned int inBufLen,
-                             unsigned char *outBuf,
-                             unsigned int maxOutBufLen,
-                             unsigned int *outBufLen,
-                             PRBool swapBytes);
-}
-
-//
 // A function that sets the password on an unitialized slot.
-//
 nsresult
 setPassword(PK11SlotInfo* slot, nsIInterfaceRequestor* ctx);
 
-#endif
+#endif // nsNSSHelper_h

--- a/security/manager/ssl/nsPKCS12Blob.cpp
+++ b/security/manager/ssl/nsPKCS12Blob.cpp
@@ -21,424 +21,359 @@
 #include "nsThreadUtils.h"
 #include "p12plcy.h"
 #include "pkix/pkixtypes.h"
 #include "secerr.h"
 
 using namespace mozilla;
 extern LazyLogModule gPIPNSSLog;
 
-#define PIP_PKCS12_TMPFILENAME NS_LITERAL_CSTRING(".pip_p12tmp")
 #define PIP_PKCS12_BUFFER_SIZE 2048
-#define PIP_PKCS12_USER_CANCELED 3
 #define PIP_PKCS12_NOSMARTCARD_EXPORT 4
 #define PIP_PKCS12_RESTORE_FAILED 5
 #define PIP_PKCS12_BACKUP_FAILED 6
 #define PIP_PKCS12_NSS_ERROR 7
 
-// constructor
 nsPKCS12Blob::nsPKCS12Blob()
-  : mCertArray(nullptr)
-  , mTmpFile(nullptr)
+  : mUIContext(new PipUIContext())
 {
-  mUIContext = new PipUIContext();
 }
 
-// nsPKCS12Blob::ImportFromFile
-//
 // Given a file handle, read a PKCS#12 blob from that file, decode it, and
 // import the results into the internal database.
 nsresult
 nsPKCS12Blob::ImportFromFile(nsIFile* file)
 {
-  nsresult rv = NS_OK;
-
+  nsresult rv;
   RetryReason wantRetry;
-
   do {
-    rv = ImportFromFileHelper(file, im_standard_prompt, wantRetry);
+    rv = ImportFromFileHelper(file, ImportMode::StandardPrompt, wantRetry);
 
-    if (NS_SUCCEEDED(rv) && wantRetry == rr_auto_retry_empty_password_flavors) {
-      rv = ImportFromFileHelper(file, im_try_zero_length_secitem, wantRetry);
+    if (NS_SUCCEEDED(rv) && wantRetry == RetryReason::AutoRetryEmptyPassword) {
+      rv = ImportFromFileHelper(file, ImportMode::TryZeroLengthSecitem,
+                                wantRetry);
     }
-  } while (NS_SUCCEEDED(rv) && (wantRetry != rr_do_not_retry));
+  } while (NS_SUCCEEDED(rv) && (wantRetry != RetryReason::DoNotRetry));
 
   return rv;
 }
 
-nsresult
-nsPKCS12Blob::ImportFromFileHelper(nsIFile* file,
-                                   nsPKCS12Blob::ImportMode aImportMode,
-                                   nsPKCS12Blob::RetryReason& aWantRetry)
+void
+nsPKCS12Blob::handleImportError(PRErrorCode nssError, RetryReason& retryReason,
+                                uint32_t passwordLengthInBytes)
 {
-  nsresult rv = NS_OK;
-  SECStatus srv = SECSuccess;
-  SEC_PKCS12DecoderContext* dcx = nullptr;
-  SECItem unicodePw = { siBuffer, nullptr, 0 };
+  if (nssError == SEC_ERROR_BAD_PASSWORD) {
+    // If the password is 2 bytes, it only consists of the wide character null
+    // terminator. In this case we want to retry with a zero-length password.
+    if (passwordLengthInBytes == 2) {
+      retryReason = nsPKCS12Blob::RetryReason::AutoRetryEmptyPassword;
+    } else {
+      retryReason = RetryReason::BadPassword;
+      handleError(PIP_PKCS12_NSS_ERROR, nssError);
+    }
+  } else {
+    handleError(PIP_PKCS12_NSS_ERROR, nssError);
+  }
+}
 
-  aWantRetry = rr_do_not_retry;
+// Returns a failing nsresult if some XPCOM operation failed, and NS_OK
+// otherwise. Returns by reference whether or not we want to retry the operation
+// immediately.
+nsresult
+nsPKCS12Blob::ImportFromFileHelper(nsIFile* file, ImportMode aImportMode,
+                                   RetryReason& aWantRetry)
+{
+  aWantRetry = RetryReason::DoNotRetry;
 
   UniquePK11SlotInfo slot(PK11_GetInternalKeySlot());
   if (!slot) {
-    srv = SECFailure;
-    goto finish;
+    return NS_ERROR_FAILURE;
   }
 
-  if (aImportMode == im_try_zero_length_secitem) {
-    unicodePw.len = 0;
+  uint32_t passwordBufferLength;
+  UniquePtr<uint8_t[]> passwordBuffer;
+  if (aImportMode == ImportMode::TryZeroLengthSecitem) {
+    passwordBufferLength = 0;
+    passwordBuffer = nullptr;
   } else {
     // get file password (unicode)
-    rv = getPKCS12FilePassword(&unicodePw);
-    if (NS_FAILED(rv))
-      goto finish;
-    if (!unicodePw.data) {
-      handleError(PIP_PKCS12_USER_CANCELED);
+    nsresult rv = getPKCS12FilePassword(passwordBufferLength, passwordBuffer);
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    if (!passwordBuffer) {
       return NS_OK;
     }
   }
 
