Subject: [PATCH] WIP Support libnss for as TLS backend v7

From: Andrew Dunstan <[email-masked]>
Date: Mon, 3 Aug 2020 12:32:10 -0400

---
 configure                                     |  211 ++++
 configure.ac                                  |   30 +
 contrib/Makefile                              |    2 +-
 .../postgres_fdw/expected/postgres_fdw.out    |    2 +-
 contrib/sslinfo/sslinfo.c                     |  164 ++-
 doc/src/sgml/sslinfo.sgml                     |   14 +-
 src/Makefile.global.in                        |   10 +
 src/backend/libpq/Makefile                    |    4 +
 src/backend/libpq/auth.c                      |    7 +
 src/backend/libpq/be-secure-nss.c             | 1032 +++++++++++++++++
 src/backend/libpq/be-secure-openssl.c         |   16 +-
 src/backend/libpq/be-secure.c                 |    3 +
 src/backend/utils/misc/guc.c                  |   20 +-
 src/include/common/pg_nss.h                   |  141 +++
 src/include/libpq/libpq-be.h                  |    9 +-
 src/include/libpq/libpq.h                     |    3 +
 src/include/pg_config.h.in                    |    3 +
 src/include/pg_config_manual.h                |    5 +-
 src/interfaces/libpq/Makefile                 |    4 +
 src/interfaces/libpq/fe-connect.c             |    4 +
 src/interfaces/libpq/fe-secure-nss.c          |  975 ++++++++++++++++
 src/interfaces/libpq/fe-secure.c              |    5 +-
 src/interfaces/libpq/libpq-fe.h               |   11 +
 src/interfaces/libpq/libpq-int.h              |    5 +
 src/test/Makefile                             |    2 +-
 src/test/ssl/Makefile                         |  172 +++
 .../cert9.db                                  |  Bin 0 -> 36864 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 src/test/ssl/ssl/nss/client-encrypted-pem.pfx |  Bin 0 -> 3149 bytes
 .../cert9.db                                  |  Bin 0 -> 28672 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 src/test/ssl/ssl/nss/client-revoked.pfx       |  Bin 0 -> 3149 bytes
 src/test/ssl/ssl/nss/client.crl               |  Bin 0 -> 418 bytes
 ...ient.crt__client-encrypted-pem.key.db.pass |    1 +
 .../cert9.db                                  |  Bin 0 -> 36864 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 .../nss/client.crt__client.key.db/cert9.db    |  Bin 0 -> 36864 bytes
 .../ssl/nss/client.crt__client.key.db/key4.db |  Bin 0 -> 45056 bytes
 .../nss/client.crt__client.key.db/pkcs11.txt  |    5 +
 src/test/ssl/ssl/nss/client.pfx               |  Bin 0 -> 3149 bytes
 .../ssl/ssl/nss/client_ca.crt.db/cert9.db     |  Bin 0 -> 28672 bytes
 src/test/ssl/ssl/nss/client_ca.crt.db/key4.db |  Bin 0 -> 36864 bytes
 .../ssl/ssl/nss/client_ca.crt.db/pkcs11.txt   |    5 +
 src/test/ssl/ssl/nss/root+client.crl          |  Bin 0 -> 393 bytes
 .../ssl/nss/root+client_ca.crt.db/cert9.db    |  Bin 0 -> 28672 bytes
 .../ssl/ssl/nss/root+client_ca.crt.db/key4.db |  Bin 0 -> 36864 bytes
 .../ssl/nss/root+client_ca.crt.db/pkcs11.txt  |    5 +
 .../ssl/nss/root+server_ca.crt.db/cert9.db    |  Bin 0 -> 28672 bytes
 .../ssl/ssl/nss/root+server_ca.crt.db/key4.db |  Bin 0 -> 36864 bytes
 .../ssl/nss/root+server_ca.crt.db/pkcs11.txt  |    5 +
 .../cert9.db                                  |  Bin 0 -> 28672 bytes
 .../key4.db                                   |  Bin 0 -> 36864 bytes
 .../pkcs11.txt                                |    5 +
 .../cert9.db                                  |  Bin 0 -> 28672 bytes
 .../root+server_ca.crt__server.crl.db/key4.db |  Bin 0 -> 36864 bytes
 .../pkcs11.txt                                |    5 +
 src/test/ssl/ssl/nss/root.crl                 |  Bin 0 -> 393 bytes
 .../cert9.db                                  |  Bin 0 -> 36864 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 .../ssl/ssl/nss/server-cn-and-alt-names.pfx   |  Bin 0 -> 3349 bytes
 .../cert9.db                                  |  Bin 0 -> 28672 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 .../cert9.db                                  |  Bin 0 -> 36864 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 src/test/ssl/ssl/nss/server-cn-only.pfx       |  Bin 0 -> 3197 bytes
 .../cert9.db                                  |  Bin 0 -> 36864 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 .../ssl/ssl/nss/server-multiple-alt-names.pfx |  Bin 0 -> 3325 bytes
 .../cert9.db                                  |  Bin 0 -> 36864 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 src/test/ssl/ssl/nss/server-no-names.pfx      |  Bin 0 -> 3109 bytes
 src/test/ssl/ssl/nss/server-password.pfx      |  Bin 0 -> 3197 bytes
 .../cert9.db                                  |  Bin 0 -> 36864 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 src/test/ssl/ssl/nss/server-revoked.pfx       |  Bin 0 -> 3181 bytes
 .../cert9.db                                  |  Bin 0 -> 36864 bytes
 .../key4.db                                   |  Bin 0 -> 45056 bytes
 .../pkcs11.txt                                |    5 +
 .../ssl/ssl/nss/server-single-alt-name.pfx    |  Bin 0 -> 3213 bytes
 src/test/ssl/ssl/nss/server.crl               |  Bin 0 -> 418 bytes
 .../ssl/ssl/nss/server_ca.crt.db/cert9.db     |  Bin 0 -> 28672 bytes
 src/test/ssl/ssl/nss/server_ca.crt.db/key4.db |  Bin 0 -> 36864 bytes
 .../ssl/ssl/nss/server_ca.crt.db/pkcs11.txt   |    5 +
 src/test/ssl/t/001_ssltests.pl                |  289 ++---
 src/test/ssl/t/002_scram.pl                   |    4 +-
 src/test/ssl/t/SSL/Backend/NSS.pm             |   64 +
 src/test/ssl/t/SSL/Backend/OpenSSL.pm         |  103 ++
 .../ssl/t/{SSLServer.pm => SSL/Server.pm}     |   80 +-
 src/tools/msvc/Install.pm                     |    3 +-
 src/tools/msvc/Mkvcbuild.pm                   |   29 +-
 src/tools/msvc/Solution.pm                    |   20 +
 src/tools/msvc/config_default.pl              |    1 +
 101 files changed, 3276 insertions(+), 257 deletions(-)
 create mode 100644 src/backend/libpq/be-secure-nss.c
 create mode 100644 src/include/common/pg_nss.h
 create mode 100644 src/interfaces/libpq/fe-secure-nss.c
 create mode 100644 src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/client-encrypted-pem.pfx
 create mode 100644 src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/client-revoked.pfx
 create mode 100644 src/test/ssl/ssl/nss/client.crl
 create mode 100644 src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db.pass
 create mode 100644 src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/client.crt__client.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/client.crt__client.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/client.crt__client.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/client.pfx
 create mode 100644 src/test/ssl/ssl/nss/client_ca.crt.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/client_ca.crt.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/client_ca.crt.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/root+client.crl
 create mode 100644 src/test/ssl/ssl/nss/root+client_ca.crt.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/root+client_ca.crt.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/root+client_ca.crt.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/root+server_ca.crt.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/root+server_ca.crt.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/root+server_ca.crt.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/root.crl
 create mode 100644 src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/server-cn-and-alt-names.pfx
 create mode 100644 src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/server-cn-only.pfx
 create mode 100644 src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/server-multiple-alt-names.pfx
 create mode 100644 src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/server-no-names.pfx
 create mode 100644 src/test/ssl/ssl/nss/server-password.pfx
 create mode 100644 src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/server-revoked.pfx
 create mode 100644 src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/pkcs11.txt
 create mode 100644 src/test/ssl/ssl/nss/server-single-alt-name.pfx
 create mode 100644 src/test/ssl/ssl/nss/server.crl
 create mode 100644 src/test/ssl/ssl/nss/server_ca.crt.db/cert9.db
 create mode 100644 src/test/ssl/ssl/nss/server_ca.crt.db/key4.db
 create mode 100644 src/test/ssl/ssl/nss/server_ca.crt.db/pkcs11.txt
 create mode 100644 src/test/ssl/t/SSL/Backend/NSS.pm
 create mode 100644 src/test/ssl/t/SSL/Backend/OpenSSL.pm
 rename src/test/ssl/t/{SSLServer.pm => SSL/Server.pm} (78%)

diff --git a/configure b/configure
index cb8fbe1051..8b7d98c2ab 100755
--- a/configure
+++ b/configure
@@ -711,6 +711,7 @@ with_uuid
 with_readline
 with_systemd
 with_selinux
+with_nss
 with_openssl
 with_ldap
 with_krb_srvnam
@@ -856,6 +857,7 @@ with_bsd_auth
 with_ldap
 with_bonjour
 with_openssl
+with_nss
 with_selinux
 with_systemd
 with_readline
@@ -1558,6 +1560,7 @@ Optional Packages:
   --with-ldap             build with LDAP support
   --with-bonjour          build with Bonjour support
   --with-openssl          build with OpenSSL support
+  --with-nss              build with NSS support
   --with-selinux          build with SELinux support
   --with-systemd          build with systemd support
   --without-readline      do not use GNU Readline nor BSD Libedit for editing
@@ -8100,6 +8103,41 @@ fi
 $as_echo "$with_openssl" >&6; }

+#
+# LibNSS
+#
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build with NSS support" >&5
+$as_echo_n "checking whether to build with NSS support... " >&6; }
+
+
+
+# Check whether --with-nss was given.
+if test "${with_nss+set}" = set; then :
+  withval=$with_nss;
+  case $withval in
+    yes)
+
+$as_echo "#define USE_NSS 1" >>confdefs.h
+
+      ;;
+    no)
+      :
+      ;;
+    *)
+      as_fn_error $? "no argument expected for --with-nss option" "$LINENO" 5
+      ;;
+  esac
+
+else
+  with_nss=no
+
+fi
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_nss" >&5
+$as_echo "$with_nss" >&6; }
+
+
 #
 # SELinux
 #
@@ -12174,6 +12212,9 @@ fi
 fi
 
 if test "$with_openssl" = yes ; then
+  if test x"$with_nss" = x"yes" ; then
+    as_fn_error $? "multiple SSL backends cannot be enabled simultaneously\"" "$LINENO" 5
+  fi
     # Minimum required OpenSSL version is 1.0.1
 
 $as_echo "#define OPENSSL_API_COMPAT 0x10001000L" >>confdefs.h
@@ -12436,6 +12477,157 @@ done
 
 fi
 
+if test "$with_nss" = yes ; then
+  if test x"$with_openssl" = x"yes" ; then
+    as_fn_error $? "multiple SSL backends cannot be enabled simultaneously\"" "$LINENO" 5
+  fi
+  CLEANLDFLAGS="$LDFLAGS"
+  # TODO: document this set of LDFLAGS
+  LDFLAGS="-lssl3 -lsmime3 -lnss3 -lplds4 -lplc4 -lnspr4 $LDFLAGS"
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL_VersionRangeSet in -lnss3" >&5
+$as_echo_n "checking for SSL_VersionRangeSet in -lnss3... " >&6; }
+if ${ac_cv_lib_nss3_SSL_VersionRangeSet+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lnss3  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char SSL_VersionRangeSet ();
+int
+main ()
+{
+return SSL_VersionRangeSet ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_nss3_SSL_VersionRangeSet=yes
+else
+  ac_cv_lib_nss3_SSL_VersionRangeSet=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_nss3_SSL_VersionRangeSet" >&5
+$as_echo "$ac_cv_lib_nss3_SSL_VersionRangeSet" >&6; }
+if test "x$ac_cv_lib_nss3_SSL_VersionRangeSet" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_LIBNSS3 1
+_ACEOF
+
+  LIBS="-lnss3 $LIBS"
+
+else
+  as_fn_error $? "library 'nss3' is required for NSS" "$LINENO" 5
+fi
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for PR_GetDefaultIOMethods in -lnspr4" >&5
+$as_echo_n "checking for PR_GetDefaultIOMethods in -lnspr4... " >&6; }
+if ${ac_cv_lib_nspr4_PR_GetDefaultIOMethods+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lnspr4  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char PR_GetDefaultIOMethods ();
+int
+main ()
+{
+return PR_GetDefaultIOMethods ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_nspr4_PR_GetDefaultIOMethods=yes
+else
+  ac_cv_lib_nspr4_PR_GetDefaultIOMethods=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_nspr4_PR_GetDefaultIOMethods" >&5
+$as_echo "$ac_cv_lib_nspr4_PR_GetDefaultIOMethods" >&6; }
+if test "x$ac_cv_lib_nspr4_PR_GetDefaultIOMethods" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_LIBNSPR4 1
+_ACEOF
+
+  LIBS="-lnspr4 $LIBS"
+
+else
+  as_fn_error $? "library 'nspr4' is required for NSS" "$LINENO" 5
+fi
+
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL_GetImplementedCiphers in -lssl3" >&5
+$as_echo_n "checking for SSL_GetImplementedCiphers in -lssl3... " >&6; }
+if ${ac_cv_lib_ssl3_SSL_GetImplementedCiphers+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lssl3  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char SSL_GetImplementedCiphers ();
+int
+main ()
+{
+return SSL_GetImplementedCiphers ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_ssl3_SSL_GetImplementedCiphers=yes
+else
+  ac_cv_lib_ssl3_SSL_GetImplementedCiphers=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ssl3_SSL_GetImplementedCiphers" >&5
+$as_echo "$ac_cv_lib_ssl3_SSL_GetImplementedCiphers" >&6; }
+if test "x$ac_cv_lib_ssl3_SSL_GetImplementedCiphers" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_LIBSSL3 1
+_ACEOF
+
+  LIBS="-lssl3 $LIBS"
+
+else
+  as_fn_error $? "library 'ssl3' is required for NSS" "$LINENO" 5
+fi
+
+  LDFLAGS="$CLEANLDFLAGS"
+fi
+
 if test "$with_pam" = yes ; then
   { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pam_start in -lpam" >&5
 $as_echo_n "checking for pam_start in -lpam... " >&6; }
@@ -13338,6 +13530,25 @@ else
 fi

+fi
+
+if test "$with_nss" = yes ; then
+  ac_fn_c_check_header_mongrel "$LINENO" "ssl.h" "ac_cv_header_ssl_h" "$ac_includes_default"
+if test "x$ac_cv_header_ssl_h" = xyes; then :
+
+else
+  as_fn_error $? "header file <ssl.h> is required for NSS" "$LINENO" 5
+fi
+
+
+  ac_fn_c_check_header_mongrel "$LINENO" "nss.h" "ac_cv_header_nss_h" "$ac_includes_default"
+if test "x$ac_cv_header_nss_h" = xyes; then :
+
+else
+  as_fn_error $? "header file <nss.h> is required for NSS" "$LINENO" 5
+fi
+
+
 fi
 
 if test "$with_pam" = yes ; then
diff --git a/configure.ac b/configure.ac
index eb2c731b58..23c07cabce 100644
--- a/configure.ac
+++ b/configure.ac
@@ -856,6 +856,15 @@ PGAC_ARG_BOOL(with, openssl, no, [build with OpenSSL support],
 AC_MSG_RESULT([$with_openssl])
 AC_SUBST(with_openssl)
 
+#
+# LibNSS
+#
+AC_MSG_CHECKING([whether to build with NSS support])
+PGAC_ARG_BOOL(with, nss, no, [build with NSS support],
+              [AC_DEFINE([USE_NSS], 1, [Define to build with NSS support. (--with-nss)])])
+AC_MSG_RESULT([$with_nss])
+AC_SUBST(with_nss)
+
 #
 # SELinux
 #
@@ -1205,6 +1214,9 @@ if test "$with_gssapi" = yes ; then
 fi
 
 if test "$with_openssl" = yes ; then
+  if test x"$with_nss" = x"yes" ; then
+    AC_MSG_ERROR([multiple SSL backends cannot be enabled simultaneously"])
+  fi
   dnl Order matters!
   # Minimum required OpenSSL version is 1.0.1
   AC_DEFINE(OPENSSL_API_COMPAT, [0x10001000L],
@@ -1230,6 +1242,19 @@ if test "$with_openssl" = yes ; then
   AC_CHECK_FUNCS([CRYPTO_lock])
 fi
 
+if test "$with_nss" = yes ; then
+  if test x"$with_openssl" = x"yes" ; then
+    AC_MSG_ERROR([multiple SSL backends cannot be enabled simultaneously"])
+  fi
+  CLEANLDFLAGS="$LDFLAGS"
+  # TODO: document this set of LDFLAGS
+  LDFLAGS="-lssl3 -lsmime3 -lnss3 -lplds4 -lplc4 -lnspr4 $LDFLAGS"
+  AC_CHECK_LIB(nss3, SSL_VersionRangeSet, [], [AC_MSG_ERROR([library 'nss3' is required for NSS])])
+  AC_CHECK_LIB(nspr4, PR_GetDefaultIOMethods, [], [AC_MSG_ERROR([library 'nspr4' is required for NSS])])
+  AC_CHECK_LIB(ssl3, SSL_GetImplementedCiphers, [], [AC_MSG_ERROR([library 'ssl3' is required for NSS])])
+  LDFLAGS="$CLEANLDFLAGS"
+fi
+
 if test "$with_pam" = yes ; then
   AC_CHECK_LIB(pam,    pam_start, [], [AC_MSG_ERROR([library 'pam' is required for PAM])])
 fi
@@ -1405,6 +1430,11 @@ if test "$with_openssl" = yes ; then
   AC_CHECK_HEADER(openssl/err.h, [], [AC_MSG_ERROR([header file <openssl/err.h> is required for OpenSSL])])
 fi
 
+if test "$with_nss" = yes ; then
+  AC_CHECK_HEADER(ssl.h, [], [AC_MSG_ERROR([header file <ssl.h> is required for NSS])])
+  AC_CHECK_HEADER(nss.h, [], [AC_MSG_ERROR([header file <nss.h> is required for NSS])])
+fi
+
 if test "$with_pam" = yes ; then
   AC_CHECK_HEADERS(security/pam_appl.h, [],
                    [AC_CHECK_HEADERS(pam/pam_appl.h, [],
diff --git a/contrib/Makefile b/contrib/Makefile
index 1846d415b6..cef7bf7f61 100644
--- a/contrib/Makefile
+++ b/contrib/Makefile
@@ -50,7 +50,7 @@ SUBDIRS = \
 		unaccent	\
 		vacuumlo
 
-ifeq ($(with_openssl),yes)
+ifeq ($(with_ssl),yes)
 SUBDIRS += sslinfo
 else
 ALWAYS_SUBDIRS += sslinfo
diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 90db550b92..961cb56358 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -8898,7 +8898,7 @@ DO $d$
     END;
 $d$;
 ERROR:  invalid option "password"
-HINT:  Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode, sslcompression, sslcert, sslkey, sslrootcert, sslcrl, requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size
+HINT:  Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode, sslcompression, sslcert, sslkey, sslrootcert, sslcrl, requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, cert_database, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size
 CONTEXT:  SQL statement "ALTER SERVER loopback_nopw OPTIONS (ADD password 'dummypw')"
 PL/pgSQL function inline_code_block line 3 at EXECUTE
 -- If we add a password for our user mapping instead, we should get a different
diff --git a/contrib/sslinfo/sslinfo.c b/contrib/sslinfo/sslinfo.c
index 5ba3988e27..84bb2c65b8 100644
--- a/contrib/sslinfo/sslinfo.c
+++ b/contrib/sslinfo/sslinfo.c
@@ -9,9 +9,11 @@
 
 #include "postgres.h"
 
+#ifdef USE_OPENSSL
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 #include <openssl/asn1.h>
+#endif
 
 #include "access/htup_details.h"
 #include "funcapi.h"
@@ -21,8 +23,8 @@
 
 PG_MODULE_MAGIC;
 
+#ifdef USE_OPENSSL
 static Datum X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
-static Datum X509_NAME_to_text(X509_NAME *name);
 static Datum ASN1_STRING_to_text(ASN1_STRING *str);
 
 /*
@@ -32,6 +34,7 @@ typedef struct
 {
 	TupleDesc	tupdesc;
 } SSLExtensionInfoContext;
+#endif
 
 /*
  * Indicates whether current session uses SSL
@@ -54,9 +57,16 @@ PG_FUNCTION_INFO_V1(ssl_version);
 Datum
 ssl_version(PG_FUNCTION_ARGS)
 {
-	if (MyProcPort->ssl == NULL)
+	const char *version;
+
+	if (!MyProcPort->ssl_in_use)
+		PG_RETURN_NULL();
+
+	version = be_tls_get_version(MyProcPort);
+	if (version == NULL)
 		PG_RETURN_NULL();
-	PG_RETURN_TEXT_P(cstring_to_text(SSL_get_version(MyProcPort->ssl)));
+
+	PG_RETURN_TEXT_P(cstring_to_text(version));
 }

