OpenSSL to NSS Porting Library

The purpose is library is to make converting an existing product that uses OpenSSL to use the NSS crypto library instead and to cause as few changes to the code you are trying to port as possible. Some changes are inevitable, particularly when crypto outside of SSL is being used, but for a general-purpose SSL client or server the goal is that 80% of the code can remain untouched.

In order to shake out the pieces of the API we need I've successfully done basic ports of:

Each is lacking something, perhaps something important, but basic SSL support is done.

Currently Supports

Things to be done

How Do I Use the Library?

For the short term you will need to use an NSS database. This consists of 3 files: cert8.db, key3.db and secmod.db located in the same directory. In order for the target to find the right database you need to set the environment variable SSL_DIR to the location of your NSS database (unless you have a server cert installed in the default NSS database in /etc/pki/nssdb)

The code doesn't currently support file-based certificates. It uses the path of the certificate passed to SSL_CTX_use_certificate_file() and SSL_CTX_use_certificate_chain_file() as the nickname of the certificate in the NSS database. To list the certificates (and their nickname) in an NSS database you can use this:

% certutil -L -d /path/to/database

If you have a PKCS#12 file containing you can import it into your NSS database with:

% pk12util -i mycert.p12 -d /path/to/database

We currently lack nice, importable autoconf rules. You will need to tell your application where to find the NSPR and NSS include and libraries. You can use pkg-config to determine this. The package names are nss and nspr.

So far we are use HAVE_NSS and HAVE_OPENSSL to differentiate between NSS and openSSL.

You want to include "nss_compat_ossl.h". Be careful to not include any openSSL header files.

Some specific things to watch out for:

SSL_CTX_set_timeout(ctx, timeout);
SSL_ConfigMPServerSIDCache(0, timeout, timeout, NULL);

Sample of porting an application.

Where can I get it?

It is available in the Fedora 8, 9 and rawhide repos

Or you can dowload the tarball: nss_compat_ossl-0.9.4.tar.gz

Reading PEM files

Work on a PKCS#11 module that can load file-based certificates on-the-fly is included in Fedora 8 in NSS 3.11.7-7 and higher. This module will let use more closely emulate OpenSSL with little-to-no changes on deployment.

It currently supports:

What it requires:

Do I automatically inherit FIPS 140-2 Compliance by linking with NSS?

No. All applications must comply with the security policy document to claim FIPS conformance.

The main NSS FIPS site is

The security policy page starts at

The policy document can be found at