   // initialize the decoder
-  dcx = SEC_PKCS12DecoderStart(&unicodePw,
-                               slot.get(),
-                               nullptr,
-                               nullptr,
-                               nullptr,
-                               nullptr,
-                               nullptr,
-                               nullptr);
+  SECItem unicodePw = { siBuffer, passwordBuffer.get(), passwordBufferLength };
+  UniqueSEC_PKCS12DecoderContext dcx(
+    SEC_PKCS12DecoderStart(&unicodePw, slot.get(), nullptr, nullptr, nullptr,
+                           nullptr, nullptr, nullptr));
   if (!dcx) {
-    srv = SECFailure;
-    goto finish;
+    return NS_ERROR_FAILURE;
   }
   // read input file and feed it to the decoder
-  rv = inputToDecoder(dcx, file);
+  PRErrorCode nssError;
+  nsresult rv = inputToDecoder(dcx, file, nssError);
   if (NS_FAILED(rv)) {
-    if (NS_ERROR_ABORT == rv) {
-      // inputToDecoder indicated a NSS error
-      srv = SECFailure;
-    }
-    goto finish;
+    return rv;
+  }
+  if (nssError != 0) {
+    handleImportError(nssError, aWantRetry, unicodePw.len);
+    return NS_OK;
   }
   // verify the blob
-  srv = SEC_PKCS12DecoderVerify(dcx);
-  if (srv)
-    goto finish;
+  SECStatus srv = SEC_PKCS12DecoderVerify(dcx.get());
+  if (srv != SECSuccess) {
+    handleImportError(PR_GetError(), aWantRetry, unicodePw.len);
+    return NS_OK;
+  }
   // validate bags
-  srv = SEC_PKCS12DecoderValidateBags(dcx, nickname_collision);
-  if (srv)
-    goto finish;
-  // import cert and key
-  srv = SEC_PKCS12DecoderImportBags(dcx);
-  if (srv)
-    goto finish;
-  // Later - check to see if this should become default email cert
-finish:
-  // If srv != SECSuccess, NSS probably set a specific error code.
-  // We should use that error code instead of inventing a new one
-  // for every error possible.
+  srv = SEC_PKCS12DecoderValidateBags(dcx.get(), nicknameCollision);
   if (srv != SECSuccess) {
-    if (SEC_ERROR_BAD_PASSWORD == PORT_GetError()) {
-      if (unicodePw.len == sizeof(char16_t)) {
-        // no password chars available,
-        // unicodeToItem allocated space for the trailing zero character only.
-        aWantRetry = rr_auto_retry_empty_password_flavors;
-      } else {
-        aWantRetry = rr_bad_password;
-        handleError(PIP_PKCS12_NSS_ERROR);
-      }
-    } else {
-      handleError(PIP_PKCS12_NSS_ERROR);
-    }
-  } else if (NS_FAILED(rv)) {
-    handleError(PIP_PKCS12_RESTORE_FAILED);
+    handleImportError(PR_GetError(), aWantRetry, unicodePw.len);
+    return NS_OK;
   }
-  // finish the decoder
-  if (dcx)
-    SEC_PKCS12DecoderFinish(dcx);
-  SECITEM_ZfreeItem(&unicodePw, false);
+  // import cert and key
+  srv = SEC_PKCS12DecoderImportBags(dcx.get());
+  if (srv != SECSuccess) {
+    handleImportError(PR_GetError(), aWantRetry, unicodePw.len);
+  }
   return NS_OK;
 }
 
 static bool
-isExtractable(SECKEYPrivateKey* privKey)
+isExtractable(UniqueSECKEYPrivateKey& privKey)
 {
   ScopedAutoSECItem value;
-  SECStatus rv =
-    PK11_ReadRawAttribute(PK11_TypePrivKey, privKey, CKA_EXTRACTABLE, &value);
+  SECStatus rv = PK11_ReadRawAttribute(
+    PK11_TypePrivKey, privKey.get(), CKA_EXTRACTABLE, &value);
   if (rv != SECSuccess) {
     return false;
   }
 
   bool isExtractable = false;
   if ((value.len == 1) && value.data) {
     isExtractable = !!(*(CK_BBOOL*)value.data);
   }
   return isExtractable;
 }
 
-// nsPKCS12Blob::ExportToFile
-//
 // Having already loaded the certs, form them into a blob (loading the keys
 // also), encode the blob, and stuff it into the file.
 nsresult
 nsPKCS12Blob::ExportToFile(nsIFile* file, nsIX509Cert** certs, int numCerts)
 {
-  nsresult rv;
-  SECStatus srv = SECSuccess;
-  SEC_PKCS12ExportContext* ecx = nullptr;
-  SEC_PKCS12SafeInfo *certSafe = nullptr, *keySafe = nullptr;
-  SECItem unicodePw;
-  nsAutoString filePath;
-  int i;
-  nsCOMPtr<nsIFile> localFileRef;
-  // init slot
-
-  bool InformedUserNoSmartcardBackup = false;
-  int numCertsExported = 0;
+  bool informedUserNoSmartcardBackup = false;
 
   // get file password (unicode)
-  unicodePw.data = nullptr;
-  rv = newPKCS12FilePassword(&unicodePw);
-  if (NS_FAILED(rv))
-    goto finish;
-  if (!unicodePw.data) {
-    handleError(PIP_PKCS12_USER_CANCELED);
+  uint32_t passwordBufferLength;
+  UniquePtr<uint8_t[]> passwordBuffer;
+  nsresult rv = newPKCS12FilePassword(passwordBufferLength, passwordBuffer);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  if (!passwordBuffer) {
     return NS_OK;
   }
-  // what about slotToUse in psm 1.x ???
-  // create export context
-  ecx =
-    SEC_PKCS12CreateExportContext(nullptr, nullptr, nullptr /*slot*/, nullptr);
+  UniqueSEC_PKCS12ExportContext ecx(
+    SEC_PKCS12CreateExportContext(nullptr, nullptr, nullptr, nullptr));
   if (!ecx) {
-    srv = SECFailure;
-    goto finish;
+    handleError(PIP_PKCS12_BACKUP_FAILED, PR_GetError());
+    return NS_ERROR_FAILURE;
   }
   // add password integrity
-  srv = SEC_PKCS12AddPasswordIntegrity(ecx, &unicodePw, SEC_OID_SHA1);
-  if (srv)
-    goto finish;
-  for (i = 0; i < numCerts; i++) {
-    nsNSSCertificate* cert = (nsNSSCertificate*)certs[i];
-    // get it as a CERTCertificate XXX
-    UniqueCERTCertificate nssCert(cert->GetCert());
+  SECItem unicodePw = { siBuffer, passwordBuffer.get(), passwordBufferLength };
+  SECStatus srv = SEC_PKCS12AddPasswordIntegrity(ecx.get(), &unicodePw,
+                                                 SEC_OID_SHA1);
+  if (srv != SECSuccess) {
+    handleError(PIP_PKCS12_BACKUP_FAILED, PR_GetError());
+    return NS_ERROR_FAILURE;
+  }
+  for (int i = 0; i < numCerts; i++) {
+    UniqueCERTCertificate nssCert(certs[i]->GetCert());
     if (!nssCert) {
-      rv = NS_ERROR_FAILURE;
-      goto finish;
+      handleError(PIP_PKCS12_BACKUP_FAILED, PR_GetError());
+      return NS_ERROR_FAILURE;
     }
-    // We can only successfully export certs that are on
-    // internal token.  Most, if not all, smart card vendors
-    // won't let you extract the private key (in any way
-    // shape or form) from the card.  So let's punt if
+    // We can probably only successfully export certs that are on the internal
+    // token. Most, if not all, smart card vendors won't let you extract the
+    // private key (in any way shape or form) from the card. So let's punt if
     // the cert is not in the internal db.
     if (nssCert->slot && !PK11_IsInternal(nssCert->slot)) {
-      // we aren't the internal token, see if the key is extractable.
-      SECKEYPrivateKey* privKey =
-        PK11_FindKeyByDERCert(nssCert->slot, nssCert.get(), this);
-
-      if (privKey) {
-        bool privKeyIsExtractable = isExtractable(privKey);
-
-        SECKEY_DestroyPrivateKey(privKey);
-
-        if (!privKeyIsExtractable) {
-          if (!InformedUserNoSmartcardBackup) {
-            InformedUserNoSmartcardBackup = true;
-            handleError(PIP_PKCS12_NOSMARTCARD_EXPORT);
-          }
-          continue;
+      // We aren't the internal token, see if the key is extractable.
+      UniqueSECKEYPrivateKey privKey(
+        PK11_FindKeyByDERCert(nssCert->slot, nssCert.get(), mUIContext));
+      if (privKey && !isExtractable(privKey)) {
+        if (!informedUserNoSmartcardBackup) {
+          informedUserNoSmartcardBackup = true;
+          handleError(PIP_PKCS12_NOSMARTCARD_EXPORT, PR_GetError());
         }
+        continue;
       }
     }
 
