Managed mirror of NSS without the makefile destruction that would make it incompatible with UXP.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Robert Relyea Bug 1682044 pkix_Build_GatherCerts() + pkix_CacheCert_Add() can corrupt "cachedCertTable" 732252121f
3 weeks ago
automation Bug 1690421 - Adjust 3.62 ABI report formatting for new libabigail. r=bbeurdouche 2 weeks ago
cmd Bug 1689228 - Minor ECH -09 fixes for interop testing, fuzzing. r=mt 2 weeks ago
coreconf Hard-disable AVX2 in NSS Build System 2 months ago
cpputil Bug 1654332 - Update ESNI to draft-08 (ECH). r=mt 2 months ago
doc Bug 1546229 Add IPSEC IKE support to softoken. 1 year ago
fuzz Bug 1485533 - Close gaps in taskcluster SSL testing. r=mt 1 year ago
gtests Bug 1690583 - Fix CH padding extension size calculation. r=mt 2 weeks ago
lib Bug 1682044 pkix_Build_GatherCerts() + pkix_CacheCert_Add() can corrupt "cachedCertTable" 2 weeks ago
nss/automation/abi-check Bug 1603628 Update NSS to handle PKCS #11 v3.0 r=ueno r=mt 11 months ago
nss-tool Bug 1654142 - Add CPU feature detection for Intel SHA extension. r=kjacobs 7 months ago
pkg Bug 1277852 - add config scripts for packaging, r=kaie 4 years ago
tests Bug 1686134 - Renew two chains libpkix test certificates. r=rrelyea 2 weeks ago
.arcconfig Bug 1522668 - Add .arcconfig, r=jcj 2 years ago
.clang-format Bug 1204998 - travis.yml with clang-format 3.8, mac and asan builds, r=mt,ekr 4 years ago
.gitignore Bug 1372127 - move .chk to root folder, r=ttaubert 3 years ago
.hgignore Bug 1372127 - move .chk to root folder, r=ttaubert 3 years ago
.hgtags Added tag NSS_3_61_BETA1 for changeset 68ae9b456b1b 2 weeks ago
.sancov-blacklist Bug 1281967 - Add "mach coverage ssl_gtests" using sancov r=franziskus 2 years ago
.taskcluster.yml Bug 1591275: Switch workers to use AWS Provder; r=kjacobs 1 year ago
COPYING Bug 845556, reorganize NSS directory layout, moving files, very large changeset! r=wtc 8 years ago
Makefile Revert 290526 2 months ago Bug 1678384 - Add a build flag to allow building nssckbi-testlib in m-c r=kjacobs 2 months ago
exports.gyp Bug 1479787 - build mozpkix as part of NSS, r=mt,keeler 2 years ago
help.txt Bug 1594933 - disable libnssdbm by default; keep build on CI, r=jcj 1 year ago
mach Bug 1604596 - Update Wycheproof vectors and add support for CBC, P256-ECDH, and CMAC tests r=franziskus 1 year ago Revert 290526 2 months ago
nss.gyp Bug 1678384 - Add a build flag to allow building nssckbi-testlib in m-c r=kjacobs 2 months ago Update readme 2 months ago
trademarks.txt Bug 845556, reorganize NSS directory layout, moving files, very large changeset! r=wtc 8 years ago

Network Security Services

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. NSS supports TLS 1.2, TLS 1.3, PKCS #5, PKCS#7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

About this fork

This particular fork of NSS caters specifically to inclusion of NSS in the build system of the Unified XUL Platform (UXP) and is patched to build as part of the Mozilla build system version in use in UXP. While this should work fine for inclusion in other environments, please be aware that it may have some issues performing builds in parallel jobserver mode (-j) if trying to build standalone or as part of a tree.

Aside from the build system changes there are no significant other changes made and the repo will fully mirror official NSS development otherwise.

