The purpose is library is to make converting an existing product that uses OpenSSL to use the NSS crypto library instead and to cause as few changes to the code you are trying to port as possible. Some changes are inevitable, particularly when crypto outside of SSL is being used, but for a general-purpose SSL client or server the goal is that 80% of the code can remain untouched.
In order to shake out the pieces of the API we need I've successfully done basic ports of:
Each is lacking something, perhaps something important, but basic SSL support is done.
For the short term you will need to use an NSS database. This consists of 3 files: cert8.db, key3.db and secmod.db located in the same directory. In order for the target to find the right database you need to set the environment variable SSL_DIR to the location of your NSS database (unless you have a server cert installed in the default NSS database in /etc/pki/nssdb)
The code doesn't currently support file-based certificates. It uses the path of the certificate passed to SSL_CTX_use_certificate_file() and SSL_CTX_use_certificate_chain_file() as the nickname of the certificate in the NSS database. To list the certificates (and their nickname) in an NSS database you can use this:
% certutil -L -d /path/to/database
If you have a PKCS#12 file containing you can import it into your NSS database with:
% pk12util -i mycert.p12 -d /path/to/database
We currently lack nice, importable autoconf rules. You will need to tell your application where to find the NSPR and NSS include and libraries. You can use pkg-config to determine this. The package names are nss and nspr.
So far we are use HAVE_NSS and HAVE_OPENSSL to differentiate between NSS and openSSL.
You want to include "nss_compat_ossl.h". Be careful to not include any openSSL header files.
Some specific things to watch out for:
SSL_ConfigMPServerSIDCache(0, timeout, timeout, NULL);
Sample of porting an
It is available in the Fedora 8, 9 and rawhide repos
Or you can dowload the tarball: nss_compat_ossl-0.9.4.tar.gz
Work on a PKCS#11 module that can load file-based certificates on-the-fly is included in Fedora 8 in NSS 3.11.7-7 and higher. This module will let use more closely emulate OpenSSL with little-to-no changes on deployment.
It currently supports:
What it requires:
No. All applications must comply with the security policy document to claim FIPS conformance.
The main NSS FIPS site is http://wiki.mozilla.org/FIPS_Validation
The security policy page starts at http://wiki.mozilla.org/Section_C:_Cryptographic_Security_Policy
The policy document can be found at http://www.mozilla.org/projects/security/pki/nss/fips/secpolicy.pdf