-    // XXX this is why, to verify the slot is the same
-    // PK11_FindObjectForCert(nssCert, nullptr, slot);
-    // create the cert and key safes
-    keySafe = SEC_PKCS12CreateUnencryptedSafe(ecx);
+    // certSafe and keySafe are owned by ecx.
+    SEC_PKCS12SafeInfo* certSafe;
+    SEC_PKCS12SafeInfo* keySafe = SEC_PKCS12CreateUnencryptedSafe(ecx.get());
     if (!SEC_PKCS12IsEncryptionAllowed() || PK11_IsFIPS()) {
       certSafe = keySafe;
     } else {
       certSafe = SEC_PKCS12CreatePasswordPrivSafe(
-        ecx, &unicodePw, SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC);
+        ecx.get(), &unicodePw,
+        SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC);
     }
     if (!certSafe || !keySafe) {
-      rv = NS_ERROR_FAILURE;
-      goto finish;
+      handleError(PIP_PKCS12_BACKUP_FAILED, PR_GetError());
+      return NS_ERROR_FAILURE;
     }
     // add the cert and key to the blob
     srv = SEC_PKCS12AddCertAndKey(
-      ecx,
+      ecx.get(),
       certSafe,
       nullptr,
       nssCert.get(),
-      CERT_GetDefaultCertDB(), // XXX
+      CERT_GetDefaultCertDB(),
       keySafe,
       nullptr,
       true,
       &unicodePw,
       SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC);
-    if (srv)
-      goto finish;
-    // cert was dup'ed, so release it
-    ++numCertsExported;
+    if (srv != SECSuccess) {
+      handleError(PIP_PKCS12_BACKUP_FAILED, PR_GetError());
+      return NS_ERROR_FAILURE;
+    }
   }
 
-  if (!numCertsExported)
-    goto finish;
-
-  // prepare the instance to write to an export file
-  this->mTmpFile = nullptr;
-  file->GetPath(filePath);
-  // Use the nsCOMPtr var localFileRef so that
-  // the reference to the nsIFile we create gets released as soon as
-  // we're out of scope, ie when this function exits.
-  if (filePath.RFind(".p12", true, -1, 4) < 0) {
-    // We're going to add the .p12 extension to the file name just like
-    // Communicator used to.  We create a new nsIFile and initialize
-    // it with the new patch.
-    filePath.AppendLiteral(".p12");
-    localFileRef = do_CreateInstance(NS_LOCAL_FILE_CONTRACTID, &rv);
-    if (NS_FAILED(rv))
-      goto finish;
-    localFileRef->InitWithPath(filePath);
-    file = localFileRef;
+  UniquePRFileDesc prFile;
+  PRFileDesc* rawPRFile;
+  rv = file->OpenNSPRFileDesc(
+    PR_RDWR | PR_CREATE_FILE | PR_TRUNCATE, 0664, &rawPRFile);
+  if (NS_FAILED(rv) || !rawPRFile) {
+    handleError(PIP_PKCS12_BACKUP_FAILED, PR_GetError());
+    return NS_ERROR_FAILURE;
   }
-  rv = file->OpenNSPRFileDesc(
-    PR_RDWR | PR_CREATE_FILE | PR_TRUNCATE, 0664, &mTmpFile);
-  if (NS_FAILED(rv) || !this->mTmpFile)
-    goto finish;
+  prFile.reset(rawPRFile);
   // encode and write
-  srv = SEC_PKCS12Encode(ecx, write_export_file, this);
-  if (srv)
-    goto finish;
-finish:
-  if (NS_FAILED(rv) || srv != SECSuccess) {
-    handleError(PIP_PKCS12_BACKUP_FAILED);
+  srv = SEC_PKCS12Encode(ecx.get(), writeExportFile, prFile.get());
+  if (srv != SECSuccess) {
+    handleError(PIP_PKCS12_BACKUP_FAILED, PR_GetError());
+    return NS_ERROR_FAILURE;
   }
-  if (ecx)
-    SEC_PKCS12DestroyExportContext(ecx);
-  if (this->mTmpFile) {
-    PR_Close(this->mTmpFile);
-    this->mTmpFile = nullptr;
-  }
-  SECITEM_ZfreeItem(&unicodePw, false);
-  return rv;
+  return NS_OK;
 }
 
-///////////////////////////////////////////////////////////////////////
-//
-//  private members
-//
-///////////////////////////////////////////////////////////////////////
-
-// unicodeToItem
-//
-// For the NSS PKCS#12 library, must convert PRUnichars (shorts) to
-// a buffer of octets.  Must handle byte order correctly.
-nsresult
-nsPKCS12Blob::unicodeToItem(const nsString& uni, SECItem* item)
+// For the NSS PKCS#12 library, must convert PRUnichars (shorts) to a buffer of
+// octets. Must handle byte order correctly.
+UniquePtr<uint8_t[]>
+nsPKCS12Blob::stringToBigEndianBytes(const nsString& uni, uint32_t& bytesLength)
 {
-  uint32_t len = uni.Length() + 1; // +1 for the null terminator.
-  if (!SECITEM_AllocItem(nullptr, item, sizeof(char16_t) * len)) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
+  uint32_t wideLength = uni.Length() + 1; // +1 for the null terminator.
+  bytesLength = wideLength * 2;
+  auto buffer = MakeUnique<uint8_t[]>(bytesLength);
 