@@ -67,9 +77,16 @@ PG_FUNCTION_INFO_V1(ssl_cipher);
 Datum
 ssl_cipher(PG_FUNCTION_ARGS)
 {
-	if (MyProcPort->ssl == NULL)
+	const char *cipher;
+
+	if (!MyProcPort->ssl_in_use)
 		PG_RETURN_NULL();
-	PG_RETURN_TEXT_P(cstring_to_text(SSL_get_cipher(MyProcPort->ssl)));
+
+	cipher = be_tls_get_cipher(MyProcPort);
+	if (cipher == NULL)
+		PG_RETURN_NULL();
+
+	PG_RETURN_TEXT_P(cstring_to_text(cipher));
 }

@@ -83,7 +100,7 @@ PG_FUNCTION_INFO_V1(ssl_client_cert_present);
 Datum
 ssl_client_cert_present(PG_FUNCTION_ARGS)
 {
-	PG_RETURN_BOOL(MyProcPort->peer != NULL);
+	PG_RETURN_BOOL(MyProcPort->peer_cert_valid);
 }

@@ -99,29 +116,26 @@ PG_FUNCTION_INFO_V1(ssl_client_serial);
 Datum
 ssl_client_serial(PG_FUNCTION_ARGS)
 {
+	char decimal[NAMEDATALEN];
 	Datum		result;
-	Port	   *port = MyProcPort;
-	X509	   *peer = port->peer;
-	ASN1_INTEGER *serial = NULL;
-	BIGNUM	   *b;
-	char	   *decimal;
 
-	if (!peer)
+	if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
+		PG_RETURN_NULL();
+
+	be_tls_get_peer_serial(MyProcPort, decimal, NAMEDATALEN);
+
+	if (!*decimal)
 		PG_RETURN_NULL();
-	serial = X509_get_serialNumber(peer);
-	b = ASN1_INTEGER_to_BN(serial, NULL);
-	decimal = BN_bn2dec(b);
 
-	BN_free(b);
 	result = DirectFunctionCall3(numeric_in,
 								 CStringGetDatum(decimal),
 								 ObjectIdGetDatum(0),
 								 Int32GetDatum(-1));
-	OPENSSL_free(decimal);
 	return result;
 }

+#ifdef USE_OPENSSL
 /*
  * Converts OpenSSL ASN1_STRING structure into text
  *
@@ -228,7 +242,7 @@ ssl_client_dn_field(PG_FUNCTION_ARGS)
 	text	   *fieldname = PG_GETARG_TEXT_PP(0);
 	Datum		result;
 
-	if (!(MyProcPort->peer))
+	if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
 		PG_RETURN_NULL();
 
 	result = X509_NAME_field_to_text(X509_get_subject_name(MyProcPort->peer), fieldname);
@@ -273,76 +287,23 @@ ssl_issuer_field(PG_FUNCTION_ARGS)
 	else
 		return result;
 }
+#endif							/* USE_OPENSSL */
 
-
-/*
- * Equivalent of X509_NAME_oneline that respects encoding
- *
- * This function converts X509_NAME structure to the text variable
- * converting all textual data into current database encoding.
- *
- * Parameter: X509_NAME *name X509_NAME structure to be converted
- *
- * Returns: text datum which contains string representation of
- * X509_NAME
- */
-static Datum
-X509_NAME_to_text(X509_NAME *name)
+#ifdef USE_NSS
+PG_FUNCTION_INFO_V1(ssl_client_dn_field);
+Datum
+ssl_client_dn_field(PG_FUNCTION_ARGS)
 {
-	BIO		   *membuf = BIO_new(BIO_s_mem());
-	int			i,
-				nid,
-				count = X509_NAME_entry_count(name);
-	X509_NAME_ENTRY *e;
-	ASN1_STRING *v;
-	const char *field_name;
-	size_t		size;
-	char		nullterm;
-	char	   *sp;
-	char	   *dp;
-	text	   *result;
-
-	if (membuf == NULL)
-		ereport(ERROR,
-				(errcode(ERRCODE_OUT_OF_MEMORY),
-				 errmsg("could not create OpenSSL BIO structure")));
-
-	(void) BIO_set_close(membuf, BIO_CLOSE);
-	for (i = 0; i < count; i++)
-	{
-		e = X509_NAME_get_entry(name, i);
-		nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(e));
-		if (nid == NID_undef)
-			ereport(ERROR,
-					(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
-					 errmsg("could not get NID for ASN1_OBJECT object")));
-		v = X509_NAME_ENTRY_get_data(e);
-		field_name = OBJ_nid2sn(nid);
-		if (field_name == NULL)
-			field_name = OBJ_nid2ln(nid);
-		if (field_name == NULL)
-			ereport(ERROR,
-					(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
-					 errmsg("could not convert NID %d to an ASN1_OBJECT structure", nid)));
-		BIO_printf(membuf, "/%s=", field_name);
-		ASN1_STRING_print_ex(membuf, v,
-							 ((ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB)
-							  | ASN1_STRFLGS_UTF8_CONVERT));
-	}
-
-	/* ensure null termination of the BIO's content */
-	nullterm = '\0';
-	BIO_write(membuf, &nullterm, 1);
-	size = BIO_get_mem_data(membuf, &sp);
-	dp = pg_any_to_server(sp, size - 1, PG_UTF8);
-	result = cstring_to_text(dp);
-	if (dp != sp)
-		pfree(dp);
-	if (BIO_free(membuf) != 1)
-		elog(ERROR, "could not free OpenSSL BIO structure");
+	PG_RETURN_NULL();
+}
 
-	PG_RETURN_TEXT_P(result);
+PG_FUNCTION_INFO_V1(ssl_issuer_field);
+Datum
+ssl_issuer_field(PG_FUNCTION_ARGS)
+{
+	PG_RETURN_NULL();
 }
+#endif							/* USE_NSS */

 /*
@@ -358,9 +319,17 @@ PG_FUNCTION_INFO_V1(ssl_client_dn);
 Datum
 ssl_client_dn(PG_FUNCTION_ARGS)
 {
-	if (!(MyProcPort->peer))
+	char		subject[NAMEDATALEN];
+
+	if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
+		PG_RETURN_NULL();
+
+	be_tls_get_peer_subject_name(MyProcPort, subject, NAMEDATALEN);
+
+	if (!*subject)
 		PG_RETURN_NULL();
-	return X509_NAME_to_text(X509_get_subject_name(MyProcPort->peer));
+
+	PG_RETURN_TEXT_P(cstring_to_text(subject));
 }

@@ -377,12 +346,21 @@ PG_FUNCTION_INFO_V1(ssl_issuer_dn);
 Datum
 ssl_issuer_dn(PG_FUNCTION_ARGS)
 {
-	if (!(MyProcPort->peer))
+	char		issuer[NAMEDATALEN];
+
+	if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
+		PG_RETURN_NULL();
+
+	be_tls_get_peer_issuer_name(MyProcPort, issuer, NAMEDATALEN);
+
+	if (!*issuer)
 		PG_RETURN_NULL();
-	return X509_NAME_to_text(X509_get_issuer_name(MyProcPort->peer));
+
+	PG_RETURN_TEXT_P(cstring_to_text(issuer));
 }

+#ifdef USE_OPENSSL
 /*
  * Returns information about available SSL extensions.
  *
@@ -516,3 +494,13 @@ ssl_extension_info(PG_FUNCTION_ARGS)
 	/* All done */
 	SRF_RETURN_DONE(funcctx);
 }
+#endif							/* USE_OPENSSL */
+
+#ifdef USE_NSS
+PG_FUNCTION_INFO_V1(ssl_extension_info);
+Datum
+ssl_extension_info(PG_FUNCTION_ARGS)
+{
+	PG_RETURN_NULL();
+}
+#endif							/* USE_NSS */
diff --git a/doc/src/sgml/sslinfo.sgml b/doc/src/sgml/sslinfo.sgml
index c237d4ba95..d15a206d2d 100644
--- a/doc/src/sgml/sslinfo.sgml
+++ b/doc/src/sgml/sslinfo.sgml
@@ -22,7 +22,8 @@
 
  <para>
   This extension won't build at all unless the installation was
-  configured with <literal>--with-openssl</literal>.
+  configured with SSL support, such as <literal>--with-openssl</literal>
+  or <literal>--with-nss</literal>.
  </para>
 
  <sect2>
@@ -54,7 +55,7 @@
     <listitem>
     <para>
      Returns the name of the protocol used for the SSL connection (e.g. TLSv1.0
-     TLSv1.1, or TLSv1.2).
+     TLSv1.1, TLSv1.2 or TLSv1.3).
     </para>
     </listitem>
    </varlistentry>
@@ -208,6 +209,9 @@ emailAddress
      the X.500 and X.509 standards, so you cannot just assign arbitrary
      meaning to them.
     </para>
+    <para>
+     This function is only available when using OpenSSL.
+    </para>
     </listitem>
    </varlistentry>
 
@@ -223,6 +227,9 @@ emailAddress
      Same as <function>ssl_client_dn_field</function>, but for the certificate issuer
      rather than the certificate subject.
     </para>
+    <para>
+     This function is only available when using OpenSSL.
+    </para>
     </listitem>
    </varlistentry>
 
@@ -238,6 +245,9 @@ emailAddress
      Provide information about extensions of client certificate: extension name,
      extension value, and if it is a critical extension.
     </para>
+    <para>
+     This function is only available when using OpenSSL.
+    </para>
     </listitem>
    </varlistentry>
   </variablelist>
diff --git a/src/Makefile.global.in b/src/Makefile.global.in
index 9a6265b3a0..2f25c51c6c 100644
--- a/src/Makefile.global.in
+++ b/src/Makefile.global.in
@@ -184,6 +184,7 @@ with_perl	= @with_perl@
 with_python	= @with_python@
 with_tcl	= @with_tcl@
 with_openssl	= @with_openssl@
+with_nss        = @with_nss@
 with_readline	= @with_readline@
 with_selinux	= @with_selinux@
 with_systemd	= @with_systemd@
@@ -232,6 +233,15 @@ CLANG = @CLANG@
 BITCODE_CFLAGS = @BITCODE_CFLAGS@
 BITCODE_CXXFLAGS = @BITCODE_CXXFLAGS@
 
+ifeq ($(with_openssl),yes)
+with_ssl = yes
+else ifeq ($(with_nss),yes)
+with_ssl = yes
+else
+with_ssl = no
+endif
+
+
 ##########################################################################
 #
 # Programs and flags
diff --git a/src/backend/libpq/Makefile b/src/backend/libpq/Makefile
index efc5ef760a..191266a426 100644
--- a/src/backend/libpq/Makefile
+++ b/src/backend/libpq/Makefile
@@ -30,6 +30,10 @@ OBJS = \
 
 ifeq ($(with_openssl),yes)
 OBJS += be-secure-openssl.o
+else
+ifeq ($(with_nss),yes)
+OBJS += be-secure-nss.o
+endif
 endif
 
 ifeq ($(with_gssapi),yes)
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 02b6c3f127..8f4197d002 100644
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -2870,7 +2870,14 @@ CheckCertAuth(Port *port)
 {
 	int			status_check_usermap = STATUS_ERROR;
 
+#if defined(USE_OPENSSL)
 	Assert(port->ssl);
+#elif defined(USE_NSS)
+	/* TODO: should we rename pr_fd to ssl, to keep consistency? */
+	Assert(port->pr_fd);
+#else
+	Assert(false);
+#endif
 