Getting started

In order to get started, create a new directory that you will be using as your local work area, and check out NSS and NSPR. (Note that there’s no git mirror of NSPR and you require mercurial to get the latest NSPR source.)

git clone
hg clone

Building NSS

After changing into the NSS directory a typical build of 32-bit NSS is done as follows:

make nss_build_all

The following environment variables might be useful:

  • BUILD_OPT=1 to get an optimised build

  • USE_64=1 to get a 64-bit build (recommended)

The complete list of environment variables can be found here.

To clean the build directory run:

make nss_clean_all



Make sure that the address $HOST.$DOMSUF on your computer is available. This is necessary because NSS tests generate certificates and establish TLS connections, which requires a fully qualified domain name. You can test this by calling ping $HOST.$DOMSUF. If this is working, you’re all set. If it’s not, set or export:


Note that you might have to add nss.local to /etc/hosts if it’s not there. The entry should look something like nss.local nss.

Running tests

Runnning all tests will take a while!

cd tests

Make sure that all environment variables set for the build are set while running the tests as well. Test results are published in the folder ../../test_results/.

Individual tests can be run with the NSS_TESTS environment variable, e.g. NSS_TESTS=ssl_gtests ./ or by changing into the according directory and running the bash script there cd ssl_gtests && ./ The following tests are available:

cipher lowhash libpkix cert dbtests tools fips sdr crmf smime ssl ocsp merge pkits chains ec gtests ssl_gtests bogo policy

To make tests run faster it’s recommended to set NSS_CYCLES=standard to run only the standard cycle.


NSS releases can be found in the releases section of this repo. We do not provide pre-built binaries. Because NSS depends on the base library NSPR you should download the appropriate archive of NSPR alongside NSS. Releases will list the version of NSPR they need as a companion.


Directly contributing to this repo is not useful. If you wish to contribute to NSS development please get involved with the Mozilla NSS team, instead. The only exception would be any contributions needed for our particular integration into UXP that divert from upstream.

Bugzilla is used to track NSS development and bugs. File new bugs in the NSS product.

A list with good first bugs to start with are listed here.

NSS Folder Structure

The nss directory contains the following important subdirectories:

  • coreconf contains the build logic.

  • lib contains all library code that is used to create the runtime libraries.

  • cmd contains a set of various tool programs that are built with NSS. Several tools are general purpose and can be used to inspect and manipulate the storage files that software using the NSS library creates and modifies. Other tools are only used for testing purposes.

  • test and gtests contain the NSS test suite. While test contains shell scripts to drive test programs in cmd, gtests holds a set of gtests.

A more comprehensible overview of the NSS folder structure and API guidelines can be found here.

NSS supports build configurations for FIPS-140 compliance, and alternative build configurations that disable functionality specific to FIPS-140 compliance.

This section documents the environment variables and build parameters that control these configurations.

Build FIPS startup tests

The C macro NSS_NO_INIT_SUPPORT controls the FIPS startup self tests. If NSS_NO_INIT_SUPPORT is defined, the startup tests are disabled.

The legacy build system (make) by default disables these tests. To enable these tests, set environment variable NSS_FORCE_FIPS=1 at build time.

The gyp build system by default disables these tests. To enable these tests, pass parameter --enable-fips to

Building either FIPS compliant or alternative compliant code

The C macro NSS_FIPS_DISABLED can be used to disable some FIPS compliant code and enable alternative implementations.

The legacy build system (make) never defines NSS_FIPS_DISABLED and always uses the FIPS compliant code.

The gyp build system by default defines NSS_FIPS_DISABLED. To use the FIPS compliant code, pass parameter --enable-fips to

Test execution

The NSS test suite may contain tests that are included, excluded, or are different based on the FIPS build configuration. To execute the correct tests, it’s necessary to determine which build configuration was used.

The legacy build system (make) uses environment variables to control all aspects of the build configuration, including FIPS build configuration.

Because the gyp build system doesn’t use environment variables to control the build configuration, the NSS tests cannot rely on environment variables to determine the build configuration.

A helper binary named nss-build-flags is produced as part of the NSS build, which prints the C macro symbols that were defined at build time, and which are relevant to test execution.