   // We have to use a cast here because on Windows, uni.get() returns
   // char16ptr_t instead of char16_t*.
   mozilla::NativeEndian::copyAndSwapToBigEndian(
-    item->data, static_cast<const char16_t*>(uni.get()), len);
+    buffer.get(), static_cast<const char16_t*>(uni.get()), wideLength);
 
-  return NS_OK;
+  return buffer;
 }
 
-// newPKCS12FilePassword
-//
 // Launch a dialog requesting the user for a new PKCS#12 file passowrd.
 // Handle user canceled by returning null password (caller must catch).
 nsresult
-nsPKCS12Blob::newPKCS12FilePassword(SECItem* unicodePw)
+nsPKCS12Blob::newPKCS12FilePassword(uint32_t& passwordBufferLength,
+                                    UniquePtr<uint8_t[]>& passwordBuffer)
 {
-  nsresult rv = NS_OK;
   nsAutoString password;
   nsCOMPtr<nsICertificateDialogs> certDialogs;
-  rv = ::getNSSDialogs(getter_AddRefs(certDialogs),
-                       NS_GET_IID(nsICertificateDialogs),
-                       NS_CERTIFICATEDIALOGS_CONTRACTID);
-  if (NS_FAILED(rv))
+  nsresult rv = ::getNSSDialogs(getter_AddRefs(certDialogs),
+                                NS_GET_IID(nsICertificateDialogs),
+                                NS_CERTIFICATEDIALOGS_CONTRACTID);
+  if (NS_FAILED(rv)) {
     return rv;
-  bool pressedOK;
+  }
+  bool pressedOK = false;
   rv = certDialogs->SetPKCS12FilePassword(mUIContext, password, &pressedOK);
-  if (NS_FAILED(rv) || !pressedOK)
+  if (NS_FAILED(rv)) {
     return rv;
-  return unicodeToItem(password, unicodePw);
+  }
+  if (!pressedOK) {
+    return NS_OK;
+  }
+  passwordBuffer = Move(stringToBigEndianBytes(password, passwordBufferLength));
+  return NS_OK;
 }
 
-// getPKCS12FilePassword
-//
 // Launch a dialog requesting the user for the password to a PKCS#12 file.
 // Handle user canceled by returning null password (caller must catch).
 nsresult
-nsPKCS12Blob::getPKCS12FilePassword(SECItem* unicodePw)
+nsPKCS12Blob::getPKCS12FilePassword(uint32_t& passwordBufferLength,
+                                    UniquePtr<uint8_t[]>& passwordBuffer)
 {
-  nsresult rv = NS_OK;
-  nsAutoString password;
   nsCOMPtr<nsICertificateDialogs> certDialogs;
-  rv = ::getNSSDialogs(getter_AddRefs(certDialogs),
-                       NS_GET_IID(nsICertificateDialogs),
-                       NS_CERTIFICATEDIALOGS_CONTRACTID);
-  if (NS_FAILED(rv))
+  nsresult rv = ::getNSSDialogs(getter_AddRefs(certDialogs),
+                                NS_GET_IID(nsICertificateDialogs),
+                                NS_CERTIFICATEDIALOGS_CONTRACTID);
+  if (NS_FAILED(rv)) {
     return rv;
-  bool pressedOK;
+  }
+  nsAutoString password;
+  bool pressedOK = false;
   rv = certDialogs->GetPKCS12FilePassword(mUIContext, password, &pressedOK);
-  if (NS_FAILED(rv) || !pressedOK)
+  if (NS_FAILED(rv)) {
     return rv;
-  return unicodeToItem(password, unicodePw);
+  }
+  if (!pressedOK) {
+    return NS_OK;
+  }
+  passwordBuffer = Move(stringToBigEndianBytes(password, passwordBufferLength));
+  return NS_OK;
 }
 
-// inputToDecoder
-//
 // Given a decoder, read bytes from file and input them to the decoder.
 nsresult
-nsPKCS12Blob::inputToDecoder(SEC_PKCS12DecoderContext* dcx, nsIFile* file)
+nsPKCS12Blob::inputToDecoder(UniqueSEC_PKCS12DecoderContext& dcx, nsIFile* file,
+                             PRErrorCode& nssError)
 {
-  nsresult rv;
-  SECStatus srv;
-  uint32_t amount;
-  char buf[PIP_PKCS12_BUFFER_SIZE];
+  nssError = 0;
 
   nsCOMPtr<nsIInputStream> fileStream;
-  rv = NS_NewLocalFileInputStream(getter_AddRefs(fileStream), file);
-
+  nsresult rv = NS_NewLocalFileInputStream(getter_AddRefs(fileStream), file);
   if (NS_FAILED(rv)) {
     return rv;
   }
 
+  char buf[PIP_PKCS12_BUFFER_SIZE];
+  uint32_t amount;
   while (true) {
     rv = fileStream->Read(buf, PIP_PKCS12_BUFFER_SIZE, &amount);
     if (NS_FAILED(rv)) {
       return rv;
     }
     // feed the file data into the decoder
-    srv = SEC_PKCS12DecoderUpdate(dcx, (unsigned char*)buf, amount);
-    if (srv) {
-      // don't allow the close call to overwrite our precious error code
-      int pr_err = PORT_GetError();
-      PORT_SetError(pr_err);
-      return NS_ERROR_ABORT;
+    SECStatus srv = SEC_PKCS12DecoderUpdate(
+      dcx.get(), (unsigned char*)buf, amount);
+    if (srv != SECSuccess) {
+      nssError = PR_GetError();
+      return NS_OK;
     }
-    if (amount < PIP_PKCS12_BUFFER_SIZE)
+    if (amount < PIP_PKCS12_BUFFER_SIZE) {
       break;
+    }
   }
   return NS_OK;
 }
 
-// nickname_collision
-// what to do when the nickname collides with one already in the db.
-// TODO: not handled, throw a dialog allowing the nick to be changed?
+// What to do when the nickname collides with one already in the db.
 SECItem*
-nsPKCS12Blob::nickname_collision(SECItem* oldNick, PRBool* cancel, void* wincx)
+nsPKCS12Blob::nicknameCollision(SECItem* oldNick, PRBool* cancel, void* wincx)
 {
   *cancel = false;
   int count = 1;
   nsCString nickname;
   nsAutoString nickFromProp;
   nsresult rv = GetPIPNSSBundleString("P12DefaultNickname", nickFromProp);
   if (NS_FAILED(rv)) {
     return nullptr;
@@ -474,90 +409,66 @@ nsPKCS12Blob::nickname_collision(SECItem
     }
     UniqueCERTCertificate cert(
       CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname.get()));
     if (!cert) {
       break;
     }
     count++;
   }
-  SECItem* newNick = new SECItem;
-  if (!newNick)
+  UniqueSECItem newNick(SECITEM_AllocItem(nullptr, nullptr,
+                                          nickname.Length() + 1));
+  if (!newNick) {
     return nullptr;
+  }
+  memcpy(newNick->data, nickname.get(), nickname.Length());
+  newNick->data[nickname.Length()] = 0;
 