 	/* Make sure we have received a username in the certificate */
 	if (port->peer_cn == NULL ||
diff --git a/src/backend/libpq/be-secure-nss.c b/src/backend/libpq/be-secure-nss.c
new file mode 100644
index 0000000000..00ae054920
--- /dev/null
+++ b/src/backend/libpq/be-secure-nss.c
@@ -0,0 +1,1032 @@
+/*-------------------------------------------------------------------------
+ *
+ * be-secure-nss.c
+ *	  functions for supporting NSS as a TLS backend
+ *
+ *
+ * Portions Copyright (c) 1996-2020, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * IDENTIFICATION
+ *	  src/backend/libpq/be-secure-nss.c
+ *
+ *-------------------------------------------------------------------------
+ */
+
+#include "postgres.h"
+
+#include <sys/stat.h>
+
+/*
+ * BITS_PER_BYTE is also defined in the NSPR header fils, so we need to undef
+ * our version to avoid compiler warnings on redefinition.
+ */
+#define pg_BITS_PER_BYTE BITS_PER_BYTE
+#undef BITS_PER_BYTE
+
+/*
+ * The nspr/obsolete/protypes.h NSPR header typedefs uint64 and int64 with
+ * colliding definitions from ours, causing a much expected compiler error.
+ * The definitions are however not actually used in NSPR at all, and are only
+ * intended for what seems to be backwards compatibility for apps written
+ * against old versions of NSPR.  The following comment is in the referenced
+ * file, and was added in 1998:
+ *
+ *		This section typedefs the old 'native' types to the new PR<type>s.
+ *		These definitions are scheduled to be eliminated at the earliest
+ *		possible time. The NSPR API is implemented and documented using
+ *		the new definitions.
+ *
+ * As there is no opt-out from pulling in these typedefs, we define the guard
+ * for the file to exclude it. This is incredibly ugly, but seems to be about
+ * the only way around it.
+ */
+#define PROTYPES_H
+#include <nspr.h>
+#undef PROTYPES_H
+#include <nss.h>
+#include <prio.h>
+#include <ssl.h>
+#include <sslerr.h>
+#include <secerr.h>
+#include <sslproto.h>
+#include <prtypes.h>
+#include <pk11pub.h>
+#include <secitem.h>
+#include <secport.h>
+#include <secder.h>
+#include <certdb.h>
+#include <base64.h>
+#include <cert.h>
+#include <prerror.h>
+#include <keyhi.h>
+
+typedef struct
+{
+	enum
+	{
+		PW_NONE = 0,
+		PW_FROMFILE = 1,
+		PW_PLAINTEXT = 2,
+		PW_EXTERNAL = 3
+	} source;
+	char	   *data;
+}			secuPWData;
+
+/*
+ * Ensure that the colliding definitions match, else throw an error. In case
+ * NSPR has removed the definition for some reasone, make sure to put ours
+ * back again.
+ */
+#if defined(BITS_PER_BYTE)
+#if BITS_PER_BYTE != pg_BITS_PER_BYTE
+#error "incompatible byte widths between NSPR and postgres"
+#endif
+#else
+#define BITS_PER_BYTE pg_BITS_PER_BYTE
+#endif
+#undef pg_BITS_PER_BYTE
+
+#include "common/pg_nss.h"
+#include "lib/stringinfo.h"
+#include "libpq/libpq.h"
+#include "nodes/pg_list.h"
+#include "miscadmin.h"
+#include "storage/fd.h"
+#include "utils/guc.h"
+#include "utils/memutils.h"
+
+static PRDescIdentity pr_id;
+
+static PRIOMethods pr_iomethods;
+static NSSInitContext * nss_context = NULL;
+static SSLVersionRange desired_sslver;
+
+/*
+ * PR_ImportTCPSocket() is a private API, but very widely used, as it's the
+ * only way to make NSS use an already set up POSIX file descriptor rather
+ * than opening one itself. To quote the NSS documentation:
+ *
+ *		"In theory, code that uses PR_ImportTCPSocket may break when NSPR's
+ *		implementation changes. In practice, this is unlikely to happen because
+ *		NSPR's implementation has been stable for years and because of NSPR's
+ *		strong commitment to backward compatibility."
+ *
+ * https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/PR_ImportTCPSocket
+ *
+ * The function is declared in <private/pprio.h>, but as it is a header marked
+ * private we declare it here rather than including it.
+ */
+NSPR_API(PRFileDesc *) PR_ImportTCPSocket(int);
+
+/* NSS IO layer callback overrides */
+static PRInt32 pg_ssl_read(PRFileDesc * fd, void *buf, PRInt32 amount,
+						   PRIntn flags, PRIntervalTime timeout);
+static PRInt32 pg_ssl_write(PRFileDesc * fd, const void *buf, PRInt32 amount,
+							PRIntn flags, PRIntervalTime timeout);
+/* Utility functions */
+static PRFileDesc * init_iolayer(Port *port, int loglevel);
+static uint16 ssl_protocol_version_to_nss(int v, const char *guc_name);
+
+static char *pg_SSLerrmessage(PRErrorCode errcode);
+static char *ssl_protocol_version_to_string(int v);
+static SECStatus pg_cert_auth_handler(void *arg, PRFileDesc * fd,
+									  PRBool checksig, PRBool isServer);
+static SECStatus pg_bad_cert_handler(void *arg, PRFileDesc * fd);
+
+/* ------------------------------------------------------------ */
+/*						 Public interface						*/
+/* ------------------------------------------------------------ */
+
+static char *
+ssl_passphrase_callback(PK11SlotInfo * slot, PRBool retry, void *arg)
+{
+	return pstrdup("");
+}
+
+/*
+ * be_tls_init
+ *			Initialize the nss TLS library in the postmaster
+ *
+ * The majority of the setup needs to happen in be_tls_open_server since the
+ * NSPR initialization must happen after the forking of the backend. We could
+ * potentially move some parts in under !isServerStart, but so far this is the
+ * separation chosen.
+ */
+int
+be_tls_init(bool isServerStart)
+{
+	SECStatus	status;
+	SSLVersionRange supported_sslver;
+
+	/*
+	 * Set up the connection cache for multi-processing application behavior.
+	 * If we are in ServerStart then we initialize the cache. If the server is
+	 * already started, we inherit the cache such that it can be used for
+	 * connections. Calling SSL_ConfigMPServerSIDCache sets an environment
+	 * variable which contains enough information for the forked child to know
+	 * how to access it.  Passing NULL to SSL_InheritMPServerSIDCache will
+	 * make the forked child look it up by the default name SSL_INHERITANCE,
+	 * if env vars aren't inherited then the contents of the variable can be
+	 * passed instead.
+	 */
+	if (isServerStart)
+	{
+		/*
+		 * SSLv2 and SSLv3 are disabled in this TLS backend, but when setting
+		 * up the required session cache for NSS we still must supply timeout
+		 * values for v2 and The minimum allowed value for both is 5 seconds,
+		 * so opt for that in both cases (the defaults being 100 seconds and
+		 * 24 hours).
+		 *
+		 * Passing NULL as the directory for the session cache will default to
+		 * using /tmp on UNIX and \\temp on Windows.  Deciding if we want to
+		 * keep closer control on this directory is left as a TODO.
+		 */
+		status = SSL_ConfigMPServerSIDCache(MaxConnections, 5, 5, NULL);
+		if (status != SECSuccess)
+			ereport(FATAL,
+					(errmsg("unable to set up TLS connection cache: %s",
+							pg_SSLerrmessage(PR_GetError()))));
+
+	}
+	else
+	{
+		status = SSL_InheritMPServerSIDCache(NULL);
+		if (status != SECSuccess)
+		{
+			ereport(LOG,
+					(errmsg("unable to connect to TLS connection cache: %s",
+							pg_SSLerrmessage(PR_GetError()))));
+			return -1;
+		}
+	}
+
+	if (!ssl_database || strlen(ssl_database) == 0)
+	{
+		ereport(isServerStart ? FATAL : LOG,
+				(errmsg("no certificate database specified")));
+		goto error;
+	}
+
+	/*
+	 * We check for the desired TLS version range here, even though we cannot
+	 * set it until be_open_server such that we can be compatible with how the
+	 * OpenSSL backend reports errors for incompatible range configurations.
+	 * Set either the default supported TLS version range, or the configured
+	 * range from ssl_min_protocol_version and ssl_max_protocol version. In
+	 * case the user hasn't defined the maximum allowed version we fall back
+	 * to the highest version TLS that the library supports.
+	 */
+	if (SSL_VersionRangeGetSupported(ssl_variant_stream, &supported_sslver) != SECSuccess)
+	{
+		ereport(isServerStart ? FATAL : LOG,
+				(errmsg("unable to get default protocol support from NSS")));
+		goto error;
+	}
+
+	/*
+	 * Set the fallback versions for the TLS protocol version range to a
+	 * combination of our minimal requirement and the library maximum.
+	 */
+	desired_sslver.min = SSL_LIBRARY_VERSION_TLS_1_0;
+	desired_sslver.max = supported_sslver.max;
+
+	if (ssl_min_protocol_version)
+	{
+		int			ver = ssl_protocol_version_to_nss(ssl_min_protocol_version,
+													  "ssl_min_protocol_version");
+
+		if (ver == -1)
+		{
+			ereport(isServerStart ? FATAL : LOG,
+					(errmsg("\"%s\" setting \"%s\" not supported by this build",
+							"ssl_min_protocol_version",
+							GetConfigOption("ssl_min_protocol_version",
+											false, false))));
+			goto error;
+		}
+
+		if (ver > 0)
+			desired_sslver.min = ver;
+	}
+
+	if (ssl_max_protocol_version)
+	{
+		int			ver = ssl_protocol_version_to_nss(ssl_max_protocol_version,
+													  "ssl_max_protocol_version");
+
+		if (ver == -1)
+		{
+			ereport(isServerStart ? FATAL : LOG,
+					(errmsg("\"%s\" setting \"%s\" not supported by this build",
+							"ssl_max_protocol_version",
+							GetConfigOption("ssl_max_protocol_version",
+											false, false))));
+			goto error;
+		}
+		if (ver > 0)
+			desired_sslver.max = ver;
+
+		if (ver < desired_sslver.min)
+		{
+			ereport(isServerStart ? FATAL : LOG,
+					(errmsg("could not set SSL protocol version range"),
+					 errdetail("\"%s\" cannot be higher than \"%s\"",
+							   "ssl_min_protocol_version",
+							   "ssl_max_protocol_version")));
+			goto error;
+		}
+	}
+
+	return 0;
+error:
+	return -1;
+}
+
+int
+be_tls_open_server(Port *port)
+{
+	SECStatus	status;
+	PRFileDesc *model;
+	PRFileDesc *pr_fd;
+	PRFileDesc *layer;
+	CERTCertificate *server_cert;
+	SECKEYPrivateKey *private_key;
+	CERTSignedCrl *crl;
+	SECItem		crlname;
+	secuPWData	pwdata = {PW_NONE, 0};	/* TODO: This is a bogus callback */
+	char	   *cert_database;
+	NSSInitParameters params;
+
+	/*
+	 * The NSPR documentation states that runtime initialization via PR_Init
+	 * is no longer required, as the first caller into NSPR will perform the
+	 * initialization implicitly. The documentation doesn't however clarify
+	 * from which version this is holds true, so let's perform the potentially
+	 * superfluous initialization anyways to avoid crashing on older versions
+	 * of NSPR, as there is no difference in overhead.  The NSS documentation
+	 * still states that PR_Init must be called in some way (implicitly or
+	 * explicitly).
+	 *
+	 * The below parameters are what the implicit initialization would've done
+	 * for us, and should work even for older versions where it might not be
+	 * done automatically. The last parameter, maxPTDs, is set to various
+	 * values in other codebases, but has been unused since NSPR 2.1 which was
+	 * released sometime in 1998.
+	 */
+	PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0 /* maxPTDs */ );
+
+	/*
+	 * The certificate path (configdir) must contain a valid NSS database. If
+	 * the certificate path isn't a valid directory, NSS will fall back on the
+	 * system certificate database. If the certificate path is a directory but
+	 * is empty then the initialization will fail. On the client side this can
+	 * be allowed for any sslmode but the verify-xxx ones.
+	 * https://bugzilla.redhat.com/show_bug.cgi?id=728562 For the server side
+	 * we wont allow this to fail however, as we require the certificate and
+	 * key to exist.
+	 *
+	 * The original design of NSS was for a single application to use a single
+	 * copy of it, initialized with NSS_Initialize() which isn't returning any
+	 * handle with which to refer to NSS. NSS initialization and shutdown are
+	 * global for the application, so a shutdown in another NSS enabled
+	 * library would cause NSS to be stopped for libpq as well.  The fix has
+	 * been to introduce NSS_InitContext which returns a context handle to
+	 * pass to NSS_ShutdownContext.  NSS_InitContext was introduced in NSS
+	 * 3.12, but the use of it is not very well documented.
+	 * https://bugzilla.redhat.com/show_bug.cgi?id=738456
+	 *
+	 * The InitParameters struct passed can be used to override internal
+	 * values in NSS, but the usage is not documented at all. When using
+	 * NSS_Init initializations, the values are instead set via PK11_Configure
+	 * calls so the PK11_Configure documentation can be used to glean some
+	 * details on these.
+	 *
+	 * https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/PKCS11/Module_Specs
+	 */
+	memset(&params, '\0', sizeof(params));
+	params.length = sizeof(params);
+
+	if (!ssl_database || strlen(ssl_database) == 0)
+		ereport(FATAL,
+				(errmsg("no certificate database specified")));
+
+	cert_database = psprintf("sql:%s", ssl_database);
+	nss_context = NSS_InitContext(cert_database, "", "", "",
+								  &params,
+								  NSS_INIT_READONLY | NSS_INIT_PK11RELOAD);
+	pfree(cert_database);
+
+	if (!nss_context)
+		ereport(FATAL,
+				(errmsg("unable to read certificate database \"%s\": %s",
+						ssl_database, pg_SSLerrmessage(PR_GetError()))));
+
+	/*
+	 * Set the passphrase callback which will be used both to obtain the
+	 * passphrase from the user, as well as by NSS to obtain the phrase
+	 * repeatedly.
+	 *
+	 * TODO: Figure this out - do note that we are setting another password
+	 * callback below for cert/key as well. Need to make sense of all these.
+	 */
+	PK11_SetPasswordFunc(ssl_passphrase_callback);
+
+	/*
+	 * Import the already opened socket as we don't want to use NSPR functions
+	 * for opening the network socket due to how the PostgreSQL protocol works
+	 * with TLS connections. This function is not part of the NSPR public API,
+	 * see the comment at the top of the file for the rationale of still using
+	 * it.
+	 */
+	pr_fd = PR_ImportTCPSocket(port->sock);
+	if (!pr_fd)
+		ereport(ERROR,
+				(errmsg("unable to connect to socket")));
+
+	/*
+	 * Most of the documentation available, and implementations of, NSS/NSPR
+	 * use the PR_NewTCPSocket() function here, which has the drawback that it
+	 * can only create IPv4 sockets. Instead use PR_OpenTCPSocket() which
+	 * copes with IPv6 as well.
+	 */
+	model = PR_OpenTCPSocket(port->laddr.addr.ss_family);
+	if (!model)
+		ereport(ERROR,
+				(errmsg("unable to open socket")));
+
+	/*
+	 * Convert the NSPR socket to an SSL socket. Ensuring the success of this
+	 * operation is critical as NSS SSL_* functions may return SECSuccess on
+	 * the socket even though SSL hasn't been enabled, which introduce a risk
+	 * of silent downgrades.
+	 */
+	model = SSL_ImportFD(NULL, model);
+	if (!model)
+		ereport(ERROR,
+				(errmsg("unable to enable TLS on socket")));
+
+	/*
+	 * Configure basic settings for the connection over the SSL socket in
+	 * order to set it up as a server.
+	 */
+	if (SSL_OptionSet(model, SSL_SECURITY, PR_TRUE) != SECSuccess)
+		ereport(ERROR,
+				(errmsg("unable to configure TLS connection")));
+
+	if (SSL_OptionSet(model, SSL_HANDSHAKE_AS_SERVER, PR_TRUE) != SECSuccess ||
+		SSL_OptionSet(model, SSL_HANDSHAKE_AS_CLIENT, PR_FALSE) != SECSuccess)
+		ereport(ERROR,
+				(errmsg("unable to configure TLS connection as server")));
+
+	/*
+	 * SSLv2 is disabled by default, and SSLv3 will be excluded from the range
+	 * of allowed protocols further down. Since we really don't want these to
+	 * ever be enabled, let's use belts and suspenders and explicitly turn
+	 * them off as well.
+	 */
+	SSL_OptionSet(model, SSL_ENABLE_SSL2, PR_FALSE);
+	SSL_OptionSet(model, SSL_ENABLE_SSL3, PR_FALSE);
+
+#ifdef SSL_CBC_RANDOM_IV
+
+	/*
+	 * Enable protection against the BEAST attack in case the NSS server has
+	 * support for that. While SSLv3 is disabled, we may still allow TLSv1
+	 * which is affected. The option isn't documented as an SSL option, but as
+	 * an NSS environment variable.
+	 */
+	SSL_OptionSet(model, SSL_CBC_RANDOM_IV, PR_TRUE);
+#endif
+
+	/*
+	 * Configure the allowed cipher. If there are no user preferred suites,
+	 * set the domestic policy. TODO: while this code works, the set of
+	 * ciphers which can be set and still end up with a working socket is
+	 * woefully underdocumented for anything more recent than SSLv3 (the code
+	 * for TLS actually calls ssl3 functions under the hood for
+	 * SSL_CipherPrefSet), so it's unclear if this is helpful or not. Using
+	 * the policies works, but may be too coarsely grained.
+	 *
+	 * Another TODO: The SSL_ImplementedCiphers table returned with calling
+	 * SSL_GetImplementedCiphers is sorted in server preference order. Sorting
+	 * SSLCipherSuites according to the order of the ciphers therein could be
+	 * a way to implement ssl_prefer_server_ciphers - if we at all want to use
+	 * cipher selection for NSS like how we do it for OpenSSL that is.
+	 */
+
+	/*
+	 * If no ciphers are specified, we use the domestic policy
+	 */
+	if (!SSLCipherSuites || strlen(SSLCipherSuites) == 0)
+	{
+		status = NSS_SetDomesticPolicy();
+		if (status != SECSuccess)
+			ereport(ERROR,
+					(errmsg("unable to set cipher policy: %s",
+							pg_SSLerrmessage(PR_GetError()))));
+	}
+	else
+	{
+		char	   *ciphers,
+				   *c;
+
+		char	   *sep = ":;, ";
+		PRUint16	ciphercode;
+		const		PRUint16 *nss_ciphers;
+
+		/*
+		 * If the user has specified a set of preferred cipher suites we start
+		 * by turning off all the existing suites to avoid the risk of down-
+		 * grades to a weaker cipher than expected.
+		 */
+		nss_ciphers = SSL_GetImplementedCiphers();
+		for (int i = 0; i < SSL_GetNumImplementedCiphers(); i++)
+			SSL_CipherPrefSet(model, nss_ciphers[i], PR_FALSE);
+
+		ciphers = pstrdup(SSLCipherSuites);
+
+		for (c = strtok(ciphers, sep); c; c = strtok(NULL, sep))
+		{
+			ciphercode = pg_find_cipher(c);
+			if (ciphercode != INVALID_CIPHER)
+			{
+				status = SSL_CipherPrefSet(model, ciphercode, PR_TRUE);
+				if (status != SECSuccess)
+					ereport(ERROR,
+							(errmsg("invalid cipher-suite specified: %s", c)));
+			}
+		}
+
+		pfree(ciphers);
+	}
+
+	if (SSL_VersionRangeSet(model, &desired_sslver) != SECSuccess)
+		ereport(ERROR,
+				(errmsg("unable to set requested SSL protocol version range")));
+
+	/*
+	 * Set up the custom IO layer.
+	 */
+	layer = init_iolayer(port, ERROR);
+	if (!layer)
+		goto error;
+
+	/* Store the Port as private data available in callbacks */
+	layer->secret = (void *) port;
+
+	if (PR_PushIOLayer(pr_fd, PR_TOP_IO_LAYER, layer) != PR_SUCCESS)
+	{
+		PR_Close(layer);
+		ereport(ERROR,
+				(errmsg("unable to push IO layer")));
+	}
+
+	/* TODO: set the postgres password callback param as callback function */
+	server_cert = PK11_FindCertFromNickname(ssl_cert_file, &pwdata /* password callback */ );
+	if (!server_cert)
+		ereport(ERROR,
+				(errmsg("unable to find certificate for \"%s\": %s",
+						ssl_cert_file, pg_SSLerrmessage(PR_GetError()))));
+
+	/* TODO: set the postgres password callback param as callback function */
+	private_key = PK11_FindKeyByAnyCert(server_cert, &pwdata /* password callback */ );
+	if (!private_key)
+		ereport(ERROR,
+				(errmsg("unable to find private key for \"%s\": %s",
+						ssl_cert_file, pg_SSLerrmessage(PR_GetError()))));
+
+	/*
+	 * NSS doesn't use CRL files on disk, so we use the ssl_crl_file guc to
+	 * contain the CRL nickname for the current server certificate in the NSS
+	 * certificate database. The main difference from the OpenSSL backend is
+	 * that NSS will use the CRL regardless, but being able to make sure the
+	 * CRL is loaded seems like a good feature.
+	 */
+	if (ssl_crl_file[0])
+	{
+		SECITEM_CopyItem(NULL, &crlname, &server_cert->derSubject);
+		crl = SEC_FindCrlByName(CERT_GetDefaultCertDB(), &crlname, SEC_CRL_TYPE);
+		if (!crl)
+			ereport(ERROR,
+					(errmsg("specified CRL not found in database")));
+		SEC_DestroyCrl(crl);
+	}
+
+	/*
+	 * Finally we must configure the socket for being a server by setting the
+	 * certificate and key.
+	 */
+	status = SSL_ConfigSecureServer(model, server_cert, private_key, kt_rsa);
+	if (status != SECSuccess)
+		ereport(ERROR,
+				(errmsg("unable to configure secure server: %s",
+						pg_SSLerrmessage(PR_GetError()))));
+	status = SSL_ConfigServerCert(model, server_cert, private_key, NULL, 0);
+	if (status != SECSuccess)
+		ereport(ERROR,
+				(errmsg("unable to configure server for TLS server connections: %s",
+						pg_SSLerrmessage(PR_GetError()))));
+
+	ssl_loaded_verify_locations = true;
+
+	/*
+	 * At this point, we no longer have use for the certificate and private
+	 * key as they have been copied into the context by NSS. Destroy our
+	 * copies explicitly to clean out the memory as best we can.
+	 */
+	CERT_DestroyCertificate(server_cert);
+	SECKEY_DestroyPrivateKey(private_key);
+
+	status = SSL_AuthCertificateHook(model, pg_cert_auth_handler, (void *) port);
+	if (status != SECSuccess)
+		ereport(ERROR,
+				(errmsg("unable to install authcert hook: %s",
+						pg_SSLerrmessage(PR_GetError()))));
+	SSL_BadCertHook(model, pg_bad_cert_handler, (void *) port);
+	SSL_OptionSet(model, SSL_REQUEST_CERTIFICATE, PR_TRUE);
+	SSL_OptionSet(model, SSL_REQUIRE_CERTIFICATE, PR_FALSE);
+
+	port->pr_fd = SSL_ImportFD(model, pr_fd);
+	if (!port->pr_fd)
+		ereport(ERROR,
+				(errmsg("unable to initialize")));
+
+	PR_Close(model);
+
+	/*
+	 * Force a handshake on the next I/O request, the second parameter means
+	 * that we are a server, PR_FALSE would indicate being a client. NSPR
+	 * requires us to call SSL_ResetHandshake since we imported an already
+	 * established socket.
+	 */
+	status = SSL_ResetHandshake(port->pr_fd, PR_TRUE);
+	if (status != SECSuccess)
+		ereport(ERROR,
+				(errmsg("unable to initiate handshake: %s",
+						pg_SSLerrmessage(PR_GetError()))));
+	status = SSL_ForceHandshake(port->pr_fd);
+	if (status != SECSuccess)
+		ereport(ERROR,
+				(errmsg("unable to handshake: %s",
+						pg_SSLerrmessage(PR_GetError()))));
+
+	port->ssl_in_use = true;
+	return 0;
+
+error:
+	return 1;
+}
+
+ssize_t
+be_tls_read(Port *port, void *ptr, size_t len, int *waitfor)
+{
+	ssize_t		n_read;
+	PRErrorCode err;
+
+	n_read = PR_Read(port->pr_fd, ptr, len);
+
+	if (n_read < 0)
+	{
+		err = PR_GetError();
+
+		/* XXX: This logic seems potentially bogus? */
+		if (err == PR_WOULD_BLOCK_ERROR)
+			*waitfor = WL_SOCKET_READABLE;
+		else
+			*waitfor = WL_SOCKET_WRITEABLE;
+	}
+
+	return n_read;
+}
+
+ssize_t
+be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
+{
+	ssize_t		n_write;
+	PRErrorCode err;
+
+	n_write = PR_Send(port->pr_fd, ptr, len, 0, PR_INTERVAL_NO_WAIT);
+
+	if (n_write < 0)
+	{
+		err = PR_GetError();
+
+		if (err == PR_WOULD_BLOCK_ERROR)
+			*waitfor = WL_SOCKET_WRITEABLE;
+		else
+			*waitfor = WL_SOCKET_READABLE;
+	}
+
+	return n_write;
+}
+
+void
+be_tls_close(Port *port)
+{
+	if (!port)
+		return;
+
+	if (port->peer_cn)
+	{
+		SSL_InvalidateSession(port->pr_fd);
+		pfree(port->peer_cn);
+		port->peer_cn = NULL;
+	}
+
+	PR_Close(port->pr_fd);
+	port->pr_fd = NULL;
+	port->ssl_in_use = false;
+
+	if (nss_context)
+	{
+		NSS_ShutdownContext(nss_context);
+		nss_context = NULL;
+	}
+}
+
+void
+be_tls_destroy(void)
+{
+	/*
+	 * It reads a bit odd to clear a session cache when we are destroying the
+	 * context altogether, but if the session cache isn't cleared before
+	 * shutting down the context it will fail with SEC_ERROR_BUSY.
+	 */
+	SSL_ClearSessionCache();
+}
+
+int
+be_tls_get_cipher_bits(Port *port)
+{
+	SECStatus	status;
+	SSLChannelInfo channel;
+	SSLCipherSuiteInfo suite;
+
+	status = SSL_GetChannelInfo(port->pr_fd, &channel, sizeof(channel));
+	if (status != SECSuccess)
+		goto error;
+
+	status = SSL_GetCipherSuiteInfo(channel.cipherSuite, &suite, sizeof(suite));
+	if (status != SECSuccess)
+		goto error;
+
+	return suite.effectiveKeyBits;
+
+error:
+	ereport(WARNING,
+			(errmsg("unable to extract TLS session information: %s",
+					pg_SSLerrmessage(PR_GetError()))));
+	return 0;
+}
+
+/*
+ * be_tls_get_compression
+ *
+ * NSS disabled support for TLS compression in version 3.33 and removed the
+ * code in a subsequent release. The API for retrieving information about
+ * compression as well as enabling it is kept for backwards compatibility, but
+ * we don't need to consult it since it was only available for SSLv3 which we
+ * don't support.
+ *
+ * https://bugzilla.mozilla.org/show_bug.cgi?id=1409587
+ */
+bool
+be_tls_get_compression(Port *port)
+{
+	return false;
+}
+
+const char *
+be_tls_get_version(Port *port)
+{
+	SECStatus	status;
+	SSLChannelInfo channel;
+
+	status = SSL_GetChannelInfo(port->pr_fd, &channel, sizeof(channel));
+	if (status != SECSuccess)
+	{
+		ereport(WARNING,
+				(errmsg("unable to extract TLS session information: %s",
+						pg_SSLerrmessage(PR_GetError()))));
+		return NULL;
+	}
+
+	return ssl_protocol_version_to_string(channel.protocolVersion);
+}
+
+const char *
+be_tls_get_cipher(Port *port)
+{
+	SECStatus	status;
+	SSLChannelInfo channel;
+	SSLCipherSuiteInfo suite;
+
+	status = SSL_GetChannelInfo(port->pr_fd, &channel, sizeof(channel));
+	if (status != SECSuccess)
+		goto error;
+
+	status = SSL_GetCipherSuiteInfo(channel.cipherSuite, &suite, sizeof(suite));
+	if (status != SECSuccess)
+		goto error;
+
+	return suite.cipherSuiteName;
+
+error:
+	ereport(WARNING,
+			(errmsg("unable to extract TLS session information: %s",
+					pg_SSLerrmessage(PR_GetError()))));
+	return NULL;
+}
+
+void
+be_tls_get_peer_subject_name(Port *port, char *ptr, size_t len)
+{
+	CERTCertificate *certificate;
+
+	certificate = SSL_PeerCertificate(port->pr_fd);
+	if (certificate)
+		strlcpy(ptr, CERT_NameToAscii(&certificate->subject), len);
+	else
+		ptr[0] = '\0';
+}
+
+void
+be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len)
+{
+	CERTCertificate *certificate;
+
+	certificate = SSL_PeerCertificate(port->pr_fd);
+	if (certificate)
+		strlcpy(ptr, CERT_NameToAscii(&certificate->issuer), len);
+	else
+		ptr[0] = '\0';
+}
+
+void
+be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
+{
+	CERTCertificate *certificate;
+
+	certificate = SSL_PeerCertificate(port->pr_fd);
+	if (certificate)
+		snprintf(ptr, len, "%li", DER_GetInteger(&(certificate->serialNumber)));
+	else
+		ptr[0] = '\0';
+}
+
+static SECStatus
+pg_bad_cert_handler(void *arg, PRFileDesc * fd)
+{
+	Port	   *port = (Port *) arg;
+
+	port->peer_cert_valid = false;
+	return SECFailure;
+}
+
+static SECStatus
+pg_cert_auth_handler(void *arg, PRFileDesc * fd, PRBool checksig, PRBool isServer)
+{
+	SECStatus	status;
+	Port	   *port = (Port *) arg;
+	CERTCertificate *cert;
+	char	   *peer_cn;
+	int			len;
+
+	status = SSL_AuthCertificate(CERT_GetDefaultCertDB(), port->pr_fd, checksig, PR_TRUE);
+	if (status == SECSuccess)
+	{
+		cert = SSL_PeerCertificate(port->pr_fd);
+		len = strlen(cert->subjectName);
+		peer_cn = MemoryContextAllocZero(TopMemoryContext, len + 1);
+		if (strncmp(cert->subjectName, "CN=", 3) == 0)
+			strlcpy(peer_cn, cert->subjectName + strlen("CN="), len + 1);
+		else
+			strlcpy(peer_cn, cert->subjectName, len + 1);
+		CERT_DestroyCertificate(cert);
+
+		port->peer_cn = peer_cn;
+		port->peer_cert_valid = true;
+	}
+
+	return status;
+}
+
+/* ------------------------------------------------------------ */
+/*						Internal functions						*/
+/* ------------------------------------------------------------ */
+
+static PRInt32
+pg_ssl_read(PRFileDesc * fd, void *buf, PRInt32 amount, PRIntn flags,
+			PRIntervalTime timeout)
+{
+	PRRecvFN	read_fn;
+	PRInt32		n_read;
+
+	read_fn = fd->lower->methods->recv;
+	n_read = read_fn(fd->lower, buf, amount, flags, timeout);
+
+	return n_read;
+}
+
+static PRInt32
+pg_ssl_write(PRFileDesc * fd, const void *buf, PRInt32 amount, PRIntn flags,
+			 PRIntervalTime timeout)
+{
+	PRSendFN	send_fn;
+	PRInt32		n_write;
+
+	send_fn = fd->lower->methods->send;
+	n_write = send_fn(fd->lower, buf, amount, flags, timeout);
+
+	return n_write;
+}
+
+static PRFileDesc *
+init_iolayer(Port *port, int loglevel)
+{
+	const		PRIOMethods *default_methods;
+	PRFileDesc *layer;
+
+	/*
+	 * Start by initializing our layer with all the default methods so that we
+	 * can selectively override the ones we want while still ensuring that we
+	 * have a complete layer specification.
+	 */
+	default_methods = PR_GetDefaultIOMethods();
+	memcpy(&pr_iomethods, default_methods, sizeof(PRIOMethods));
+
+	pr_iomethods.recv = pg_ssl_read;
+	pr_iomethods.send = pg_ssl_write;
+
+	/*
+	 * Each IO layer must be identified by a unique name, where uniqueness is
+	 * per connection. Each connection in a postgres cluster can generate the
+	 * identity from the same string as they will create their IO layers on
+	 * different sockets. Only one layer per socket can have the same name.
+	 */
+	pr_id = PR_GetUniqueIdentity("PostgreSQL");
+	if (pr_id == PR_INVALID_IO_LAYER)
+	{
+		ereport(loglevel,
+				(errmsg("out of memory when setting up TLS connection")));
+		return NULL;
+	}
+
+	/*
+	 * Create the actual IO layer as a stub such that it can be pushed onto
+	 * the layer stack. The step via a stub is required as we define custom
+	 * callbacks.
+	 */
+	layer = PR_CreateIOLayerStub(pr_id, &pr_iomethods);
+	if (!layer)
+	{
+		ereport(loglevel,
+				(errmsg("unable to create NSS I/O layer")));
+		return NULL;
+	}
+
+	return layer;
+}
+
+static char *
+ssl_protocol_version_to_string(int v)
+{
+	switch (v)
+	{
+			/* SSL v2 and v3 are not supported */
+		case SSL_LIBRARY_VERSION_2:
+		case SSL_LIBRARY_VERSION_3_0:
+			Assert(false);
+			break;
+
+		case SSL_LIBRARY_VERSION_TLS_1_0:
+			return pstrdup("TLSv1.0");
+		case SSL_LIBRARY_VERSION_TLS_1_1:
+			return pstrdup("TLSv1.1");
+		case SSL_LIBRARY_VERSION_TLS_1_2:
+			return pstrdup("TLSv1.2");
+		case SSL_LIBRARY_VERSION_TLS_1_3:
+			return pstrdup("TLSv1.3");
+	}
+
+	return pstrdup("unknown");
+}
+
+
+/*
+ * ssl_protocol_version_to_nss
+ *			Translate PostgreSQL TLS version to NSS version
+ *
+ * Returns zero in case the requested TLS version is undefined (PG_ANY) and
+ * should be set by the caller, or -1 on failure.
+ */
+static uint16
+ssl_protocol_version_to_nss(int v, const char *guc_name)
+{
+	switch (v)
+	{
+			/*
+			 * There is no SSL_LIBRARY_ macro defined in NSS with the value
+			 * zero, so we use this to signal the caller that the highest
+			 * useful version should be set on the connection.
+			 */
+		case PG_TLS_ANY:
+			return 0;
+
+			/*
+			 * No guard is required here as there are no versions of NSS
+			 * without support for TLS1.
+			 */
+		case PG_TLS1_VERSION:
+			return SSL_LIBRARY_VERSION_TLS_1_0;
+		case PG_TLS1_1_VERSION:
+#ifdef SSL_LIBRARY_VERSION_TLS_1_1
+			return SSL_LIBRARY_VERSION_TLS_1_1;
+#else
+			break;
+#endif
+		case PG_TLS1_2_VERSION:
+#ifdef SSL_LIBRARY_VERSION_TLS_1_2
+			return SSL_LIBRARY_VERSION_TLS_1_2;
+#else
+			break;
+#endif
+		case PG_TLS1_3_VERSION:
+#ifdef SSL_LIBRARY_VERSION_TLS_1_3
+			return SSL_LIBRARY_VERSION_TLS_1_3;
+#else
+			break;
+#endif
+		default:
+			break;
+	}
+
+	return -1;
+}
+
+/*
+ * pg_SSLerrmessage
+ *		Create and return a human readable error message given
+ *		the specified error code
+ *
+ * PR_ErrorToName only converts the enum identifier of the error to string,
+ * but that can be quite useful for debugging (and in case PR_ErrorToString is
+ * unable to render a message then we at least have something).
+ */
+static char *
+pg_SSLerrmessage(PRErrorCode errcode)
+{
+	char		error[128];
+	int			ret;
+
+	/* TODO: this should perhaps use a StringInfo instead.. */
+	ret = pg_snprintf(error, sizeof(error), "%s (%s)",
+					  PR_ErrorToString(errcode, PR_LANGUAGE_I_DEFAULT),
+					  PR_ErrorToName(errcode));
+	if (ret)
+		return pstrdup(error);
+
+	return pstrdup(_("unknown TLS error"));
+}
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 8b21ff4065..5962cffc0c 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -1298,15 +1298,28 @@ X509_NAME_to_cstring(X509_NAME *name)
 	char	   *dp;
 	char	   *result;
 
