diff --git a/lib/pki/tdcache.c b/lib/pki/tdcache.c

--- a/lib/pki/tdcache.c

+++ b/lib/pki/tdcache.c

@@ -379,23 +379,29 @@ nssTrustDomain_UnlockCertCache (

 struct token_cert_dtor {

     NSSToken *token;

     nssTDCertificateCache *cache;

     NSSCertificate **certs;

     PRUint32 numCerts, arrSize;

 };

+static void cert_iter(const void *k, void *v, void *a)

+{

+    nssList *certList = (nssList *)a;

+    NSSCertificate *c = (NSSCertificate *)k;

+    nssList_Add(certList, nssCertificate_AddRef(c));

+}

+

 static void 

-remove_token_certs(const void *k, void *v, void *a)

+remove_token_certs(NSSCertificate *c, struct token_cert_dtor *dtor) 

 {

-    NSSCertificate *c = (NSSCertificate *)k;

     nssPKIObject *object = &c->object;

-    struct token_cert_dtor *dtor = a;

     PRUint32 i;

+

     nssPKIObject_AddRef(object);

     nssPKIObject_Lock(object);

     for (i=0; i<object->numInstances; i++) {

 	if (object->instances[i]->token == dtor->token) {

 	    nssCryptokiObject_Destroy(object->instances[i]);

 	    object->instances[i] = object->instances[object->numInstances-1];

 	    object->instances[object->numInstances-1] = NULL;

 	    object->numInstances--;

@@ -422,45 +428,83 @@ NSS_IMPLEMENT PRStatus

 nssTrustDomain_RemoveTokenCertsFromCache (

   NSSTrustDomain *td,

   NSSToken *token

 )

 {

     NSSCertificate **certs;

     PRUint32 i, arrSize = 10;

     struct token_cert_dtor dtor;

+    nssList *certList;

+    PRStatus nspr_rv = PR_FAILURE;

+    nssListIterator *iter;

+    NSSCertificate *c;

+

     certs = nss_ZNEWARRAY(NULL, NSSCertificate *, arrSize);

     if (!certs) {

 	return PR_FAILURE;

     }

     dtor.cache = td->cache;

     dtor.token = token;

     dtor.certs = certs;

     dtor.numCerts = 0;

     dtor.arrSize = arrSize;

+

+    certList = nssList_Create(NULL, PR_FALSE);

+    if (!certList) {

+	goto loser;

+    }

+    /* fetch the list of certs in the cache */

     PZ_Lock(td->cache->lock);

-    nssHash_Iterate(td->cache->issuerAndSN, remove_token_certs, &dtor);

+    nssHash_Iterate(td->cache->issuerAndSN, cert_iter, (void *)certList);

+    PZ_Unlock(td->cache->lock);

+

+    /* find the certs that match this token without olding the td cache lock */

+    iter=nssList_CreateIterator(certList);

+    if (!iter) {

+	goto loser;

+    }

+    for (c  = (NSSCertificate *)nssListIterator_Start(iter);

+	 c != (NSSCertificate *)NULL;

+	 c  = (NSSCertificate *)nssListIterator_Next(iter)) {

+	remove_token_certs( c, &dtor);

+    }

+    nssListIterator_Finish(iter);

+    nssListIterator_Destroy(iter);

+    nssList_Destroy(certList);

+    certList = NULL;

+

+    /* now remove theose certs attached to this token */

+    PZ_Lock(td->cache->lock);

     for (i=0; i

 	if (dtor.certs[i]->object.numInstances == 0) {

 	    nssTrustDomain_RemoveCertFromCacheLOCKED(td, dtor.certs[i]);

 	    dtor.certs[i] = NULL;  /* skip this cert in the second for loop */

 	} else {

 	    /* make sure it doesn't disappear on us before we finish */

 	    nssCertificate_AddRef(dtor.certs[i]);

 	}

     }

     PZ_Unlock(td->cache->lock);

+

+    /* clean up */

     for (i=0; i

 	if (dtor.certs[i]) {

 	    STAN_ForceCERTCertificateUpdate(dtor.certs[i]);

 	    nssCertificate_Destroy(dtor.certs[i]);

 	}

     }

+

+    nspr_rv = PR_SUCCESS;

+loser:

+    if (certList) {

+	nssList_Destroy(certList);

+    }

     nss_ZFreeIf(dtor.certs);

-    return PR_SUCCESS;

+    return nspr_rv;

 }

 NSS_IMPLEMENT PRStatus

 nssTrustDomain_UpdateCachedTokenCerts (

   NSSTrustDomain *td,

   NSSToken *token

 )

 {

@@ -1073,23 +1117,16 @@ nssTrustDomain_GetCertByDERFromCache (

 #endif

     rvCert = nssTrustDomain_GetCertForIssuerAndSNFromCache(td, 

                                                            &issuer, &serial);

     PORT_Free(issuer.data);

     PORT_Free(serial.data);

     return rvCert;

 }

-static void cert_iter(const void *k, void *v, void *a)

-{

-    nssList *certList = (nssList *)a;

-    NSSCertificate *c = (NSSCertificate *)k;

-    nssList_Add(certList, nssCertificate_AddRef(c));

-}

-

 NSS_EXTERN NSSCertificate **

 nssTrustDomain_GetCertsFromCache (

   NSSTrustDomain *td,

   nssList *certListOpt

 )

 {

     NSSCertificate **rvArray = NULL;

     nssList *certList;