-  newNick->type = siAsciiString;
-  newNick->data = (unsigned char*)strdup(nickname.get());
-  newNick->len = strlen((char*)newNick->data);
-  return newNick;
+  return newNick.release();
 }
 
-// write_export_file
 // write bytes to the exported PKCS#12 file
 void
-nsPKCS12Blob::write_export_file(void* arg, const char* buf, unsigned long len)
+nsPKCS12Blob::writeExportFile(void* arg, const char* buf, unsigned long len)
 {
-  nsPKCS12Blob* cx = (nsPKCS12Blob*)arg;
-  PR_Write(cx->mTmpFile, buf, len);
-}
-
-// pip_ucs2_ascii_conversion_fn
-// required to be set by NSS (to do PKCS#12), but since we've already got
-// unicode make this a no-op.
-PRBool
-pip_ucs2_ascii_conversion_fn(PRBool toUnicode,
-                             unsigned char* inBuf,
-                             unsigned int inBufLen,
-                             unsigned char* outBuf,
-                             unsigned int maxOutBufLen,
-                             unsigned int* outBufLen,
-                             PRBool swapBytes)
-{
-  // do a no-op, since I've already got unicode.  Hah!
-  *outBufLen = inBufLen;
-  memcpy(outBuf, inBuf, inBufLen);
-  return true;
+  PRFileDesc* file = static_cast<PRFileDesc*>(arg);
+  MOZ_RELEASE_ASSERT(file);
+  PR_Write(file, buf, len);
 }
 
 void
-nsPKCS12Blob::handleError(int myerr)
+nsPKCS12Blob::handleError(int myerr, PRErrorCode prerr)
 {
   MOZ_ASSERT(NS_IsMainThread());
   if (!NS_IsMainThread()) {
     return;
   }
 
-  int prerr = PORT_GetError();
   MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("PKCS12: NSS/NSPR error(%d)", prerr));
   MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("PKCS12: I called(%d)", myerr));
 
   const char* msgID = nullptr;
 
   switch (myerr) {
-    case PIP_PKCS12_USER_CANCELED:
-      return; /* Just ignore it for now */
     case PIP_PKCS12_NOSMARTCARD_EXPORT:
       msgID = "PKCS12InfoNoSmartcardBackup";
       break;
     case PIP_PKCS12_RESTORE_FAILED:
       msgID = "PKCS12UnknownErrRestore";
       break;
     case PIP_PKCS12_BACKUP_FAILED:
       msgID = "PKCS12UnknownErrBackup";
       break;
     case PIP_PKCS12_NSS_ERROR:
       switch (prerr) {
-        // The following errors have the potential to be "handled", by asking
-        // the user (via a dialog) whether s/he wishes to continue
         case 0:
           break;
         case SEC_ERROR_PKCS12_CERT_COLLISION:
-          /* pop a dialog saying the cert is already in the database */
-          /* ask to keep going?  what happens if one collision but others ok? */
-          // The following errors cannot be "handled", notify the user (via an
-          // alert) that the operation failed.
+          msgID = "PKCS12DupData";
+          break;
         case SEC_ERROR_BAD_PASSWORD:
           msgID = "PK11BadPassword";
           break;
 
         case SEC_ERROR_BAD_DER:
         case SEC_ERROR_PKCS12_CORRUPT_PFX_STRUCTURE:
         case SEC_ERROR_PKCS12_INVALID_MAC:
           msgID = "PKCS12DecodeErr";
@@ -565,18 +476,19 @@ nsPKCS12Blob::handleError(int myerr)
 
         case SEC_ERROR_PKCS12_DUPLICATE_DATA:
           msgID = "PKCS12DupData";
           break;
       }
       break;
   }
 
-  if (!msgID)
+  if (!msgID) {
     msgID = "PKCS12UnknownErr";
+  }
 
   nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
   if (!wwatch) {
     return;
   }
   nsCOMPtr<nsIPrompt> prompter;
   if (NS_FAILED(wwatch->GetNewPrompter(nullptr, getter_AddRefs(prompter)))) {
     return;

--- a/security/manager/ssl/nsPKCS12Blob.h
+++ b/security/manager/ssl/nsPKCS12Blob.h
@@ -1,81 +1,80 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef nsPKCS12Blob_h
 #define nsPKCS12Blob_h
 
 #include "nsCOMPtr.h"
 #include "nsIMutableArray.h"
 #include "nsString.h"
 #include "p12.h"
 #include "seccomon.h"
 
 class nsIFile;
 class nsIX509Cert;
 
-//
-// nsPKCS12Blob
-//
 // Class for importing/exporting PKCS#12 blobs
-//
 class nsPKCS12Blob
 {
 public:
   nsPKCS12Blob();
-  virtual ~nsPKCS12Blob() {}
+  ~nsPKCS12Blob() {}
 
   // PKCS#12 Import
   nsresult ImportFromFile(nsIFile* file);
 
   // PKCS#12 Export
   nsresult ExportToFile(nsIFile* file, nsIX509Cert** certs, int numCerts);
 
 private:
-  nsCOMPtr<nsIMutableArray> mCertArray;
   nsCOMPtr<nsIInterfaceRequestor> mUIContext;
 
   // local helper functions
-  nsresult getPKCS12FilePassword(SECItem*);
-  nsresult newPKCS12FilePassword(SECItem*);
-  nsresult inputToDecoder(SEC_PKCS12DecoderContext*, nsIFile*);
-  nsresult unicodeToItem(const nsString& uni, SECItem* item);
-  void handleError(int myerr = 0);
+  nsresult getPKCS12FilePassword(uint32_t& passwordBufferLength,
+                                 UniquePtr<uint8_t[]>& passwordBuffer);
+  nsresult newPKCS12FilePassword(uint32_t& passwordBufferLength,
+                                 UniquePtr<uint8_t[]>& passwordBuffer);
+  nsresult inputToDecoder(UniqueSEC_PKCS12DecoderContext& dcx, nsIFile* file,
+                          PRErrorCode& nssError);
+  UniquePtr<uint8_t[]> stringToBigEndianBytes(const nsString& uni,
+                                              uint32_t& bytesLength);
+  void handleError(int myerr, PRErrorCode prerr);
 