+	if (membuf == NULL)
+		ereport(ERROR,
+				(errcode(ERRCODE_OUT_OF_MEMORY),
+				 errmsg("failed to create BIO")));
+
 	(void) BIO_set_close(membuf, BIO_CLOSE);
 	for (i = 0; i < count; i++)
 	{
 		e = X509_NAME_get_entry(name, i);
 		nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(e));
+		if (nid == NID_undef)
+			ereport(ERROR,
+					(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
+					 errmsg("could not get NID for ASN1_OBJECT object")));
 		v = X509_NAME_ENTRY_get_data(e);
 		field_name = OBJ_nid2sn(nid);
 		if (!field_name)
 			field_name = OBJ_nid2ln(nid);
+		if (field_name == NULL)
+			ereport(ERROR,
+					(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
+					 errmsg("could not convert NID %d to an ASN1_OBJECT structure", nid)));
 		BIO_printf(membuf, "/%s=", field_name);
 		ASN1_STRING_print_ex(membuf, v,
 							 ((ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB)
@@ -1322,7 +1335,8 @@ X509_NAME_to_cstring(X509_NAME *name)
 	result = pstrdup(dp);
 	if (dp != sp)
 		pfree(dp);
-	BIO_free(membuf);
+	if (BIO_free(membuf) != 1)
+		elog(ERROR, "could not free OpenSSL BIO structure");
 
 	return result;
 }
diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index 2ae507a902..f39977b80c 100644
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -49,6 +49,9 @@ bool		ssl_passphrase_command_supports_reload;
 #ifdef USE_SSL
 bool		ssl_loaded_verify_locations = false;
 #endif
+#ifdef USE_NSS
+char	   *ssl_database;
+#endif
 
 /* GUC variable controlling SSL cipher list */
 char	   *SSLCipherSuites = NULL;
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index de87ad6ef7..33c3eebf48 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -4262,7 +4262,11 @@ static struct config_string ConfigureNamesString[] =
 		},
 		&ssl_library,
 #ifdef USE_SSL
+#if defined(USE_OPENSSL)
 		"OpenSSL",
+#elif defined(USE_NSS)
+		"NSS",
+#endif
 #else
 		"",
 #endif
@@ -4320,6 +4324,18 @@ static struct config_string ConfigureNamesString[] =
 		check_canonical_path, assign_pgstat_temp_directory, NULL
 	},
 
+#ifdef USE_NSS
+	{
+		{"ssl_database", PGC_SIGHUP, CONN_AUTH_SSL,
+			gettext_noop("Location of the NSS certificate database."),
+			NULL
+		},
+		&ssl_database,
+		"",
+		NULL, NULL, NULL
+	},
+#endif
+
 	{
 		{"synchronous_standby_names", PGC_SIGHUP, REPLICATION_PRIMARY,
 			gettext_noop("Number of synchronous standbys and list of names of potential synchronous ones."),
@@ -4348,8 +4364,10 @@ static struct config_string ConfigureNamesString[] =
 			GUC_SUPERUSER_ONLY
 		},
 		&SSLCipherSuites,
-#ifdef USE_OPENSSL
+#if defined(USE_OPENSSL)
 		"HIGH:MEDIUM:+3DES:!aNULL",
+#elif defined (USE_NSS)
+		"",
 #else
 		"none",
 #endif
diff --git a/src/include/common/pg_nss.h b/src/include/common/pg_nss.h
new file mode 100644
index 0000000000..74298c8bb1
--- /dev/null
+++ b/src/include/common/pg_nss.h
@@ -0,0 +1,141 @@
+/*-------------------------------------------------------------------------
+ *
+ * pg_nss.h
+ *	  Support for NSS as a TLS backend
+ *
+ * These definitions are used by both frontend and backend code.
+ *
+ * Copyright (c) 2020, PostgreSQL Global Development Group
+ *
+ * IDENTIFICATION
+ *        src/include/common/pg_nss.h
+ *
+ *-------------------------------------------------------------------------
+ */
+#ifndef PG_NSS_H
+#define PG_NSS_H
+
+#ifdef USE_NSS
+
+#include <sslproto.h>
+
+PRUint16	pg_find_cipher(char *name);
+
+typedef struct
+{
+	const char *name;
+	PRUint16	number;
+}			NSSCiphers;
+
+#define INVALID_CIPHER	0xFFFF
+
+/*
+ * This list is a partial copy of the ciphers in NSS files lib/ssl/sslproto.h
+ * in order to provide a human readable version of the ciphers. It would be
+ * nice to not have to have this, but NSS doesn't provide any API addressing
+ * the ciphers by name. TODO: do we want more of the ciphers, or perhaps less?
+ */
+static const NSSCiphers NSS_CipherList[] = {
+
+	{"TLS_NULL_WITH_NULL_NULL", TLS_NULL_WITH_NULL_NULL},
+
+	{"TLS_RSA_WITH_NULL_MD5", TLS_RSA_WITH_NULL_MD5},
+	{"TLS_RSA_WITH_NULL_SHA", TLS_RSA_WITH_NULL_SHA},
+	{"TLS_RSA_WITH_RC4_128_MD5", TLS_RSA_WITH_RC4_128_MD5},
+	{"TLS_RSA_WITH_RC4_128_SHA", TLS_RSA_WITH_RC4_128_SHA},
+	{"TLS_RSA_WITH_IDEA_CBC_SHA", TLS_RSA_WITH_IDEA_CBC_SHA},
+	{"TLS_RSA_WITH_DES_CBC_SHA", TLS_RSA_WITH_DES_CBC_SHA},
+	{"TLS_RSA_WITH_3DES_EDE_CBC_SHA", TLS_RSA_WITH_3DES_EDE_CBC_SHA},
+
+	{"TLS_DH_DSS_WITH_DES_CBC_SHA", TLS_DH_DSS_WITH_DES_CBC_SHA},
+	{"TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA", TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA},
+	{"TLS_DH_RSA_WITH_DES_CBC_SHA", TLS_DH_RSA_WITH_DES_CBC_SHA},
+	{"TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA", TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA},
+
+	{"TLS_DHE_DSS_WITH_DES_CBC_SHA", TLS_DHE_DSS_WITH_DES_CBC_SHA},
+	{"TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA},
+	{"TLS_DHE_RSA_WITH_DES_CBC_SHA", TLS_DHE_RSA_WITH_DES_CBC_SHA},
+	{"TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA", TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA},
+
+	{"TLS_DH_anon_WITH_RC4_128_MD5", TLS_DH_anon_WITH_RC4_128_MD5},
+	{"TLS_DH_anon_WITH_DES_CBC_SHA", TLS_DH_anon_WITH_DES_CBC_SHA},
+	{"TLS_DH_anon_WITH_3DES_EDE_CBC_SHA", TLS_DH_anon_WITH_3DES_EDE_CBC_SHA},
+
+	{"TLS_RSA_WITH_AES_128_CBC_SHA", TLS_RSA_WITH_AES_128_CBC_SHA},
+	{"TLS_DH_DSS_WITH_AES_128_CBC_SHA", TLS_DH_DSS_WITH_AES_128_CBC_SHA},
+	{"TLS_DH_RSA_WITH_AES_128_CBC_SHA", TLS_DH_RSA_WITH_AES_128_CBC_SHA},
+	{"TLS_DHE_DSS_WITH_AES_128_CBC_SHA", TLS_DHE_DSS_WITH_AES_128_CBC_SHA},
+	{"TLS_DHE_RSA_WITH_AES_128_CBC_SHA", TLS_DHE_RSA_WITH_AES_128_CBC_SHA},
+	{"TLS_DH_anon_WITH_AES_128_CBC_SHA", TLS_DH_anon_WITH_AES_128_CBC_SHA},
+
+	{"TLS_RSA_WITH_AES_256_CBC_SHA", TLS_RSA_WITH_AES_256_CBC_SHA},
+	{"TLS_DH_DSS_WITH_AES_256_CBC_SHA", TLS_DH_DSS_WITH_AES_256_CBC_SHA},
+	{"TLS_DH_RSA_WITH_AES_256_CBC_SHA", TLS_DH_RSA_WITH_AES_256_CBC_SHA},
+	{"TLS_DHE_DSS_WITH_AES_256_CBC_SHA", TLS_DHE_DSS_WITH_AES_256_CBC_SHA},
+	{"TLS_DHE_RSA_WITH_AES_256_CBC_SHA", TLS_DHE_RSA_WITH_AES_256_CBC_SHA},
+	{"TLS_DH_anon_WITH_AES_256_CBC_SHA", TLS_DH_anon_WITH_AES_256_CBC_SHA},
+	{"TLS_RSA_WITH_NULL_SHA256", TLS_RSA_WITH_NULL_SHA256},
+	{"TLS_RSA_WITH_AES_128_CBC_SHA256", TLS_RSA_WITH_AES_128_CBC_SHA256},
+	{"TLS_RSA_WITH_AES_256_CBC_SHA256", TLS_RSA_WITH_AES_256_CBC_SHA256},
+
+	{"TLS_DHE_DSS_WITH_AES_128_CBC_SHA256", TLS_DHE_DSS_WITH_AES_128_CBC_SHA256},
+	{"TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", TLS_RSA_WITH_CAMELLIA_128_CBC_SHA},
+	{"TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA", TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA},
+	{"TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA", TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA},
+	{"TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA", TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA},
+	{"TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA},
+	{"TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA", TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA},
+
+	{"TLS_DHE_DSS_WITH_RC4_128_SHA", TLS_DHE_DSS_WITH_RC4_128_SHA},
+	{"TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", TLS_DHE_RSA_WITH_AES_128_CBC_SHA256},
+	{"TLS_DHE_DSS_WITH_AES_256_CBC_SHA256", TLS_DHE_DSS_WITH_AES_256_CBC_SHA256},
+	{"TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", TLS_DHE_RSA_WITH_AES_256_CBC_SHA256},
+
+	{"TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", TLS_RSA_WITH_CAMELLIA_256_CBC_SHA},
+	{"TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA", TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA},
+	{"TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA", TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA},
+	{"TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA", TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA},
+	{"TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA},
+	{"TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA", TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA},
+
+	{"TLS_RSA_WITH_SEED_CBC_SHA", TLS_RSA_WITH_SEED_CBC_SHA},
+
+	{"TLS_RSA_WITH_AES_128_GCM_SHA256", TLS_RSA_WITH_AES_128_GCM_SHA256},
+	{"TLS_RSA_WITH_AES_256_GCM_SHA384", TLS_RSA_WITH_AES_256_GCM_SHA384},
+	{"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
+	{"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", TLS_DHE_RSA_WITH_AES_256_GCM_SHA384},
+	{"TLS_DHE_DSS_WITH_AES_128_GCM_SHA256", TLS_DHE_DSS_WITH_AES_128_GCM_SHA256},
+	{"TLS_DHE_DSS_WITH_AES_256_GCM_SHA384", TLS_DHE_DSS_WITH_AES_256_GCM_SHA384},
+
+	{"TLS_AES_128_GCM_SHA256", TLS_AES_128_GCM_SHA256},
+	{"TLS_AES_256_GCM_SHA384", TLS_AES_256_GCM_SHA384},
+	{"TLS_CHACHA20_POLY1305_SHA256", TLS_CHACHA20_POLY1305_SHA256},
+	{NULL, 0}
+};
+
+/*
+ * pg_find_cipher
+ *			Translate an NSS ciphername to the cipher code
+ *
+ * Searches the configured ciphers for the corresponding cipher code to the
+ * name. Search is performed case insensitive.
+ */
+PRUint16
+pg_find_cipher(char *name)
+{
+	const		NSSCiphers *cipher_list = NSS_CipherList;
+
+	while (cipher_list->name)
+	{
+		if (pg_strcasecmp(cipher_list->name, name) == 0)
+			return cipher_list->number;
+
+		cipher_list++;
+	}
+
+	return 0xFFFF;
+}
+
+#endif							/* USE_NSS */
+
+#endif							/* PG_NSS_H */
diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h
index 179ebaa104..6211510fab 100644
--- a/src/include/libpq/libpq-be.h
+++ b/src/include/libpq/libpq-be.h
@@ -192,13 +192,18 @@ typedef struct Port
 	bool		peer_cert_valid;
 
 	/*
-	 * OpenSSL structures. (Keep these last so that the locations of other
-	 * fields are the same whether or not you build with OpenSSL.)
+	 * SSL backend specific structures. (Keep these last so that the locations
+	 * of other fields are the same whether or not you build with SSL
+	 * enabled.)
 	 */
 #ifdef USE_OPENSSL
 	SSL		   *ssl;
 	X509	   *peer;
 #endif
+
+#ifdef USE_NSS
+	void	   *pr_fd;
+#endif
 } Port;
 
 #ifdef USE_SSL
diff --git a/src/include/libpq/libpq.h b/src/include/libpq/libpq.h
index b1152475ac..298d87ecae 100644
--- a/src/include/libpq/libpq.h
+++ b/src/include/libpq/libpq.h
@@ -88,6 +88,9 @@ extern PGDLLIMPORT bool ssl_passphrase_command_supports_reload;
 #ifdef USE_SSL
 extern bool ssl_loaded_verify_locations;
 #endif
+#ifdef USE_NSS
+extern char *ssl_database;
+#endif
 
 extern int	secure_initialize(bool isServerStart);
 extern bool secure_loaded_verify_locations(void);
diff --git a/src/include/pg_config.h.in b/src/include/pg_config.h.in
index fb270df678..31f808398c 100644
--- a/src/include/pg_config.h.in
+++ b/src/include/pg_config.h.in
@@ -893,6 +893,9 @@
 /* Define to 1 to build with PAM support. (--with-pam) */
 #undef USE_PAM
 
+/* Define to build with NSS support (--with-nss) */
+#undef USE_NSS
+
 /* Define to 1 to use software CRC-32C implementation (slicing-by-8). */
 #undef USE_SLICING_BY_8_CRC32C
 
diff --git a/src/include/pg_config_manual.h b/src/include/pg_config_manual.h
index 705dc69c06..c28b84126d 100644
--- a/src/include/pg_config_manual.h
+++ b/src/include/pg_config_manual.h
@@ -176,10 +176,9 @@
 