   // RetryReason and ImportMode are used when importing a PKCS12 file.
   // There are two reasons that cause us to retry:
   // - When the password entered by the user is incorrect.
   //   The user will be prompted to try again.
   // - When the user entered a zero length password.
-  //   An empty password should be represented as an empty
-  //   string (a SECItem that contains a single terminating
-  //   null UTF16 character), but some applications use a
-  //   zero length SECItem.
-  //   We try both variations, zero length item and empty string,
-  //   without giving a user prompt when trying the different empty password
-  //   flavors.
-
-  enum RetryReason
+  //   An empty password should be represented as an empty string (a SECItem
+  //   that contains a single terminating null UTF16 character), but some
+  //   applications use a zero length SECItem. We try both variations, zero
+  //   length item and empty string, without giving a user prompt when trying
+  //   the different empty password flavors.
+  enum class RetryReason
   {
-    rr_do_not_retry,
-    rr_bad_password,
-    rr_auto_retry_empty_password_flavors
+    DoNotRetry,
+    BadPassword,
+    AutoRetryEmptyPassword,
   };
-  enum ImportMode
+  enum class ImportMode
   {
-    im_standard_prompt,
-    im_try_zero_length_secitem
+    StandardPrompt,
+    TryZeroLengthSecitem
   };
 
+  void handleImportError(PRErrorCode nssError, RetryReason& retryReason,
+                         uint32_t passwordLengthInBytes);
+
   nsresult ImportFromFileHelper(nsIFile* file,
                                 ImportMode aImportMode,
                                 RetryReason& aWantRetry);
 
-  // NSPR file I/O for export file
-  PRFileDesc* mTmpFile;
-
-  static SECItem* nickname_collision(SECItem*, PRBool*, void*);
-  static void write_export_file(void* arg, const char* buf, unsigned long len);
+  static SECItem* nicknameCollision(SECItem* oldNick, PRBool* cancel,
+                                    void* wincx);
+  static void writeExportFile(void* arg, const char* buf, unsigned long len);
 };
 
 #endif // nsPKCS12Blob_h

copy from security/manager/ssl/tests/unit/test_certDB_import_with_master_password.js
copy to security/manager/ssl/tests/unit/test_certDB_export_pkcs12.js
--- a/security/manager/ssl/tests/unit/test_certDB_import_with_master_password.js
+++ b/security/manager/ssl/tests/unit/test_certDB_export_pkcs12.js
@@ -1,130 +1,115 @@
 // -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
 // Any copyright is dedicated to the Public Domain.
 // http://creativecommons.org/publicdomain/zero/1.0/
 "use strict";
 
-// Tests that a CA certificate can still be imported if the user has a master
-// password set.
+// Tests exporting a certificate and key as a PKCS#12 blob and importing it
+// again with a new password set.
 
 do_get_profile();
 
 const gCertDB = Cc["@mozilla.org/security/x509certdb;1"]
                   .getService(Ci.nsIX509CertDB);
 
-const CA_CERT_COMMON_NAME = "importedCA";
+const PKCS12_FILE = "test_certDB_import/cert_from_windows.pfx";
+const CERT_COMMON_NAME = "test_cert_from_windows";
+const TEST_CERT_PASSWORD = "黒い";
+const TEST_OUTPUT_PASSWORD = "other password";
 
-let gCACertImportDialogCount = 0;
+let gPasswordToUse = TEST_CERT_PASSWORD;
 
 // Mock implementation of nsICertificateDialogs.
 const gCertificateDialogs = {
-  confirmDownloadCACert: (ctx, cert, trust) => {
-    gCACertImportDialogCount++;
-    equal(cert.commonName, CA_CERT_COMMON_NAME,
-          "CA cert to import should have the correct CN");
-    trust.value = Ci.nsIX509CertDB.TRUSTED_EMAIL;
+  confirmDownloadCACert: () => {
+    // We don't test anything that calls this method.
+    ok(false, "confirmDownloadCACert() should not have been called");
+  },
+  setPKCS12FilePassword: (ctx, password) => {
+    password.value = gPasswordToUse;
     return true;
   },
-  setPKCS12FilePassword: (ctx, password) => {
-    // This is only relevant to exporting.
-    ok(false, "setPKCS12FilePassword() should not have been called");
-  },
   getPKCS12FilePassword: (ctx, password) => {
-    // We don't test anything that calls this method yet.
-    ok(false, "getPKCS12FilePassword() should not have been called");
+    password.value = gPasswordToUse;
+    return true;
   },
   viewCert: (ctx, cert) => {
     // This shouldn't be called for import methods.
     ok(false, "viewCert() should not have been called");
   },
 
   QueryInterface: ChromeUtils.generateQI([Ci.nsICertificateDialogs])
 };
 
-var gMockPrompter = {
-  passwordToTry: "password",
-  numPrompts: 0,
-
-  // This intentionally does not use arrow function syntax to avoid an issue
-  // where in the context of the arrow function, |this != gMockPrompter| due to
-  // how objects get wrapped when going across xpcom boundaries.
-  promptPassword(dialogTitle, text, password, checkMsg, checkValue) {
-    this.numPrompts++;
-    if (this.numPrompts > 1) { // don't keep retrying a bad password
-      return false;
-    }
-    equal(text,
-          "Please enter your master password.",
-          "password prompt text should be as expected");
-    equal(checkMsg, null, "checkMsg should be null");
-    ok(this.passwordToTry, "passwordToTry should be non-null");
-    password.value = this.passwordToTry;
-    return true;
-  },
+var gPrompt = {
+  clickOk: true,
 
   QueryInterface: ChromeUtils.generateQI([Ci.nsIPrompt]),
 
-  // Again with the arrow function issue.
-  getInterface(iid) {
-    if (iid.equals(Ci.nsIPrompt)) {
-      return this;
-    }
+  // This intentionally does not use arrow function syntax to avoid an issue
+  // where in the context of the arrow function, |this != gPrompt| due to
+  // how objects get wrapped when going across xpcom boundaries.
+  alert(title, text) {
+    ok(false, "Not expecting alert to be called.");
+  },
 
-    throw new Error(Cr.NS_ERROR_NO_INTERFACE);
-  }
+  promptPassword(dialogTitle, text, password, checkMsg, checkValue) {
+    ok(false, "Not expecting a password prompt.");
+    return false;
+  },
 };
 
-function getCertAsByteArray(certPath) {
-  let certFile = do_get_file(certPath, false);
-  let certBytes = readFile(certFile);
-
-  let byteArray = [];
-  for (let i = 0; i < certBytes.length; i++) {
-    byteArray.push(certBytes.charCodeAt(i));
-  }
-
-  return byteArray;
-}
+const gPromptFactory = {
+  QueryInterface: ChromeUtils.generateQI([Ci.nsIPromptFactory]),
+  getPrompt: (aWindow, aIID) => gPrompt,
+};
 
 function findCertByCommonName(commonName) {
   let certEnumerator = gCertDB.getCerts().getEnumerator();
   while (certEnumerator.hasMoreElements()) {
     let cert = certEnumerator.getNext().QueryInterface(Ci.nsIX509Cert);
     if (cert.commonName == commonName) {
       return cert;
     }
   }
   return null;
 }
 
 function run_test() {
   let certificateDialogsCID =
     MockRegistrar.register("@mozilla.org/nsCertificateDialogs;1",
                            gCertificateDialogs);
+  let promptFactoryCID =
+    MockRegistrar.register("@mozilla.org/prompter;1", gPromptFactory);
+
   registerCleanupFunction(() => {
     MockRegistrar.unregister(certificateDialogsCID);
+    MockRegistrar.unregister(promptFactoryCID);
   });
 
-  // Set a master password.
-  let tokenDB = Cc["@mozilla.org/security/pk11tokendb;1"]
-                  .getService(Ci.nsIPK11TokenDB);
-  let token = tokenDB.getInternalKeyToken();
-  token.initPassword("password");
-  token.logoutSimple();
-
-  // Sanity check the CA cert is missing.
-  equal(findCertByCommonName(CA_CERT_COMMON_NAME), null,
-        "CA cert should not be in the database before import");
+  // Import the certificate and key so we have something to export.
+  let cert = findCertByCommonName(CERT_COMMON_NAME);
+  equal(cert, null, "cert should not be found before import");
+  let certFile = do_get_file(PKCS12_FILE);
+  ok(certFile, `${PKCS12_FILE} should exist`);
+  gPasswordToUse = TEST_CERT_PASSWORD;
+  gCertDB.importPKCS12File(certFile);
+  cert = findCertByCommonName(CERT_COMMON_NAME);
+  notEqual(cert, null, "cert should be found now");
 
-  // Import and check for success.
-  let caArray = getCertAsByteArray("test_certDB_import/importedCA.pem");
-  gCertDB.importCertificates(caArray, caArray.length, Ci.nsIX509Cert.CA_CERT,
-                             gMockPrompter);
-  equal(gCACertImportDialogCount, 1,
-        "Confirmation dialog for the CA cert should only be shown once");
+  // Export the certificate and key.
+  let output = do_get_tempdir();
+  output.append("output.p12");
+  ok(!output.exists(), "output shouldn't exist before exporting PKCS12 file");
+  gPasswordToUse = TEST_OUTPUT_PASSWORD;
+  gCertDB.exportPKCS12File(output, 1, [cert]);
+  ok(output.exists(), "output should exist after exporting PKCS12 file");
 
-  let caCert = findCertByCommonName(CA_CERT_COMMON_NAME);
-  notEqual(caCert, null, "CA cert should now be found in the database");
-  ok(gCertDB.isCertTrusted(caCert, Ci.nsIX509Cert.CA_CERT,
-                           Ci.nsIX509CertDB.TRUSTED_EMAIL),
-     "CA cert should be trusted for e-mail");
+  // We should be able to import the exported blob again using the new password.
+  gCertDB.importPKCS12File(output);
+  output.remove(false /* not a directory; recursive doesn't apply */);
+
+  // Ideally there would be some way to confirm that this actually did anything.
+  // Unfortunately, since deleting a certificate currently doesn't actually do
+  // anything until the platform is restarted, we can't confirm that we
+  // successfully re-imported the certificate.
 }

copy from security/manager/ssl/tests/unit/test_certDB_import_with_master_password.js
copy to security/manager/ssl/tests/unit/test_certDB_export_pkcs12_with_master_password.js
--- a/security/manager/ssl/tests/unit/test_certDB_import_with_master_password.js
+++ b/security/manager/ssl/tests/unit/test_certDB_export_pkcs12_with_master_password.js
@@ -1,130 +1,138 @@
 // -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
 // Any copyright is dedicated to the Public Domain.
 // http://creativecommons.org/publicdomain/zero/1.0/
 "use strict";
 
-// Tests that a CA certificate can still be imported if the user has a master
-// password set.
+// Tests exporting a certificate and key as a PKCS#12 blob if the user has a
+// master password set.
 
 do_get_profile();
 
 const gCertDB = Cc["@mozilla.org/security/x509certdb;1"]
                   .getService(Ci.nsIX509CertDB);
 
-const CA_CERT_COMMON_NAME = "importedCA";
-
-let gCACertImportDialogCount = 0;
+const PKCS12_FILE = "test_certDB_import/cert_from_windows.pfx";
+const CERT_COMMON_NAME = "test_cert_from_windows";
+const TEST_CERT_PASSWORD = "黒い";
 
 // Mock implementation of nsICertificateDialogs.
 const gCertificateDialogs = {
-  confirmDownloadCACert: (ctx, cert, trust) => {
-    gCACertImportDialogCount++;
-    equal(cert.commonName, CA_CERT_COMMON_NAME,
-          "CA cert to import should have the correct CN");
-    trust.value = Ci.nsIX509CertDB.TRUSTED_EMAIL;
+  confirmDownloadCACert: () => {
+    // We don't test anything that calls this method.
+    ok(false, "confirmDownloadCACert() should not have been called");
+  },
+  setPKCS12FilePassword: (ctx, password) => {
+    password.value = TEST_CERT_PASSWORD;
     return true;
   },
-  setPKCS12FilePassword: (ctx, password) => {
-    // This is only relevant to exporting.
-    ok(false, "setPKCS12FilePassword() should not have been called");
-  },
   getPKCS12FilePassword: (ctx, password) => {
-    // We don't test anything that calls this method yet.
-    ok(false, "getPKCS12FilePassword() should not have been called");
+    password.value = TEST_CERT_PASSWORD;
+    return true;
   },
   viewCert: (ctx, cert) => {
     // This shouldn't be called for import methods.
     ok(false, "viewCert() should not have been called");
   },
 
   QueryInterface: ChromeUtils.generateQI([Ci.nsICertificateDialogs])
 };
 
-var gMockPrompter = {
-  passwordToTry: "password",
-  numPrompts: 0,
+var gPrompt = {
+  password: "password",
+  clickOk: true,
+  expectingAlert: false,
+  expectedAlertRegexp: null,
+
+  QueryInterface: ChromeUtils.generateQI([Ci.nsIPrompt]),
 