 /*
  * USE_SSL code should be compiled only when compiling with an SSL
- * implementation.  (Currently, only OpenSSL is supported, but we might add
- * more implementations in the future.)
+ * implementation.
  */
-#ifdef USE_OPENSSL
+#if defined(USE_OPENSSL) || defined(USE_NSS)
 #define USE_SSL
 #endif
 
diff --git a/src/interfaces/libpq/Makefile b/src/interfaces/libpq/Makefile
index d4919970f8..97821fb39b 100644
--- a/src/interfaces/libpq/Makefile
+++ b/src/interfaces/libpq/Makefile
@@ -57,6 +57,10 @@ OBJS += \
 	fe-secure-gssapi.o
 endif
 
+ifeq ($(with_nss), yes)
+OBJS += fe-secure-nss.o
+endif
+
 ifeq ($(PORTNAME), cygwin)
 override shlib = cyg$(NAME)$(DLSUFFIX)
 endif
diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c
index 7bee9dd201..2814eb8ddd 100644
--- a/src/interfaces/libpq/fe-connect.c
+++ b/src/interfaces/libpq/fe-connect.c
@@ -354,6 +354,10 @@ static const internalPQconninfoOption PQconninfoOptions[] = {
 		"Target-Session-Attrs", "", 11, /* sizeof("read-write") = 11 */
 	offsetof(struct pg_conn, target_session_attrs)},
 
+	{"cert_database", NULL, NULL, NULL,
+		"CertificateDatabase", "", 64,
+	offsetof(struct pg_conn, cert_database)},
+
 	/* Terminating entry --- MUST BE LAST */
 	{NULL, NULL, NULL, NULL,
 	NULL, NULL, 0}
diff --git a/src/interfaces/libpq/fe-secure-nss.c b/src/interfaces/libpq/fe-secure-nss.c
new file mode 100644
index 0000000000..6401949136
--- /dev/null
+++ b/src/interfaces/libpq/fe-secure-nss.c
@@ -0,0 +1,975 @@
+/*-------------------------------------------------------------------------
+ *
+ * fe-secure-nss.c
+ *	  functions for supporting NSS as a TLS backend for frontend libpq
+ *
+ * Portions Copyright (c) 1996-2020, PostgreSQL Global Development Group
+ * Portions Copyright (c) 1994, Regents of the University of California
+ *
+ * IDENTIFICATION
+ *	  src/interfaces/libpq/fe-secure-nss.c
+ *
+ *-------------------------------------------------------------------------
+ */
+
+#include "postgres_fe.h"
+
+#include "libpq-fe.h"
+#include "fe-auth.h"
+#include "libpq-int.h"
+
+/*
+ * BITS_PER_BYTE is also defined in the NSPR header fils, so we need to undef
+ * our version to avoid compiler warnings on redefinition.
+ */
+#define pg_BITS_PER_BYTE BITS_PER_BYTE
+#undef BITS_PER_BYTE
+
+/*
+ * The nspr/obsolete/protypes.h NSPR header typedefs uint64 and int64 with
+ * colliding definitions from ours, causing a much expected compiler error.
+ * The definitions are however not actually used in NSPR at all, and are only
+ * intended for what seems to be backwards compatibility for apps written
+ * against old versions of NSPR.  The following comment is in the referenced
+ * file, and was added in 1998:
+ *
+ *		This section typedefs the old 'native' types to the new PR<type>s.
+ *		These definitions are scheduled to be eliminated at the earliest
+ *		possible time. The NSPR API is implemented and documented using
+ *		the new definitions.
+ *
+ * As there is no opt-out from pulling in these typedefs, we define the guard
+ * for the file to exclude it. This is incredibly ugly, but seems to be about
+ * the only way around it.
+ */
+#define PROTYPES_H
+#include <nspr.h>
+#undef PROTYPES_H
+#include <nss.h>
+#include <ssl.h>
+#include <sslproto.h>
+#include <pk11func.h>
+#include <prerror.h>
+#include <prinit.h>
+#include <prio.h>
+#include <secerr.h>
+#include <secmod.h>
+
+/*
+ * Ensure that the colliding definitions match, else throw an error. In case
+ * NSPR remove the definition in a future version (however unlikely that may
+ * be, make sure to put ours back again.
+ */
+#if defined(BITS_PER_BYTE)
+#if BITS_PER_BYTE != pg_BITS_PER_BYTE
+#error "incompatible byte widths between NSPR and PostgreSQL"
+#endif
+#else
+#define BITS_PER_BYTE pg_BITS_PER_BYTE
+#endif
+#undef pg_BITS_PER_BYTE
+
+static SECStatus pg_load_nss_module(SECMODModule * *module, const char *library, const char *name);
+static SECStatus pg_bad_cert_handler(void *arg, PRFileDesc * fd);
+static char *pg_SSLerrmessage(PRErrorCode errcode);
+static SECStatus pg_client_auth_handler(void *arg, PRFileDesc * socket, CERTDistNames * caNames,
+										CERTCertificate * *pRetCert, SECKEYPrivateKey * *pRetKey);
+static SECStatus pg_cert_auth_handler(void *arg, PRFileDesc * fd, PRBool checksig, PRBool isServer);
+static int	ssl_protocol_version_to_nss(const char *protocol);
+static bool cert_database_has_CA(PGconn *conn);
+
+static char *PQssl_passwd_cb(PK11SlotInfo * slot, PRBool retry, void *arg);
+
+/*
+ * PR_ImportTCPSocket() is a private API, but very widely used, as it's the
+ * only way to make NSS use an already set up POSIX file descriptor rather
+ * than opening one itself. To quote the NSS documentation:
+ *
+ *		"In theory, code that uses PR_ImportTCPSocket may break when NSPR's
+ *		implementation changes. In practice, this is unlikely to happen because
+ *		NSPR's implementation has been stable for years and because of NSPR's
+ *		strong commitment to backward compatibility."
+ *
+ * https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR/Reference/PR_ImportTCPSocket
+ *
+ * The function is declared in <private/pprio.h>, but as it is a header marked
+ * private we declare it here rather than including it.
+ */
+NSPR_API(PRFileDesc *) PR_ImportTCPSocket(int);
+
+static SECMODModule * ca_trust = NULL;
+static NSSInitContext * nss_context = NULL;
+
+/*
+ * Track whether the NSS database has a password set or not. There is no API
+ * function for retrieving password status, so we simply flip this to true in
+ * case NSS invoked the password callback - as that will only happen in case
+ * there is a password. The reason for tracking this is that there are calls
+ * which require a password parameter, but doesn't use the callbacks provided,
+ * so we must call the callback on behalf of these.
+ */
+static bool has_password = false;
+
+#if defined(WIN32)
+static const char *ca_trust_name = "nssckbi.dll";
+#elif defined(__darwin__)
+static const char *ca_trust_name = "libnssckbi.dylib";
+#else
+static const char *ca_trust_name = "libnssckbi.so";
+#endif
+
+static PQsslKeyPassHook_nss_type PQsslKeyPassHook = NULL;
+
+/* ------------------------------------------------------------ */
+/*			 Procedures common to all secure sessions			*/
+/* ------------------------------------------------------------ */
+
+void
+pgtls_init_library(bool do_ssl, int do_crypto)
+{
+	/* TODO: implement me .. */
+}
+
+int
+pgtls_init(PGconn *conn)
+{
+	conn->ssl_in_use = false;
+
+	return 0;
+}
+
+void
+pgtls_close(PGconn *conn)
+{
+	if (nss_context)
+	{
+		NSS_ShutdownContext(nss_context);
+		nss_context = NULL;
+	}
+}
+
+PostgresPollingStatusType
+pgtls_open_client(PGconn *conn)
+{
+	SECStatus	status;
+	PRFileDesc *pr_fd;
+	PRFileDesc *model;
+	NSSInitParameters params;
+	SSLVersionRange desired_range;
+
+	/*
+	 * The NSPR documentation states that runtime initialization via PR_Init
+	 * is no longer required, as the first caller into NSPR will perform the
+	 * initialization implicitly. The documentation doesn't however clarify
+	 * from which version this is holds true, so let's perform the potentially
+	 * superfluous initialization anyways to avoid crashing on older versions
+	 * of NSPR, as there is no difference in overhead.  The NSS documentation
+	 * still states that PR_Init must be called in some way (implicitly or
+	 * explicitly).
+	 *
+	 * The below parameters are what the implicit initialization would've done
+	 * for us, and should work even for older versions where it might not be
+	 * done automatically. The last parameter, maxPTDs, is set to various
+	 * values in other codebases, but has been unused since NSPR 2.1 which was
+	 * released sometime in 1998.
+	 */
+	PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
+
+	/*
+	 * The original design of NSS was for a single application to use a single
+	 * copy of it, initialized with NSS_Initialize() which isn't returning any
+	 * handle with which to refer to NSS. NSS initialization and shutdown are
+	 * global for the application, so a shutdown in another NSS enabled
+	 * library would cause NSS to be stopped for libpq as well.  The fix has
+	 * been to introduce NSS_InitContext which returns a context handle to
+	 * pass to NSS_ShutdownContext.  NSS_InitContext was introduced in NSS
+	 * 3.12, but the use of it is not very well documented.
+	 * https://bugzilla.redhat.com/show_bug.cgi?id=738456
+	 *
+	 * The InitParameters struct passed can be used to override internal
+	 * values in NSS, but the usage is not documented at all. When using
+	 * NSS_Init initializations, the values are instead set via PK11_Configure
+	 * calls so the PK11_Configure documentation can be used to glean some
+	 * details on these.
+	 *
+	 * https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/PKCS11/Module_Specs
+	 */
+	memset(&params, 0, sizeof(params));
+	params.length = sizeof(params);
+
+	if (conn->cert_database && strlen(conn->cert_database) > 0)
+	{
+		char	   *cert_database_path = psprintf("sql:%s", conn->cert_database);
+
+		nss_context = NSS_InitContext(cert_database_path, "", "", "",
+									  &params,
+									  NSS_INIT_READONLY | NSS_INIT_PK11RELOAD);
+		pfree(cert_database_path);
+	}
+	else
+		nss_context = NSS_InitContext("", "", "", "", &params,
+									  NSS_INIT_READONLY | NSS_INIT_NOCERTDB |
+									  NSS_INIT_NOMODDB | NSS_INIT_FORCEOPEN |
+									  NSS_INIT_NOROOTINIT | NSS_INIT_PK11RELOAD);
+
+	if (!nss_context)
+	{
+		char	   *err = pg_SSLerrmessage(PR_GetError());
+
+		printfPQExpBuffer(&conn->errorMessage,
+						  libpq_gettext("unable to %s certificate database: %s"),
+						  conn->cert_database ? "open" : "create",
+						  err);
+		free(err);
+		return PGRES_POLLING_FAILED;
+	}
+
+	/*
+	 * Configure cipher policy.
+	 */
+	status = NSS_SetDomesticPolicy();
+	if (status != SECSuccess)
+	{
+		char	   *err = pg_SSLerrmessage(PR_GetError());
+
+		printfPQExpBuffer(&conn->errorMessage,
+						  libpq_gettext("unable to configure cipher policy: %s"),
+						  err);
+		free(err);
+		return PGRES_POLLING_FAILED;
+	}
+
+	/*
+	 * If we don't have a certificate database, the system trust store is the
+	 * fallback we can use. If we fail to initialize that as well, we can
+	 * still attempt a connection as long as the sslmode isn't verify*.
+	 */
+	if (!conn->cert_database && conn->sslmode[0] == 'v')
+	{
+		status = pg_load_nss_module(&ca_trust, ca_trust_name, "\"Root Certificates\"");
+		/* status = pg_load_nss_module(&ca_trust, ca_trust_name, "trust"); */
+		if (status != SECSuccess)
+		{
+			char	   *err = pg_SSLerrmessage(PR_GetError());
+
+			printfPQExpBuffer(&conn->errorMessage,
+							  libpq_gettext("WARNING: unable to load NSS trust module \"%s\" : %s"), ca_trust_name, err);
+			return PGRES_POLLING_FAILED;
+		}
+	}
+
+
+	PK11_SetPasswordFunc(PQssl_passwd_cb);
+
+	/*
+	 * Import the already opened socket as we don't want to use NSPR functions
+	 * for opening the network socket due to how the PostgreSQL protocol works
+	 * with TLS connections. This function is not part of the NSPR public API,
+	 * see the comment at the top of the file for the rationale of still using
+	 * it.
+	 */
+	pr_fd = PR_ImportTCPSocket(conn->sock);
+	if (!pr_fd)
+	{
+		printfPQExpBuffer(&conn->errorMessage,
+						  libpq_gettext("unable to attach to socket: %s"),
+						  pg_SSLerrmessage(PR_GetError()));
+		return PGRES_POLLING_FAILED;
+	}
+
+	/*
+	 * Most of the documentation available, and implementations of, NSS/NSPR
+	 * use the PR_NewTCPSocket() function here, which has the drawback that it
+	 * can only create IPv4 sockets. Instead use PR_OpenTCPSocket() which
+	 * copes with IPv6 as well.
+	 */
+	model = SSL_ImportFD(NULL, PR_OpenTCPSocket(conn->laddr.addr.ss_family));
+	if (!model)
+	{
+		printfPQExpBuffer(&conn->errorMessage,
+						  libpq_gettext("unable to enable TLS: %s"),
+						  pg_SSLerrmessage(PR_GetError()));
+		return PGRES_POLLING_FAILED;
+	}
+
+	/* Disable old protocol versions (SSLv2 and SSLv3) */
+	SSL_OptionSet(model, SSL_ENABLE_SSL2, PR_FALSE);
+	SSL_OptionSet(model, SSL_V2_COMPATIBLE_HELLO, PR_FALSE);
+	SSL_OptionSet(model, SSL_ENABLE_SSL3, PR_FALSE);
+
+#ifdef SSL_CBC_RANDOM_IV
+
+	/*
+	 * Enable protection against the BEAST attack in case the NSS library has
+	 * support for that. While SSLv3 is disabled, we may still allow TLSv1
+	 * which is affected. The option isn't documented as an SSL option, but as
+	 * an NSS environment variable.
+	 */
+	SSL_OptionSet(model, SSL_CBC_RANDOM_IV, PR_TRUE);
+#endif
+
+	/* Set us up as a TLS client for the handshake */
+	SSL_OptionSet(model, SSL_HANDSHAKE_AS_CLIENT, PR_TRUE);
+
+	/*
+	 * When setting the available protocols, we either use the user defined
+	 * configuration values, and if missing we accept whatever is the highest
+	 * version supported by the library as the max and only limit the range in
+	 * the other end at TLSv1.0. ssl_variant_stream is a ProtocolVariant enum
+	 * for Stream protocols, rather than datagram.
+	 */
+	SSL_VersionRangeGetSupported(ssl_variant_stream, &desired_range);
+	desired_range.min = SSL_LIBRARY_VERSION_TLS_1_0;
+
+	if (conn->ssl_min_protocol_version && strlen(conn->ssl_min_protocol_version) > 0)
+	{
+		int			ssl_min_ver = ssl_protocol_version_to_nss(conn->ssl_min_protocol_version);
+
+		if (ssl_min_ver == -1)
+		{
+			printfPQExpBuffer(&conn->errorMessage,
+							  libpq_gettext("invalid value \"%s\" for minimum version of SSL protocol\n"),
+							  conn->ssl_min_protocol_version);
+			return -1;
+		}
+
+		desired_range.min = ssl_min_ver;
+	}
+
+	if (conn->ssl_max_protocol_version && strlen(conn->ssl_max_protocol_version) > 0)
+	{
+		int			ssl_max_ver = ssl_protocol_version_to_nss(conn->ssl_max_protocol_version);
+
+		if (ssl_max_ver == -1)
+		{
+			printfPQExpBuffer(&conn->errorMessage,
+							  libpq_gettext("invalid value \"%s\" for maximum version of SSL protocol\n"),
+							  conn->ssl_max_protocol_version);
+			return -1;
+		}
+
+		desired_range.max = ssl_max_ver;
+	}
+
+	if (SSL_VersionRangeSet(model, &desired_range) != SECSuccess)
+	{
+		printfPQExpBuffer(&conn->errorMessage,
+						  libpq_gettext("unable to set allowed SSL protocol version range: %s"),
+						  pg_SSLerrmessage(PR_GetError()));
+		return PGRES_POLLING_FAILED;
+	}
+
+	/*
+	 * Set up callback for verifying server certificates, as well as for how
+	 * to handle failed verifications.
+	 */
+	SSL_AuthCertificateHook(model, pg_cert_auth_handler, (void *) conn);
+	SSL_BadCertHook(model, pg_bad_cert_handler, (void *) conn);
+
+	/*
+	 * Convert the NSPR socket to an SSL socket. Ensuring the success of this
+	 * operation is critical as NSS SSL_* functions may return SECSuccess on
+	 * the socket even though SSL hasn't been enabled, which introduce a risk
+	 * of silent downgrades.
+	 */
+	conn->pr_fd = SSL_ImportFD(model, pr_fd);
+	if (!conn->pr_fd)
+	{
+		printfPQExpBuffer(&conn->errorMessage,
+						  libpq_gettext("unable to configure client for TLS: %s"),
+						  pg_SSLerrmessage(PR_GetError()));
+		return PGRES_POLLING_FAILED;
+	}
+
+	/*
+	 * The model can now we closed as we've applied the settings of the model
+	 * onto the real socket. From hereon we should only use conn->pr_fd.
+	 */
+	PR_Close(model);
+
+	/* Set the private data to be passed to the password callback */
+	SSL_SetPKCS11PinArg(conn->pr_fd, (void *) conn);
+
+	/*
+	 * If a CRL file has been specified, verify if it exists in the database
+	 * but don't fail in case it doesn't.
+	 */
+	if (conn->sslcrl && strlen(conn->sslcrl) > 0)
+	{
+		/* XXX: Implement me.. */
+	}
+
+	status = SSL_ResetHandshake(conn->pr_fd, PR_FALSE);
+	if (status != SECSuccess)
+	{
+		printfPQExpBuffer(&conn->errorMessage,
+						  libpq_gettext("unable to initiate handshake: %s"),
+						  pg_SSLerrmessage(PR_GetError()));
+		return PGRES_POLLING_FAILED;
+	}
+
+	/*
+	 * Set callback for client authentication when requested by the server.
+	 */
+	SSL_GetClientAuthDataHook(conn->pr_fd, pg_client_auth_handler, (void *) conn);
+
+	/*
+	 * Specify which hostname we are expecting to talk to. This is required,
+	 * albeit mostly applies to when opening a connection to a traditional
+	 * http server it seems.
+	 */
+	SSL_SetURL(conn->pr_fd, (conn->connhost[conn->whichhost]).host);
+
+	do
+	{
+		status = SSL_ForceHandshake(conn->pr_fd);
+	}
+	while (status != SECSuccess && PR_GetError() == PR_WOULD_BLOCK_ERROR);
+
+	if (status != SECSuccess)
+	{
+		printfPQExpBuffer(&conn->errorMessage,
+						  libpq_gettext("SSL error: %s"),
+						  pg_SSLerrmessage(PR_GetError()));
+		return PGRES_POLLING_FAILED;
+	}
+
+	conn->ssl_in_use = true;
+	return PGRES_POLLING_OK;
+}
+
+ssize_t
+pgtls_read(PGconn *conn, void *ptr, size_t len)
+{
+	PRInt32		nread;
+	PRErrorCode status;
+	int			read_errno = 0;
+
+	nread = PR_Recv(conn->pr_fd, ptr, len, 0, PR_INTERVAL_NO_WAIT);
+
+	/*
+	 * PR_Recv blocks until there is data to read or the timeout expires. Zero
+	 * is returned for closed connections, while -1 indicates an error within
+	 * the ongoing connection.
+	 */
+	if (nread == 0)
+	{
+		read_errno = ECONNRESET;
+		return -1;
+	}
+
+	if (nread == -1)
+	{
+		status = PR_GetError();
+
+		switch (status)
+		{
+			case PR_WOULD_BLOCK_ERROR:
+				read_errno = EINTR;
+				break;
+
+			case PR_IO_TIMEOUT_ERROR:
+				break;
+
+				/*
+				 * The error cases for PR_Recv are not documented, but can be
+				 * reverse engineered from _MD_unix_map_default_error() in the
+				 * NSPR code, defined in pr/src/md/unix/unix_errors.c.
+				 */
+			default:
+				printfPQExpBuffer(&conn->errorMessage,
+								  libpq_gettext("TLS read error: %s"),
+								  pg_SSLerrmessage(status));
+				break;
+		}
+	}
+
+	SOCK_ERRNO_SET(read_errno);
+	return (ssize_t) nread;
+}
+
+/*
+ * pgtls_read_pending
+ *		Check for the existence of data to be read.
+ *
+ * This is part of the PostgreSQL TLS backend API.
+ */
+bool
+pgtls_read_pending(PGconn *conn)
+{
+	unsigned char c;
+	int			n;
+
+	/*
+	 * PR_Recv peeks into the stream with the timeount turned off, to see if
+	 * there is another byte to read off the wire. There is an NSS function
+	 * SSL_DataPending() which might seem like a better fit, but it will only
+	 * check already encrypted data in the SSL buffer, not still unencrypted
+	 * data, thus it doesn't guarantee that a subsequent call to
+	 * PR_Read/PR_Recv wont block.
+	 */
+	n = PR_Recv(conn->pr_fd, &c, 1, PR_MSG_PEEK, PR_INTERVAL_NO_WAIT);
+	return (n > 0);
+}
+
+ssize_t
+pgtls_write(PGconn *conn, const void *ptr, size_t len)
+{
+	PRInt32		n;
+	PRErrorCode status;
+	int			write_errno = 0;
+
+	n = PR_Write(conn->pr_fd, ptr, len);
+
+	if (n < 0)
+	{
+		status = PR_GetError();
+
+		switch (status)
+		{
+			case PR_WOULD_BLOCK_ERROR:
+#ifdef EAGAIN
+				write_errno = EAGAIN;
+#else
+				write_errno = EINTR;
+#endif
+				break;
+
+			default:
+				printfPQExpBuffer(&conn->errorMessage,
+								  libpq_gettext("TLS write error: %s"),
+								  pg_SSLerrmessage(status));
+				write_errno = ECONNRESET;
+				break;
+		}
+	}
+
+	SOCK_ERRNO_SET(write_errno);
+	return (ssize_t) n;
+}
+
+/*
+ *	Verify that the server certificate matches the hostname we connected to.
+ *
+ * The certificate's Common Name and Subject Alternative Names are considered.
+ */
+int
+pgtls_verify_peer_name_matches_certificate_guts(PGconn *conn,
+												int *names_examined,
+												char **first_name)
+{
+	return 1;
+}
+
+/* ------------------------------------------------------------ */
+/*			PostgreSQL specific TLS support functions			*/
+/* ------------------------------------------------------------ */
+
+/*
+ * TODO: this a 99% copy of the same function in the backend, make these share
+ * a single implementation instead.
+ */
+static char *
+pg_SSLerrmessage(PRErrorCode errcode)
+{
+	const char *error;
+
+	error = PR_ErrorToName(errcode);
+	if (error)
+		return strdup(error);
+
+	return strdup("unknown TLS error");
+}
+
+static SECStatus
+pg_load_nss_module(SECMODModule * *module, const char *library, const char *name)
+{
+	SECMODModule *mod;
+	char	   *modulespec;
+
+	modulespec = psprintf("library=\"%s\", name=\"%s\"", library, name);
+
+	/*
+	 * Attempt to load the specified module. The second parameter is "parent"
+	 * which should always be NULL for application code. The third parameter
+	 * defines if loading should recurse which is only applicable when loading
+	 * a module from within another module. This hierarchy would have to be
+	 * defined in the modulespec, and since we don't support anything but
+	 * directly addressed modules we should pass PR_FALSE.
+	 */
+	mod = SECMOD_LoadUserModule(modulespec, NULL, PR_FALSE);
+	pfree(modulespec);
+
+	if (mod && mod->loaded)
+	{
+		*module = mod;
+		return SECSuccess;
+	}
+
+	SECMOD_DestroyModule(mod);
+	return SECFailure;
+}
+
+/* ------------------------------------------------------------ */
+/*						NSS Callbacks							*/
+/* ------------------------------------------------------------ */
+
+/*
+ * pg_cert_auth_handler
+ *			Callback for authenticating server certificate
+ *
+ * This is pretty much the same procedure as the SSL_AuthCertificate function
+ * provided by NSS, with the difference being server hostname validation. With
+ * SSL_AuthCertificate there is no way to do verify-ca, it only does the -full
+ * flavor of our sslmodes, so we need our own implementation.
+ */
+static SECStatus
+pg_cert_auth_handler(void *arg, PRFileDesc * fd, PRBool checksig, PRBool isServer)
+{
+	SECStatus	status;
+	PGconn	   *conn = (PGconn *) arg;
+	char	   *server_hostname = NULL;
+	CERTCertificate *server_cert;
+	void	   *pin;
+
+	Assert(!isServer);
+
+	pin = SSL_RevealPinArg(conn->pr_fd);
+	server_cert = SSL_PeerCertificate(conn->pr_fd);
+
+	status = CERT_VerifyCertificateNow((CERTCertDBHandle *) CERT_GetDefaultCertDB(), server_cert,
+									   checksig, certificateUsageSSLServer,
+									   pin, NULL);
+
+	/*
+	 * If we've already failed validation then there is no point in also
+	 * performing the hostname check for verify-full.
+	 */
+	if (status != SECSuccess)
+	{
+		printfPQExpBuffer(&conn->errorMessage,
+						  libpq_gettext("unable to verify certificate: %s"),
+						  pg_SSLerrmessage(PR_GetError()));
+		goto done;
+	}
+
+	if (strcmp(conn->sslmode, "verify-full") == 0)
+	{
+		server_hostname = SSL_RevealURL(conn->pr_fd);
+		if (!server_hostname || server_hostname[0] == '\0')
+			goto done;
+
+		/*
+		 * CERT_VerifyCertName will internally perform RFC 2818 SubjectAltName
+		 * verification.
+		 */
+		status = CERT_VerifyCertName(server_cert, server_hostname);
+		if (status != SECSuccess)
+			printfPQExpBuffer(&conn->errorMessage,
+							  libpq_gettext("unable to verify server hostname: %s"),
+							  pg_SSLerrmessage(PR_GetError()));
+
+	}
+
+done:
+	if (server_hostname)
+		PR_Free(server_hostname);
+
+	CERT_DestroyCertificate(server_cert);
+	return status;
+}
+
+/*
+ * pg_client_auth_handler
+ *		Callback for client certificate validation
+ *
+ * The client auth callback is not on by default in NSS, so we need to invoke
+ * it ourselves to ensure we can do cert authentication. A TODO is to support
+ * running without a specified sslcert parameter. By retrieving all the certs
+ * via nickname from the cert database and see if we find one which apply with
+ * NSS_CmpCertChainWCANames() and PK11_FindKeyByAnyCert() we could support
+ * just running with a ssl database specified.
+ *
+ * For now, we use the default client certificate validation which requires a
+ * defined nickname to identify the cert in the database.
+ */
+static SECStatus
+pg_client_auth_handler(void *arg, PRFileDesc * socket, CERTDistNames * caNames,
+					   CERTCertificate * *pRetCert, SECKEYPrivateKey * *pRetKey)
+{
+	PGconn	   *conn = (PGconn *) arg;
+
+	return NSS_GetClientAuthData(conn->sslcert, socket, caNames, pRetCert, pRetKey);
+}
+
+/*
+ * pg_bad_cert_handler
+ *		Callback for failed certificate validation
+ *
+ * The TLS handshake will call this function iff the server certificate failed
+ * validation. Depending on the sslmode, we allow the connection anyways.
+ */
+static SECStatus
+pg_bad_cert_handler(void *arg, PRFileDesc * fd)
+{
+	PGconn	   *conn = (PGconn *) arg;
+	PRErrorCode err;
+
+	/*
+	 * This really shouldn't happen, as we've the the PGconn object as our
+	 * callback data, and at the callsite we know it will be populated. That
+	 * being said, the NSS code itself performs this check even when it should
+	 * not be required so let's use the same belts with our suspenders.
+	 */
+	if (!arg)
+		return SECFailure;
+
+	/*
+	 * For sslmodes other than verify-full and verify-ca we don't perform peer
+	 * validation, so return immediately.  sslmode require with a database
+	 * specified which contains a CA certificate will work like verify-ca to
+	 * be compatible with the OpenSSL implementation.
+	 */
+	if (strcmp(conn->sslmode, "require") == 0)
+	{
+		if (conn->cert_database && strlen(conn->cert_database) > 0 && cert_database_has_CA(conn))
+			return SECFailure;
+	}
+	if (conn->sslmode[0] == 'v')
+		return SECFailure;
+
+	err = PORT_GetError();
+
+	/*
+	 * TODO: these are relevant error codes that can occur in certificate
+	 * validation, figure out which we dont want for require/prefer etc.
+	 */
+	switch (err)
+	{
+		case SEC_ERROR_INVALID_AVA:
+		case SEC_ERROR_INVALID_TIME:
+		case SEC_ERROR_BAD_SIGNATURE:
+		case SEC_ERROR_EXPIRED_CERTIFICATE:
+		case SEC_ERROR_UNKNOWN_ISSUER:
+		case SEC_ERROR_UNTRUSTED_ISSUER:
+		case SEC_ERROR_UNTRUSTED_CERT:
+		case SEC_ERROR_CERT_VALID:
+		case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE:
+		case SEC_ERROR_CRL_EXPIRED:
+		case SEC_ERROR_CRL_BAD_SIGNATURE:
+		case SEC_ERROR_EXTENSION_VALUE_INVALID:
+		case SEC_ERROR_CA_CERT_INVALID:
+		case SEC_ERROR_CERT_USAGES_INVALID:
+		case SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION:
+			return SECSuccess;
+			break;
+		default:
+			return SECFailure;
+			break;
+	}
+
+	/* Unreachable */
+	return SECSuccess;
+}
+
+/* ------------------------------------------------------------ */
+/*					SSL information functions					*/
+/* ------------------------------------------------------------ */
+
+void *
+PQgetssl(PGconn *conn)
+{
+	/*
+	 * Always return NULL as this is legacy and defined to be equal to
+	 * PQsslStruct(conn, "OpenSSL"); This should ideally trigger a logged
+	 * warning somewhere as it's nonsensical to run in a non-OpenSSL build,
+	 * but the color of said bikeshed hasn't yet been determined.
+	 */
+	return NULL;
+}
+
+void *
+PQsslStruct(PGconn *conn, const char *struct_name)
+{
+	if (!conn)
+		return NULL;
+
+	/*
+	 * Return the underlying PRFileDesc which can be used to access
+	 * information on the connection details. There is no SSL context per se.
+	 */
+	if (strcmp(struct_name, "NSS") == 0)
+		return conn->pr_fd;
+	return NULL;
+}
+
+const char *const *
+PQsslAttributeNames(PGconn *conn)
+{
+	static const char *const result[] = {
+		"library",
+		"cipher",
+		"protocol",
+		"key_bits",
+		"compression",
+		NULL
+	};
+
+	return result;
+}
+
+const char *
+PQsslAttribute(PGconn *conn, const char *attribute_name)
+{
+	SECStatus	status;
+	SSLChannelInfo channel;
+	SSLCipherSuiteInfo suite;
+
+	if (!conn || !conn->pr_fd)
+		return NULL;
+
+	if (strcmp(attribute_name, "library") == 0)
+		return "NSS";
+
+	status = SSL_GetChannelInfo(conn->pr_fd, &channel, sizeof(channel));
+	if (status != SECSuccess)
+		return NULL;
+
+	status = SSL_GetCipherSuiteInfo(channel.cipherSuite, &suite, sizeof(suite));
+	if (status != SECSuccess)
+		return NULL;
+
+	if (strcmp(attribute_name, "cipher") == 0)
+		return suite.cipherSuiteName;
+
+	if (strcmp(attribute_name, "key_bits") == 0)
+	{
+		static char key_bits_str[8];
+
+		snprintf(key_bits_str, sizeof(key_bits_str), "%i", suite.effectiveKeyBits);
+		return key_bits_str;
+	}
+
+	if (strcmp(attribute_name, "protocol") == 0)
+	{
+		switch (channel.protocolVersion)
+		{
+#ifdef SSL_LIBRARY_VERSION_TLS_1_3
+			case SSL_LIBRARY_VERSION_TLS_1_3:
+				return "TLSv1.3";
+#endif
+#ifdef SSL_LIBRARY_VERSION_TLS_1_2
+			case SSL_LIBRARY_VERSION_TLS_1_2:
+				return "TLSv1.2";
+#endif
+#ifdef SSL_LIBRARY_VERSION_TLS_1_1
+			case SSL_LIBRARY_VERSION_TLS_1_1:
+				return "TLSv1.1";
+#endif
+			case SSL_LIBRARY_VERSION_TLS_1_0:
+				return "TLSv1.0";
+			default:
+				return "unknown";
+		}
+	}
+
+	/*
+	 * NSS disabled support for compression in version 3.33, and it was only
+	 * available for SSLv3 at that point anyways, so we can safely return off
+	 * here without checking.
+	 */
+	if (strcmp(attribute_name, "compression") == 0)
+		return "off";
+
+	return NULL;
+}
+
+static int
+ssl_protocol_version_to_nss(const char *protocol)
+{
+	if (pg_strcasecmp("TLSv1", protocol) == 0)
+		return SSL_LIBRARY_VERSION_TLS_1_0;
+
+#ifdef SSL_LIBRARY_VERSION_TLS_1_1
+	if (pg_strcasecmp("TLSv1.1", protocol) == 0)
+		return SSL_LIBRARY_VERSION_TLS_1_1;
+#endif
+
+#ifdef SSL_LIBRARY_VERSION_TLS_1_2
+	if (pg_strcasecmp("TLSv1.2", protocol) == 0)
+		return SSL_LIBRARY_VERSION_TLS_1_2;
+#endif
+
+#ifdef SSL_LIBRARY_VERSION_TLS_1_3
+	if (pg_strcasecmp("TLSv1.3", protocol) == 0)
+		return SSL_LIBRARY_VERSION_TLS_1_3;
+#endif
+
+	return -1;
+}
+
+static bool
+cert_database_has_CA(PGconn *conn)
+{
+	CERTCertList *certificates;
+	bool		hasCA;
+
+	/*
+	 * If the certificate database has a password we must provide it, since
+	 * this API doesn't invoke the standard password callback.
+	 */
+	if (has_password)
+		certificates = PK11_ListCerts(PK11CertListCA, PQssl_passwd_cb(NULL, PR_FALSE, (void *) conn));
+	else
+		certificates = PK11_ListCerts(PK11CertListCA, NULL);
+	hasCA = !CERT_LIST_EMPTY(certificates);
+	CERT_DestroyCertList(certificates);
+
+	return hasCA;
+}
+
+PQsslKeyPassHook_nss_type
+PQgetSSLKeyPassHook_nss(void)
+{
+	return PQsslKeyPassHook;
+}
+
+void
+PQsetSSLKeyPassHook_nss(PQsslKeyPassHook_nss_type hook)
+{
+	PQsslKeyPassHook = hook;
+}
+
+/*
+ * Supply a password to decrypt a client certificate.
+ *
+ * This must match NSS type PK11PasswordFunc.
+ */
+static char *
+PQssl_passwd_cb(PK11SlotInfo * slot, PRBool retry, void *arg)
+{
+	has_password = true;
+
+	if (PQsslKeyPassHook)
+		return PQsslKeyPassHook(slot, (PRBool) retry, arg);
+	else
+		return PQdefaultSSLKeyPassHook_nss(slot, retry, arg);
+}
+
+/*
+ * The default password handler callback.
+ */
+char *
+PQdefaultSSLKeyPassHook_nss(PK11SlotInfo * slot, PRBool retry, void *arg)
+{
+	PGconn	   *conn = (PGconn *) arg;
+
+	/*
+	 * If the password didn't work the first time there is no point in
+	 * retrying as it hasn't changed.
+	 */
+	if (retry != PR_TRUE && conn->sslpassword && strlen(conn->sslpassword) > 0)
+		return PORT_Strdup(conn->sslpassword);
+
+	return NULL;
+}
diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index 3311fd7a5b..b6c92ece11 100644
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -430,6 +430,9 @@ PQsslAttributeNames(PGconn *conn)
 
 	return result;
 }
+#endif /* USE_SSL */
+
+#ifndef USE_OPENSSL
 
 PQsslKeyPassHook_OpenSSL_type
 PQgetSSLKeyPassHook_OpenSSL(void)
@@ -448,7 +451,7 @@ PQdefaultSSLKeyPassHook_OpenSSL(char *buf, int size, PGconn *conn)
 {
 	return 0;
 }
-#endif							/* USE_SSL */
+#endif							/* USE_OPENSSL */
 
 /* Dummy version of GSSAPI information functions, when built without GSS support */
 #ifndef ENABLE_GSS
diff --git a/src/interfaces/libpq/libpq-fe.h b/src/interfaces/libpq/libpq-fe.h
index 3b6a9fbce3..27c16e187f 100644
--- a/src/interfaces/libpq/libpq-fe.h
+++ b/src/interfaces/libpq/libpq-fe.h
@@ -625,6 +625,17 @@ extern PQsslKeyPassHook_OpenSSL_type PQgetSSLKeyPassHook_OpenSSL(void);
 extern void PQsetSSLKeyPassHook_OpenSSL(PQsslKeyPassHook_OpenSSL_type hook);
 extern int	PQdefaultSSLKeyPassHook_OpenSSL(char *buf, int size, PGconn *conn);
 
+/* == in fe-secure-nss.c === */
+typedef struct PK11SlotInfoStr PK11SlotInfo;
+typedef int PRIntn;
+typedef PRIntn PRBool;
+
+/* Support for overriding sslpassword handling with a callback. */
+typedef char *(*PQsslKeyPassHook_nss_type) (PK11SlotInfo * slot, PRBool retry, void *arg);
+extern PQsslKeyPassHook_nss_type PQgetSSLKeyPassHook_nss(void);
+extern void PQsetSSLKeyPassHook_nss(PQsslKeyPassHook_nss_type hook);
+extern char *PQdefaultSSLKeyPassHook_nss(PK11SlotInfo * slot, PRBool retry, void *arg);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h
index 1de91ae295..12717ca720 100644
--- a/src/interfaces/libpq/libpq-int.h
+++ b/src/interfaces/libpq/libpq-int.h
@@ -362,6 +362,7 @@ struct pg_conn
 	char	   *sslpassword;	/* client key file password */
 	char	   *sslrootcert;	/* root certificate filename */
 	char	   *sslcrl;			/* certificate revocation list filename */
+	char	   *cert_database;
 	char	   *requirepeer;	/* required peer credentials for local sockets */
 	char	   *gssencmode;		/* GSS mode (require,prefer,disable) */
 	char	   *krbsrvname;		/* Kerberos service name */
@@ -485,6 +486,10 @@ struct pg_conn
 								 * OpenSSL version changes */
 #endif
 #endif							/* USE_OPENSSL */
+
+#ifdef USE_NSS
+	void	   *pr_fd;
+#endif							/* USE_NSS */
 #endif							/* USE_SSL */
 
 #ifdef ENABLE_GSS
diff --git a/src/test/Makefile b/src/test/Makefile
index efb206aa75..d18f5a083b 100644
--- a/src/test/Makefile
+++ b/src/test/Makefile
@@ -27,7 +27,7 @@ ifneq (,$(filter ldap,$(PG_TEST_EXTRA)))
 SUBDIRS += ldap
 endif
 endif
-ifeq ($(with_openssl),yes)
+ifeq ($(with_ssl),yes)
 ifneq (,$(filter ssl,$(PG_TEST_EXTRA)))
 SUBDIRS += ssl
 endif
diff --git a/src/test/ssl/Makefile b/src/test/ssl/Makefile
index 777ee39413..fe265e2dbd 100644
--- a/src/test/ssl/Makefile
+++ b/src/test/ssl/Makefile
@@ -14,6 +14,7 @@ top_builddir = ../../..
 include $(top_builddir)/src/Makefile.global
 
 export with_openssl
+export with_nss
 
 CERTIFICATES := server_ca server-cn-and-alt-names \
 	server-cn-only server-single-alt-name server-multiple-alt-names \
@@ -30,6 +31,32 @@ SSLFILES := $(CERTIFICATES:%=ssl/%.key) $(CERTIFICATES:%=ssl/%.crt) \
 	ssl/client+client_ca.crt ssl/client-der.key \
 	ssl/client-encrypted-pem.key ssl/client-encrypted-der.key
 
+# Even though we in practice could get away with far fewer NSS databases, they
+# are generated to mimick the setup for the OpenSSL tests in order to ensure
+# we isolate the same behavior between the backends. The database name should
+# contain the files included for easier test suite code reading.
+NSSFILES := ssl/nss/client_ca.crt.db \
+	ssl/nss/server_ca.crt.db \
+	ssl/nss/root+server_ca.crt.db \
+	ssl/nss/root+client_ca.crt.db \
+	ssl/nss/client.crt__client.key.db \
+	ssl/nss/client-revoked.crt__client-revoked.key.db \
+	ssl/nss/server-cn-only.crt__server-password.key.db \
+	ssl/nss/server-cn-only.crt__server-cn-only.key.db \
+	ssl/nss/root.crl \
+	ssl/nss/server.crl \
+	ssl/nss/client.crl \
+	ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db \
+	ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db \
+	ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db \
+	ssl/nss/server-no-names.crt__server-no-names.key.db \
+	ssl/nss/server-revoked.crt__server-revoked.key.db \
+	ssl/nss/root+client.crl \
+	ssl/nss/client+client_ca.crt__client.key.db \
+	ssl/nss/client.crt__client-encrypted-pem.key.db \
+	ssl/nss/root+server_ca.crt__server.crl.db \
+	ssl/nss/root+server_ca.crt__root+server.crl.db
+
 # This target re-generates all the key and certificate files. Usually we just
 # use the ones that are committed to the tree without rebuilding them.
 #
@@ -37,6 +64,10 @@ SSLFILES := $(CERTIFICATES:%=ssl/%.key) $(CERTIFICATES:%=ssl/%.crt) \
 #
 sslfiles: $(SSLFILES)
 