   // This intentionally does not use arrow function syntax to avoid an issue
-  // where in the context of the arrow function, |this != gMockPrompter| due to
+  // where in the context of the arrow function, |this != gPrompt| due to
   // how objects get wrapped when going across xpcom boundaries.
+  alert(title, text) {
+    info(`alert('${text}')`);
+    ok(this.expectingAlert,
+       "alert() should only be called if we're expecting it");
+    ok(this.expectedAlertRegexp.test(text),
+       "alert text should match expected message");
+  },
+
   promptPassword(dialogTitle, text, password, checkMsg, checkValue) {
-    this.numPrompts++;
-    if (this.numPrompts > 1) { // don't keep retrying a bad password
-      return false;
-    }
     equal(text,
           "Please enter your master password.",
           "password prompt text should be as expected");
     equal(checkMsg, null, "checkMsg should be null");
-    ok(this.passwordToTry, "passwordToTry should be non-null");
-    password.value = this.passwordToTry;
-    return true;
+    password.value = this.password;
+    return this.clickOk;
   },
-
-  QueryInterface: ChromeUtils.generateQI([Ci.nsIPrompt]),
-
-  // Again with the arrow function issue.
-  getInterface(iid) {
-    if (iid.equals(Ci.nsIPrompt)) {
-      return this;
-    }
-
-    throw new Error(Cr.NS_ERROR_NO_INTERFACE);
-  }
 };
 
-function getCertAsByteArray(certPath) {
-  let certFile = do_get_file(certPath, false);
-  let certBytes = readFile(certFile);
-
-  let byteArray = [];
-  for (let i = 0; i < certBytes.length; i++) {
-    byteArray.push(certBytes.charCodeAt(i));
-  }
-
-  return byteArray;
-}
+const gPromptFactory = {
+  QueryInterface: ChromeUtils.generateQI([Ci.nsIPromptFactory]),
+  getPrompt: (aWindow, aIID) => gPrompt,
+};
 
 function findCertByCommonName(commonName) {
   let certEnumerator = gCertDB.getCerts().getEnumerator();
   while (certEnumerator.hasMoreElements()) {
     let cert = certEnumerator.getNext().QueryInterface(Ci.nsIX509Cert);
     if (cert.commonName == commonName) {
       return cert;
     }
   }
   return null;
 }
 
 function run_test() {
   let certificateDialogsCID =
     MockRegistrar.register("@mozilla.org/nsCertificateDialogs;1",
                            gCertificateDialogs);
+  let promptFactoryCID =
+    MockRegistrar.register("@mozilla.org/prompter;1", gPromptFactory);
+
   registerCleanupFunction(() => {
     MockRegistrar.unregister(certificateDialogsCID);
+    MockRegistrar.unregister(promptFactoryCID);
   });
 
   // Set a master password.
   let tokenDB = Cc["@mozilla.org/security/pk11tokendb;1"]
                   .getService(Ci.nsIPK11TokenDB);
   let token = tokenDB.getInternalKeyToken();
   token.initPassword("password");
   token.logoutSimple();
 
-  // Sanity check the CA cert is missing.
-  equal(findCertByCommonName(CA_CERT_COMMON_NAME), null,
-        "CA cert should not be in the database before import");
+  // Import the certificate and key so we have something to export.
+  let cert = findCertByCommonName(CERT_COMMON_NAME);
+  equal(cert, null, "cert should not be found before import");
+  let certFile = do_get_file(PKCS12_FILE);
+  ok(certFile, `${PKCS12_FILE} should exist`);
+  gCertDB.importPKCS12File(certFile);
+  cert = findCertByCommonName(CERT_COMMON_NAME);
+  notEqual(cert, null, "cert should be found now");
+
+  // Log out so we're prompted for the password.
+  token.logoutSimple();
 
-  // Import and check for success.
-  let caArray = getCertAsByteArray("test_certDB_import/importedCA.pem");
-  gCertDB.importCertificates(caArray, caArray.length, Ci.nsIX509Cert.CA_CERT,
-                             gMockPrompter);
-  equal(gCACertImportDialogCount, 1,
-        "Confirmation dialog for the CA cert should only be shown once");
+  // Export the certificate and key (and don't cancel the password request
+  // dialog).
+  let output = do_get_tempdir();
+  output.append("output.p12");
+  ok(!output.exists(), "output shouldn't exist before exporting PKCS12 file");
+  gCertDB.exportPKCS12File(output, 1, [cert]);
+  ok(output.exists(), "output should exist after exporting PKCS12 file");
+  output.remove(false /* not a directory; recursive doesn't apply */);
+
+  // Log out again so we're prompted for the password.
+  token.logoutSimple();
 
-  let caCert = findCertByCommonName(CA_CERT_COMMON_NAME);
-  notEqual(caCert, null, "CA cert should now be found in the database");
-  ok(gCertDB.isCertTrusted(caCert, Ci.nsIX509Cert.CA_CERT,
-                           Ci.nsIX509CertDB.TRUSTED_EMAIL),
-     "CA cert should be trusted for e-mail");
+  // Attempt to export the certificate and key, but this time cancel the
+  // password request dialog. The export operation should also be canceled.
+  gPrompt.clickOk = false;
+  let output2 = do_get_tempdir();
+  output2.append("output2.p12");
+  ok(!output2.exists(), "output2 shouldn't exist before exporting PKCS12 file");
+  gPrompt.expectingAlert = true;
+  gPrompt.expectedAlertRegexp = /Failed to create the PKCS #12 backup file for unknown reasons\./;
+  throws(() => gCertDB.exportPKCS12File(output, 1, [cert]), /NS_ERROR_FAILURE/);
+  ok(!output2.exists(), "output2 shouldn't exist after failing to export");
 }

--- a/security/manager/ssl/tests/unit/xpcshell.ini
+++ b/security/manager/ssl/tests/unit/xpcshell.ini
@@ -58,16 +58,18 @@ run-sequentially = hardcoded ports
 [test_cert_overrides_read_only.js]
 run-sequentially = hardcoded ports
 [test_cert_override_bits_mismatches.js]
 run-sequentially = hardcoded ports
 [test_cert_sha1.js]
 [test_cert_signatures.js]
 [test_cert_trust.js]
 [test_cert_version.js]
+[test_certDB_export_pkcs12.js]
+[test_certDB_export_pkcs12_with_master_password.js]
 [test_certDB_import.js]
 [test_certDB_import_pkcs12.js]
 [test_certDB_import_with_master_password.js]
 [test_certviewer_invalid_oids.js]
 skip-if = toolkit == 'android'
 [test_constructX509FromBase64.js]
 [test_content_signing.js]
 [test_ct.js]