+# Generate NSS certificate databases corresponding to the OpenSSL certificates.
+# This target will fail unless preceded by nssfiles-clean.
+nssfiles: $(NSSFILES)
+
 # OpenSSL requires a directory to put all generated certificates in. We don't
 # use this for anything, but we need a location.
 ssl/new_certs_dir:
@@ -64,6 +95,24 @@ ssl/%_ca.crt: ssl/%_ca.key %_ca.config ssl/root_ca.crt ssl/new_certs_dir
 	rm ssl/temp_ca.crt ssl/temp_ca_signed.crt
 	echo "01" > ssl/$*_ca.srl
 
+ssl/nss/%_ca.crt.db: ssl/%_ca.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n $*_ca.crt -i ssl/$*_ca.crt -t "CT,C,C"
+
+ssl/nss/root+server_ca.crt__server.crl.db: ssl/root+server_ca.crt ssl/nss/server.crl
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/root+server_ca.crt -i ssl/root+server_ca.crt -t "CT,C,C"
+	crlutil -I -i ssl/nss/server.crl -d $@ -B
+
+ssl/nss/root+server_ca.crt__root+server.crl.db: ssl/root+server_ca.crt ssl/nss/root.crl ssl/nss/server.crl
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/root+server_ca.crt -i ssl/root+server_ca.crt -t "CT,C,C"
+	crlutil -I -i ssl/nss/root.crl -d $@ -B
+	crlutil -I -i ssl/nss/server.crl -d $@ -B
+
 # Server certificates, signed by server CA:
 ssl/server-%.crt: ssl/server-%.key ssl/server_ca.crt server-%.config
 	openssl req -new -key ssl/server-$*.key -out ssl/server-$*.csr -config server-$*.config
@@ -77,6 +126,74 @@ ssl/server-ss.crt: ssl/server-cn-only.key ssl/server-cn-only.crt server-cn-only.
 	openssl x509 -req -days 10000 -in ssl/server-ss.csr -signkey ssl/server-cn-only.key -out ssl/server-ss.crt  -extensions v3_req -extfile server-cn-only.config
 	rm ssl/server-ss.csr
 
+ssl/nss/server-cn-only.crt__server-password.key.db: ssl/server-cn-only.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/server-cn-only.crt -i ssl/server-cn-only.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n server_ca.crt -i ssl/server_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n root_ca.crt -i ssl/root_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n client_ca.crt -i ssl/client_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/server-password.pfx -inkey ssl/server-password.key -in ssl/server-cn-only.crt -certfile ssl/server_ca.crt -passin 'pass:secret1' -passout pass:
+	pk12util -i ssl/nss/server-password.pfx -d $@ -W ''
+
+ssl/nss/server-cn-only.crt__server-cn-only.key.db: ssl/server-cn-only.crt ssl/server-cn-only.key
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/server-cn-only.crt -i ssl/server-cn-only.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n server_ca.crt -i ssl/server_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/server-cn-only.pfx -inkey ssl/server-cn-only.key -in ssl/server-cn-only.crt -certfile ssl/server_ca.crt -passout pass:
+	pk12util -i ssl/nss/server-cn-only.pfx -d $@ -W ''
+
+ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db: ssl/server-multiple-alt-names.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/server-multiple-alt-names.crt -i ssl/server-multiple-alt-names.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n server_ca.crt -i ssl/server_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n root_ca.crt -i ssl/root_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n client_ca.crt -i ssl/client_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/server-multiple-alt-names.pfx -inkey ssl/server-multiple-alt-names.key -in ssl/server-multiple-alt-names.crt -certfile ssl/server-multiple-alt-names.crt -passout pass:
+	pk12util -i ssl/nss/server-multiple-alt-names.pfx -d $@ -W ''
+
+ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db: ssl/server-single-alt-name.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/server-single-alt-name.crt -i ssl/server-single-alt-name.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n server_ca.crt -i ssl/server_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n root_ca.crt -i ssl/root_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n client_ca.crt -i ssl/client_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/server-single-alt-name.pfx -inkey ssl/server-single-alt-name.key -in ssl/server-single-alt-name.crt -certfile ssl/server-single-alt-name.crt -passout pass:
+	pk12util -i ssl/nss/server-single-alt-name.pfx -d $@ -W ''
+
+ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db: ssl/server-cn-and-alt-names.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/server-cn-and-alt-names.crt -i ssl/server-cn-and-alt-names.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n server_ca.crt -i ssl/server_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n root_ca.crt -i ssl/root_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n client_ca.crt -i ssl/client_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/server-cn-and-alt-names.pfx -inkey ssl/server-cn-and-alt-names.key -in ssl/server-cn-and-alt-names.crt -certfile ssl/server-cn-and-alt-names.crt -passout pass:
+	pk12util -i ssl/nss/server-cn-and-alt-names.pfx -d $@ -W ''
+
+ssl/nss/server-no-names.crt__server-no-names.key.db: ssl/server-no-names.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/server-no-names.crt -i ssl/server-no-names.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n server_ca.crt -i ssl/server_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n root_ca.crt -i ssl/root_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n client_ca.crt -i ssl/client_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/server-no-names.pfx -inkey ssl/server-no-names.key -in ssl/server-no-names.crt -certfile ssl/server-no-names.crt -passout pass:
+	pk12util -i ssl/nss/server-no-names.pfx -d $@ -W ''
+
+ssl/nss/server-revoked.crt__server-revoked.key.db: ssl/server-revoked.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/server-revoked.crt -i ssl/server-revoked.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n server_ca.crt -i ssl/server_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n root_ca.crt -i ssl/root_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n client_ca.crt -i ssl/client_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/server-revoked.pfx -inkey ssl/server-revoked.key -in ssl/server-revoked.crt -certfile ssl/server-revoked.crt -passout pass:
+	pk12util -i ssl/nss/server-revoked.pfx -d $@ -W ''
+
 # Password-protected version of server-cn-only.key
 ssl/server-password.key: ssl/server-cn-only.key
 	openssl rsa -aes256 -in $< -out $@ -passout 'pass:secret1'
@@ -88,6 +205,27 @@ ssl/client.crt: ssl/client.key ssl/client_ca.crt
 	openssl x509 -in ssl/temp.crt -out ssl/client.crt # to keep just the PEM cert
 	rm ssl/client.csr ssl/temp.crt
 
+# Client certificate, signed by client CA
+ssl/nss/client.crt__client.key.db: ssl/client.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/client.crt -i ssl/client.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n client_ca.crt -i ssl/client_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n root+client_ca.crt -i ssl/root+client_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/client.pfx -inkey ssl/client.key -in ssl/client.crt -certfile ssl/client_ca.crt -passout pass:
+	pk12util -i ssl/nss/client.pfx -d $@ -W ''
+
+# Client certificate with encrypted key, signed by client CA
+ssl/nss/client.crt__client-encrypted-pem.key.db: ssl/client.crt
+	$(MKDIR_P) $@
+	echo 'dUmmyP^#+' > $@.pass
+	certutil -d "sql:$@" -N -f $@.pass
+	certutil -d "sql:$@" -A -f $@.pass -n ssl/client.crt -i ssl/client.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -f $@.pass -n client_ca.crt -i ssl/client_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -f $@.pass -n root+server_ca.crt -i ssl/root+server_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/client-encrypted-pem.pfx -inkey ssl/client-encrypted-pem.key -in ssl/client.crt -certfile ssl/client_ca.crt -passin pass:'dUmmyP^#+' -passout pass:'dUmmyP^#+'
+	pk12util -i ssl/nss/client-encrypted-pem.pfx -d $@ -W 'dUmmyP^#+' -k $@.pass
+
 # Another client certificate, signed by the client CA. This one is revoked.
 ssl/client-revoked.crt: ssl/client-revoked.key ssl/client_ca.crt client.config
 	openssl req -new -key ssl/client-revoked.key -out ssl/client-revoked.csr -config client.config
@@ -95,6 +233,14 @@ ssl/client-revoked.crt: ssl/client-revoked.key ssl/client_ca.crt client.config
 	openssl x509 -in ssl/temp.crt -out ssl/client-revoked.crt # to keep just the PEM cert
 	rm ssl/client-revoked.csr ssl/temp.crt
 
+ssl/nss/client-revoked.crt__client-revoked.key.db: ssl/client-revoked.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/client-revoked.crt -i ssl/client-revoked.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n client_ca.crt -i ssl/client_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/client-revoked.pfx -inkey ssl/client-revoked.key -in ssl/client-revoked.crt -certfile ssl/client_ca.crt -passout pass:
+	pk12util -i ssl/nss/client-revoked.pfx -d $@ -W ''
+
 # Convert the key to DER, to test our behaviour there too
 ssl/client-der.key: ssl/client.key
 	openssl rsa -in ssl/client.key -outform DER -out ssl/client-der.key
@@ -127,19 +273,40 @@ ssl/root+client_ca.crt: ssl/root_ca.crt ssl/client_ca.crt
 ssl/client+client_ca.crt: ssl/client.crt ssl/client_ca.crt
 	cat $^ > $@
 
+# Client certificate, signed by client CA
+ssl/nss/client+client_ca.crt__client.key.db: ssl/client+client_ca.crt
+	$(MKDIR_P) $@
+	certutil -d "sql:$@" -N --empty-password
+	certutil -d "sql:$@" -A -n ssl/client+client_ca.crt -i ssl/client+client_ca.crt -t "CT,C,C"
+	certutil -d "sql:$@" -A -n ssl/root+server_ca.crt -i ssl/root+server_ca.crt -t "CT,C,C"
+	openssl pkcs12 -export -out ssl/nss/client.pfx -inkey ssl/client.key -in ssl/client.crt -certfile ssl/client_ca.crt -passout pass:
+	pk12util -i ssl/nss/client.pfx -d $@ -W ''
+
 #### CRLs
 
 ssl/client.crl: ssl/client-revoked.crt
 	openssl ca -config cas.config -name client_ca -revoke ssl/client-revoked.crt
 	openssl ca -config cas.config -name client_ca -gencrl -out ssl/client.crl
 
+ssl/nss/client.crl: ssl/client.crl
+	openssl crl -in $^ -outform der -out $@
+
 ssl/server.crl: ssl/server-revoked.crt
 	openssl ca -config cas.config -name server_ca -revoke ssl/server-revoked.crt
 	openssl ca -config cas.config -name server_ca -gencrl -out ssl/server.crl
 
+ssl/nss/server.crl: ssl/server.crl
+	openssl crl -in $^ -outform der -out $@
+
 ssl/root.crl: ssl/root_ca.crt
 	openssl ca -config cas.config -name root_ca -gencrl -out ssl/root.crl
 
+ssl/nss/root.crl: ssl/root.crl
+	openssl crl -in $^ -outform der -out $@
+
+ssl/nss/root+client.crl: ssl/root+client.crl
+	openssl crl -in $^ -outform der -out $@
+
 # If a CRL is used, OpenSSL requires a CRL file for *all* the CAs in the
 # chain, even if some of them are empty.
 ssl/root+server.crl: ssl/root.crl ssl/server.crl
@@ -151,9 +318,14 @@ ssl/root+client.crl: ssl/root.crl ssl/client.crl
 sslfiles-clean:
 	rm -f $(SSLFILES) ssl/client_ca.srl ssl/server_ca.srl ssl/client_ca-certindex* ssl/server_ca-certindex* ssl/root_ca-certindex* ssl/root_ca.srl ssl/temp_ca.crt ssl/temp_ca_signed.crt
 
+.PHONY: nssfiles-clean
+nssfiles-clean:
+	rm -rf ssl/nss
+
 clean distclean maintainer-clean:
 	rm -rf tmp_check
 	rm -rf ssl/*.old ssl/new_certs_dir ssl/client*_tmp.key
+	rm -rf ssl/nss
 
 # Doesn't depend on $(SSLFILES) because we don't rebuild them by default
 check:
diff --git a/src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/cert9.db b/src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..2e541cdfc9c6da2ce489ad74bc2f32e25028361d
GIT binary patch
literal 36864
zcmeI530xCL`^R^45st73C`c_tML|H_To3`3Lqsq_I7CqqLx>pUP?8{6ixN>hS`mD`
zUbF~kv4Vw)2wqiMvGsbbR;*g7Sgqw%3W}}bRo|ISIOIeB{rgJa&-=Eskjb-i{AT96
zyH7Hc$tEmBqEsumbCXjNWooVfGsAEk^Wt(b3^UX}z!SAGLCDbC@Col`|CVWpjq<q9
zA=)vPQ4?nTkf<}RFpf8N0y}6!1P}p401-e05CKF05kLg~KmuMYmX(zq9;r-<Riw%1
z%apN6DwR|dlc1Cv_=fs<hx>5@f+qM)=Td3h;2>^iI@eLgBl#o7F)4+qltO|mMv>5&
zgY}96mDW>1Fk%9OW%ZUF9z~T`X=36Pa&@Ny^A!bsYEKOw$s6HKXITyG=!a6J(kN0o
zMHsJ$=n{Ksh<PKjgK+~ZJ3D+`qFNS{py({#Y0&gK;od$HzwR8Av0Q0rz!dM$NbY36
zNbc02fRL$vum<1Ypox+I-*B$CPjG0s3s**h2M;{>;30rE6#-*-FiH$}#c)?l?ZPZ#
zAq+$?aD{;z48$-P0|OZhVn8s4k|K2>rAR^z9;vGbs_;lC!y};%kAy-z5-RaXD8(b8
z7LSBtJW>uree-nfqm=nNn^NXe%6v+hPbu>$Wj>|Mr<D1WvVbZppvnrUvI45CfGX=s
zrMgn7u2iZkmFlWXrIcMMWj87(MTtjY;#2+QldvqG>Mx&avw(^hQ1JpPUP#3VsTiR?
z2G$}ZVJ$+6jF2KDr1XW9zK}W&BC4#2Dl4MOiYTf;lO*{(Sh?PWtrx>slFBSshy+4`
z2xicmFoWKNwd+mT1icA+t2ben^(G{$Hz8J?N%7H}UBxI;`q-{wuHA~kL!!&z*3|~L
zjyAY<wHKHj?FD8>USM|1+fgxy?PxDBJ1PcdN5#PGs2G^=RD*2*COqHtCOql%W^9+K
z=rZSan$$_7%Nx_xoEX@gSdom3jUmYqJQ~Z&&ko0Qu4Q2Y7|}<|H0oq(Kf3d}j^=fm
zbl_^)(A~m8Jx)A>rlIZ$nrK4=5CKF05kLeG0Ym^1Km-s0L;w*$1Q3Bg4*@pQ2y});
zoWY28qLsKqG!U1-4%!d_L;w*$1P}p401-e05CKF05kLeG0Yu=xl>nR0!0iQ3PO$XG
zXH3fAXHH`14Szai@MfFQ4Co9)d){n<8vmQF$4svf!%Q1Y*Avx5;(u!gQM(WUL;w*$
z1P}p401-e05CKF05kLg~JOun1nPxcY#T!R@vglJ8bQ4jyLZ#-WBqyu6zTWVA>Rf5E
zN*$M?2n&&L!@?xo6b0B(sg%h{Ts6$9(tzdfECwCJnSCV2=p!9^03*{9Cw+Kc<TzdD
z+^Ej||N13QP%4ttT)84et)fi=N``%*r2G8e3nOk2dBkmEGvP(7`SYAjs3(X3B7g`W
z0*C-2fCwN0hyWsh2p|H8K;IDPvmrgpfNqZO!e%hx%tfEgI6yJlTXauDasbbgG}p~K
z7^_qXaH>S3Ql#j{{~C<YfYE;~ah*6we9|{$kP0Gz2p|H803v`0AOeU0B7g`W0*C-2
z@E0fGL0^pjo1gr5P7~;-3m7(ZF%HJ_qu~k(XE2~oRis4AWuxRNYPvoPHU5WLbSns)
zbx-<Cy7B)8jJQSA5vPeJqKw$^7e6|v`-lJ{fCwN0hyWsh2p|H803v`0AOeWMe}aHD
zU5JM#^KP9=KO3Yx`P0ddn6!}Vp`WI*V1n1~2UmSRHA<I6;0B@(PS>*5o$=Ex8Gxy*
zGD)znw^RRSKicPa*}GpXd{3^TQ)>XM=t9HZ%5p%DnDnnO6KmsstnJJdz(gA&fC&7L
z5?Ib>E@oJonws})zooelGX;MbW(rcxvrMp_S*Wz0#a?S4+<oLTP=JPGU?CGM37&d$
zIyl&18u;J8cE_l~w&PxmWA>5ObzZqwMQ4W}w2a6Rd&_LOCM9@~S>}+N&bJ>;$n*Pg
zc-m&iMI#ejt}*vqI-Z<AeV#jOa747~{Oyy;E=ea&yi5tIxV4CVx_FEsyFRa&Ggza&
zb~148Uafl>KRsBwm1+L@%>kzGPk9j;%8T*-A#2k}JFo4>Hnf}_nzg?=(APdM;^V@!
z%_Vu-R_6*Et658G#1(?OW2?)RWBTX2+dZAf%}HNfp4HaxNZ`J?ymHU&JEKZ#{AZqX
zjr(ZAN_B*A{9coJKV8_gVd<a@V~ey<@mopDSFirLEjQ%WVKU^K?*%T4c!lfNj-NJE
zd1;Se+{}Lr3A4HIP>zG2QN^|W8C?f0(@gwY(7^$H&HNZ<2{u^BROo`)gB!&BBg{99
zIwEiW%{!W<8QaRCJ^%Ba^-}^J|1M4N{GvW63<ouYc7I@#9p@^)TV9>KePToCqUzjZ
z{CmoQaSppbjBnxPp4_`^;xv(!@2Z9LCGcbxWA8~Z%U8i<nhAfu+pkZiyCxvx5B9;i
z+WQ1MsioVJS{iEyorcqT?>EU|89J?;wDK_r$BmiTo8u*ItvKK(p?G{Zo&fxqlW>L=
zN9allc|!eeAJm}5hjec?&cx_ioWMveZbZ`p7zdVIZd=3Hx=`ym%2j))c^%v0`i)5k
zeojkmjAJe2%xc&&tr)lYVx!Wn{j<ZO(q|L)uYTNMlmG6+<N}&xk%w%Bg0<bF{kd_p
z=SLqY2g{z?U%F$R<M>&bw0WPK;n1`Y!wnP8H(OUE@71hW{ge^x^+Q4SL_3f8y37S^
zvS!8IS)0zim@PiP?)^1&FPbZBD{Y1cu;$<A$Cf>=-I7x}>Fa~q`YjnI&Xu@(on7F3
zeBaWhY<nMH!MLKR(LOVs4^4l5==8kp7N2KdZEU=sKE|<M>*XO^S#jXTNe<S3J93;}
zR`g_aQN?I;#koUU{3kxyQnSQyP_0jF;dS<-cVax^X5Z8l)9B!mEjA-fNfWT1@@)$S
zlceML%kIp;p$5!wY%=LV+tlK;blCb)Ki_3czHy-XhW*vJ)3@TX<BmATH~lkl<FZrt
zS2q-0%y)U$T<XR9__56Z)yQV%i(OWaD&_<x<_J_aIT>djPHmd=MW#*t0Q-umHQC?Y
z%896&P`Xo6nkDugvg^o#;=nU??X8-UM{C`;W#t>&Ty9#hGWtTr^HkRpj|6Ks*f!5Q
z>bZL~!>Ibjp>J*9`Tmqqopr($>o2t<Ek^B&NMG@MS><ER$bxBXzo%QvBPCZ>9&mX%
zn=_{9pxxYO4+XimlaJ&!ZM$~CK7E$fc>17a<uOi!AGaTOu^L`mP&mauC!(w-t1;8z
zyC;TeHyp##$eoy`agkZeZ00h01H78v{EYmKOY6<QB;3opWn9akb@RoRJzpfd`-k4_
z*Y`ND_+oHtt}b8P7he<xue9CWF0?V$wH8esTkH7Te|%|eI=}U-te@wpFO8~*TSpEs
zwC-=0dd#?*t-#-buGbS=>jGTwD;zxkc+U&&Oa|!cJ#TNHTLQm(7I>unG#u}7;q}G0
zqI-B*(W_ooG~>5cQ-c=$-@fy&{&t7*ojnd1<tYbo;}e<&Hv13c+&L{<Ubv>3Y%Phg
z{PNzx!bSsi-q*KtBeRMsv&eR*q2*6BmFh+2w5SLC9ZuV(g-V=LKmBIh$5X`b42!U*
zwJqI41n=!%kk3?>DS|i|2T~<$mu-ZF`^NK6i<UH&?6@>NUa*N#n0AGBsyMt=6IS!(
z+fUDbwf6&mqobyttjEe&>6x0Tid!YCzM3|p@)&z$UhQ*1i^wgt?RaD+C-jlRBKEMY
znw1i=YS_`|yQL+2?&WFaM^BCYd6crE<lWmpJ}!6rhU0ZMT(zul&hWn{+}s?pBfyRC
zHK*3n)^2xuWus+OkwL)PW~t?xf@%8%MIHvuN%u^CB@RGe(idkgydHjIseiBU#NqfK
zH+~-j|7b%55CKF05kLeG0Ym^1Km-th|0ID`3s}^A=VI)=QE<Mq`{YBW<sU!l1~(4}
z-36oWe{*p%m=NWFA@DD{2~nKZW1#ouGeN&QF7JaWliwY~AO6v{?I0&(S^3cV;zNY;
z<mtpuuH1}U>!B#HB{nKHt!Z<PnU!+SY;Z<ZR1W+49r;MHQ@vAUf_ik`CI7pIe{1=s
ziFv_c;t#bg4zY>L*9@uHzvA1(<X`6#;;(G#zs@)6U*=%=!NaN<1NQxDkWjSim#VQ6
z$uA$jEQ$7+U`6-+{@lzv%u=kM!Qhjnv+Uw8s&<~Yh-%$zu8y90ar5}pgX4BCUi?7n
zA-;~kT+i4(81s*kilgRu<yVH3(l$4nEl8?O%~ua@zdV-tQnD@gOo}G1cC%vU)`sSc
zT8XXO>?cEHrGxg|v(6h`ATO{T=rlj>m+*D6Pd;Qgcx$wW{oEXe8NYaq`A^%*?6w6@
z8>+vJ5(azBZ>7z1TuL83JuWcuyO!14bNqIVc(%3HeR<8<+Ups{V@6!0Pq8W)idoZq
z?%B&HpH6(b<;v~+#YMOGEG^@d2CTR!Ud3q=ZFum$xp>DHKe2;8Jh9Oyy~$w24hxwF
zCKucLWowi6<zC&bX_Q{JFn6GBtjgH9&5_g^)wisW4e;H4X7aNPR@HjikofY6zE9$3
ztY2OeAU&r_5Jg`r$(Lu_1-6*J>v724bWPbY+TjoH`p50PQ2uq&6@U3yskLjr!tjgZ
z*KXR8EUDkrOn-FFB5qI0{-IAUrqN>9<tK-=#osS}5E<BR>vBpeui_l9qF0+7_3?qu
T<IT@{@aaNdObzt5rU3sJIhEY#

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/key4.db b/src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..2a6cb5d9248a87e322d39172bd495eb428b2a035
GIT binary patch
literal 45056
zcmeI53pi9;|HtRTG&9VMYebk46-9e)4AHnGa>*s62s2Dl?nWtfG;Up`)S-K%qC^)Z
z-6)q7M_1KBDRD}tlS)ZS_0HZn&gE@p{?Gq;pXYzx|Jr7+`R(;v>$|_}vu4)V_Jg^e
zuHixfby0L&Bu_|XqLff*G|GlbMWIkc@vb1=M>d=|kQ+G=KcoK;e=j7WOsBsgQ9h#Z
zL@Sg+52Z%ohyqVRkJv`EA|Cx-Cr}Rv00MvjAOHve0)PM@@PCs)#F#M}Iyz|46d{iv
zA&3+Rc{6!J-pDiF-pj$(+kxtBYv<}f9jT>G4iBYzc+GaR^_ow0ahOl_nKRqd$ARiT
zhidOWXO`=1dvB_jgNLiFy~9+h_&d```p^@@Xc``;VXuQmg-3-7660ed#K|CDf-o96
z4jR!9qK`xbI~-0!gNF7;8iXw6g@;DP$9u$uFXIUXV}{Mmo-@<IkBTH=3!@FFlX-NA
zVPqqZXv{-2B6xg3#Ap-TpEQu<-!zy;v*d6Z+B9^~knIHi5<!S?R73tx8u3Hvzp2n6
zx{*B=r!j71G~w~_34*v$8M!~n3}yeO!l4_j^+J!)pwZBqqmd~a6&Q^$!%{=jHd-&s
z#M#=pdwEZ#@*wdpo;Mytyffh#seo(fa1{qW<iLj<<PdJcVZj9(F3jM<94<I;VF4FB
zxZsNm3q%SUDiK8p)}TW}=Ydt|5G+H7U>!OH3(+B1i4MV1bO_d>L$DYf3W3XEdqe&Z
zWyVm9C^Hac2BOSBlo^OJ15sum$_zxAiS%V6eVIsKCeoLQ^fg1WW=Pfy$(kWqv!N`a
zY=$VCBP|h1bOaLv87~8Z`!bO6G7!&9q@Ib?Gm&~0Qo}-OSi?2&Sy&K!78XK=g^*z(
z`Yc4Bh0FsR>B~m?vXQ=QgsNB*f*5r8<ijECo&(oHNaGLzo5^Cb;ReGY++a9_&psT&
z7KTH3w8J4h<lzt|Ivm1SheCwUa5&lxAvIh(+Rf|_-QX!1YG6L<!F<Gn*{EM}IO10v
zj<gkre`q^$VsY(=UvW5cVsSWfVsSWfVsQw+)L;+d5PrQ4hwzJTI1C*P1*74j-$Ud@
zGt`zpYKITo31#!3P(B11F)=s|N80xm#?g0h5PdYpia$~C@TUq%yrXe3DDeYqfB+x>
z2mk_rz<-RuHWFHdky9g+t^RrnH7gbwCH^9lQ7E#CN}3`{B||GsbL4BJxi}9u`(JEn
ziU!PqD`EjG8XX@WF)bt_To5IkGV~M_!ZQtt6T<S)Sh^adg2VdAVHFj`4TXYuVM4qh
z&Zg*Xi+v?=g{v=m40~V072M`V2Q<8)4xtu^AE!6wndbLiwvnqcn6Fu9v$ci&)5LRX
zzF8bwo-S3f5Isjpq~9^6>%+`!hvyR$b0;r1iJ00df3*2>^lrb!mN=SkQ2foVtI<=V
zYHPp6%{kGz9N$o2LBQY3E+EkoQd+M%FDgl~JjPhz?y*x|rKV#nIn(XSd@nlR_LsCA
z6Fr-~Roi-gnviz-th2pAwr^>EVs2q}%Ihg7v@`-%Rd7x)f3-e)JlsNkx24{v#nh}7
z>yM}PDqnOywTOP)YVW~?#TAbJO=e+7W@ZR|S=<uE#jkGXY)c;hgMw<J7e_lPb^ZGH
zy<0syFF>9To-(H{r{{0k$elMKy!j||hW`!yxmvg1g`iPrC<UDgMdAp?8BQ7fB(yvU
z3WjV)4;3Mn95pU#{J|TJs;ksp@@?eTFqlc>fA&v*6+Ed`Z^8`>>P;2~jmDs<5D|wT
zQo#@)Z5$yu!wD_G%At+r$ZvYFY)*YjS<}JXJEbJK6toh5iM;o&l<;z6!U0wHrMrW;
zCrO+7oW8a9yxxUsQ#zod@pNZr-Si`vYNOKZXK5!6?-;v9Z$K%iPNC4Mqk?NN^GMjO
zX(l!40nKfS?<bjblfpbxc&C2bq3m(u7N`38q&oz|UjnPwPDV{Q<i7Db`pZ1}iHcp-
zs9xNQcMDC@(Y$RI*d0&aYbE^>mr|+t^o{RQIm?>)Hz)EEt#Sr!V+JPr`dT-J9rMP7
z1skRP8aepz^cKMkp>Ft>&X5~p+x&Js{rc+VRx0suQ~v#G!IFpb9TMxG^t3on&X3%)
z*+1k+Zfs%T_0p6p^~-~8zK*wPs6Tb`i`~-HuWzAE)PYAu&o4}?y72b%qu5Kj=gcQv
zR#?YPB8aB}BW)V03U55#Fom3UvAgG|+UM2y)2o?fPjyQfnY~$^rF92Aq)vnGtFoS!
z0k!Kcvtl?OXmX-0rgCFDwDxdk1egx^CFvDBw9vdbr93UqRf|$%Us%37CwxHd#_7Qs
zy;Q&W7@wb2GAn&M)|+-TmM;(B=F})^JDjlCkoU<;%aF|@a7*$+9O5h&Qn<%<ihO(B
zW5%{DB-~o){@yCoDy=eLQ@rZz?xL}t_-_+VQ92neTN@lV?<D4ub;o{u?^F<NJuCa(
zz6)eoDEQ3sym+TI=B05RjdUc-X1n!{8%lQXniSW*F0Jb0_*hD%;Ilu<*L(Wa*8#^`
zPdyqhrVy=tUsLmO;O2L%sgp19k`FbS1}5n4YQIul{gcYPd7plC`l4ju>6v}oty}$I
zZd!a$K5=Esz=938Clw52dD1qY*K~I^^l43hAygMC4KgurededHU3Id##?_OtZG7CT
zS&KdHW#z8cQ$q6>Ej*iMmhxDO?f6n*$0VWh!nw98YdXgnm<w9)?6Qq}eFPRaFFcWj
z0_6CqeSK%s@|J^ZYvb=*Cofz31EoX9&+8c}p1UY3q*p41IiirHw{nfQF)Q2l%y}iI
za42<d+0nKi%sL4LmaUVbelhE@<MU25;jY?`%kRsYR;;bQ!V=24RG}=tO`&9;$sS)1
zyT%X_E=U36$vfZlaB9Cj^x)#kqIurS?*-mqZS?Cn@>BTE&H{hZt!V`mhr+Fg7nXM`
z8Fc38e(c>OC_z0-sj}&wewyc&qEr8Z_RP{rFFmJPHRWA`YrEC!%ow-rvQV&3IGb!f
zf65$c8UL1|uW%u%SnY|?a(ZTK_)fL64de8sQm`3FElFN=H#5SJ(}>wCrqJ)ZjO%~P
z-C!jzC&O|7%p>@D?WQ^INqpw6LGN1r2fJU5P27L|RR3z6)yZ@oH&ItkUc2hW<pq;x
z*qlG*j1LZ6)w=R<!}DCV>tC#B>?@7t%eu<8EDBp%6rO9?;8B5}bS5vtQ`j-Ha5=Ht
zYGV3yr;g?*VOo2aTLPBoHY2(AZT)?%<b5sfu^-w@d!5{jFUUfn)+E1%-)v*zcIfzY
zGuFYu-KOZo<k#w}rmH9J^4)cyN-Bj5Dk<0YFHMi+Cmbtlf!`7PF>k$my_Ih0MtQ~B
zR37cvx4)^G{QBaJq5-R*CA`?h_hJ(Q91Xe8>ICFaOYN%*izaDScK7If3iKaKYvUx?
zPSmHNlC8^QLfb>qgBrq)7wSN%dGZ(E2$uyci1|4GaFOGt^#xBiJc~JT*Q0p#H1kVX
z&f0m~g1bbM`<w7<vUMY$Y|oM3_ul>7!QA#w_8!gf{cH69_YZ6MCO=wye_s3m8z2A(
z00MvjAOHve0)PM@00;mAfB+x>2>h237=x7~z_&q$uKx#7l)?Y90fONG0)PM@00;mA
zfB+x>2mk_r03ZMe00MvjLI8_J5r(e+yHJ!a00j^L1ONd*01yBK00BS%5C8-K0YCr{
z00jQY1hlbMgzx<_Be?$mC(kVK4hR4OfB+x>2mk_r03ZMe00MvjAOHxA5`eG&zxRiZ
zhOYm+QIzh{_8<ZT00BS%5C8-K0YCr{00aO5KmZT`1OS15CIJmBi}3IMaIw62IB3de
zcu>Tlr+?=7fNMYi5C8-K0YCr{00aO5KmZT`1ONd*01)^d0R=7i{{J|V8jA9sVoA}a
zlv5HZ_b9oP`D7m1j{JzcpFBveB(EVcNou4Rk{79))Id5$+DtYe<G!Z}>Hz^j01yBK
z00BS%5C8-K0YCr{_~#JN#oD6d!^46?1aZP328+pDWD&v$8v1wl42HJEG^C}2<s!Y8
z3RaACrvKhqLsAwRD=BNHE-A}alayttO3E@-BxO0ulCtJXf5pMz&{-TYJLJFKTTmpX
zIb=y`KAR*d&E_jgO7mF?lG1D*QBv9rBK$Q?XA9`i?*qe2OmoIaO7qz`Noh7;UQ(LR
zl9QBX^RSZAW)MaJt3!z4#m6s?jteD;-<D{KKT7-n8z2A(00MvjAOHve0)PM@00;mA
zfB+x>2>j0pi1fAPZBtZG-~Uk(Bw7On;0VSUP8t0qv^*Jdhipd=6(N=!b>=Urj5EiQ
zW|ZwR!Siz-?!<o!8oc!8o45T>GsoqpQo1o{GzLwDh&cR^3Wo5<SdN-@9v{2^?1AMQ
z=)YZSJn?k^y3+pJl~ZwO4O2ZQ=D3-^!Pozqs7w^ak6cD3lfo5i74;NW67LZq!bbcv
zyzQ7hxPF|Me5pK9ZV|Q`tBYBQzK>>zJNzd$k-nB>Vvr2PmbrR!xxoXeh55Hj6%P=!
zHnb?$wQrAol=U2{@LAPIkVY)#V+O0+H&V5{LbUG1-TYkPPU<R*w#Y=Da7(#&!P5p2
zO+%hLJgxusXM8evOl&pCP+QzDoNiWaxjE+ZgR*9u_F~&tKN`GyXUdB>c21hdt!P>a
zRaHLkrZY4n4&A(yP}n%-Dr4#UUs#!%igR|mh-hOadX$A@DCY9&xyh;i#dW5SdoXw%
z3(JNVPxS6vw7Ps*VKKe%t~8I<k#PoR=%jb`l!>?l8pH){-s_sX*dG}04<G-=SiAr&
zqNz*tXeI+k^VIuV8=q@taSzqHZVu22)0sfI%L!9))X`l$@!iI{d}$u<_L)ToZ?c-V
zeTMq+`(8KC9pfe`Yu(;(KxD}oXL@qxIT1}wqDQt29*tkEdBD4Ny`U#BPxaP0i_JH}
ztMs5NFKR6V-+mi^FVaw&$MBBy+_DF^r{84k{-N2x`LqJ2-?6H=?>b)<(_Hv#><JM~
zRia0h3?7}F7gSlt#wen*p+mD%wR`(3sI%j*eJwR!6ENmxkCmS^k9yT#Zj*dtN;~LH
zRe7B^bvy2Czerp5=6Tqr8hXK?L!OAHBGDsL29Hl|`r3Ar7Af6xACperGT1t6&k6zl
zX=2&j=SBnPZnqMpd3-Qw%e;y@i~JdNo>qnr@$DfoweN%d$q@!G%Zsxf4U~vz$`U<t
zWbjDaa=*mtH>~m5%Na#xaqhI)E50RZqLt5BU#)7KVt2n%n#V$Y)b)>RgG$Yt9$cmH
zKHrn?ZLWQrIq};%zxf+?Gn0!&G$n~1&1LZDH(u-gL6$|rr41H>CC-JjP2T3vZdDi=
z_dSbamNu0fmgdp2>f|@Y^?j7&z_#i|g&h+r7hJtOS3u!5PSH%6dOmfXNT2ezMf}hA
z1Y|Hdant<8TMpH2z4PHjhkCvG*X-4fCzY?o%@#gSy3Bo~YA4O)8_U24UbM{P#Yw9M
z?bl{Br#{p}g|HrO_2{^td@^g_RFOVevPoHH`_SV#HC~yEm8Mpl8gE^m&~%cwjA-|I
z!P`@Mp}Wabn|4Vv*_pb!%MXQ~o11Rf6KvGJ^?`F>o!)cQ?8p=%1J`CKC(<WLG|87`
z`I)uF3bU;zqinP90~aB`JH1@q$14>3@oinQ(GK&-SPf|=->=TwBJ>F@nqF7)oa}47
zaPiIZgt^XWwlgvAMnT<^<syAWi6+^68K(QlwAy}62hk+Tk`07J&m#}=E<D|h7gZj<
zLbfxe>{pGFW->CZ_)Y%=TSl<L9M8J}h0S+$&c%qDTC4hE($=MfXQzqu6(pME%d$wC
z+D<#{s#iM2=;hs&9UE5W6s>N&{y9wT-ZQq5!;A5&tE8D!p5PsL9YuY4th}yl>c#%O
zTWt@jtO}bprt8As8RAkMKaoCBqDeMS29ns>aq8`y2)C8yAI+7UUe7A(DvT)7$88mb
zO~1;G3}}~Ta##AbeAmj;j<?RZOlmu%-DiBA_GNJG(}BY!hQ?o=oUKLr1c@fiWck)2
zdowTpU6Xr-d+?gir`K5*9X(t&p=I6V;?<g2O%E)%t<p?>)Ln$z-g|nmJ}zzP>#e-X
z$t!h}I(4*YCR?Iw@td6Xi1hJ)Gx_JccQTMX@q*>@S;;i<XM-63b^Uvmr46*sy-)O8
zlDm3f;?Y?B25Ba_@td?gId?3}G+i>UMSdEr%Fc8#SKG1TLUPIJ9=)5rBK<LvP0F$a
z-G5CikKo$ob~y1LXSgP_S1Tu73U2&T|1z*C$cCa&C(UH>#n)X0YIEI`UELO|=iJ;I
zLeyK3V6@O_yJqHl!HP}eMfy02CS_WJic))b$p5T$-L|OT+J5OY`(-6b7c^_Qhf+u`
zzE8f??~`UyW#Ovx_K)JH&=P}9&sW;rT=u5(WUEu_<EM$re$PlpCy4arC7P6J2`W6d
zbI+di&lO2j!`J|?;ywP!b}b1OY@2(+W2Pk)g=NxAvZB70_{JQd8*%Qens*WNJo-Z4
zt*eF^`}aRsSA2JQakxldPNGSfmLNy<c}k~VeVqSoteZZ4X31HXAN}tfo|}*z;@h2I
z5fUfW<cBePy9%a6t&echt@<#rrlp*?!Rt=VbT6|bj2!Q|9<N0DScxWOT7q6a<bGRp
z3S~*ynW*o7cJiq!SNhahKQQo$eZ9suIZYnYNEV(>bISYCy1Xm7?Um~BqD@@Y-25Jl
zheFhv?dqFJXZMNpF%nJ6v;=L>IQZ?_J<5yQhY|=%sLyX&j4N!$`9wtDS$iP;v0Kn1
zX(nI3I`gxWQ^B!l7ah|q90h9_ma@On*F)7LI`u|-=N=1@AzEICm7+FspWTYz?BlQb
zSYg)JBmsTzRW$`?m3BxZf+9z+_eoIj-!A`y7^gaO<+E+`zDDLADtPTAI!s*BU=zGy
zy(qul)8~h6|Hh^^ju4#Tgce}s(8hA)myetm7v|LELYf~ub$#WOo@LI6Hu~CJ@4TA(
KtL=5`OaB6Y_1OIY

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/pkcs11.txt
new file mode 100644
index 0000000000..dfffe92b90
--- /dev/null
+++ b/src/test/ssl/ssl/nss/client+client_ca.crt__client.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/client+client_ca.crt__client.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/client-encrypted-pem.pfx b/src/test/ssl/ssl/nss/client-encrypted-pem.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..940af9f2967aeb1d3be1c41db6cb2d1e21c757ba
GIT binary patch
literal 3149
zcmY+Fc{CJ^0>x*{7`rGUg9(LXnV~_l?~}2GPnMYyYV0XODhy-Iz7vhIWKH(nAWI?3
zkewmPzVA!(`p$XpeeeBo&pqefbMBw_2gfs`Xn-I%p7|VvK`dA|_<#jS2PEQ|0bo4S
zDICvq2**P{{!>AScnI-N^o9lq_+yFxG(b2ngz?`C%s>d76-*B^sg)fCyam(H&;$JO
z5FBk3u(<#@Tp{AY)Ix+PJuFYL6FZG=V1Jq!^lg8gG73&qCcPD5h)?g`9ab=dF?M%L
zP6$Be?j#~zI{XO7GGQ<I-JThgS5}L6eVlSj^LYy)`iJAj`7B~N*_RsG$)ny&!XlrO
z-Lxe1PaJ^^Tvu}jOQ_Prk)8M1a7&ppz8Zv~n>i@Xi3#;-iaYi+p_To2Tkj1r&DbqX
zPH}h`b+{|n!5l{BRe>Is<(6jwO^QsZw&;aNGhFDdt<qFzIk#EU8|mTEU2UZr?hM=F
z(EGON)gsC`>&rRyQg7~`GpA)TY0~u)JMYn*E%PEP=;qt&MHw^X&wyZ4eA;+_U!N^Y
z3JFQU#G%$qTmV|hoVatG-}yMN_r@*n6v%AYeqm(-l}q$Hen;|u09)UNzLk{)2~=Ab
zMvu%$$uA?wnR=Q$541Aw2GR&N3{_mV3?VoqR7E=4VphrShBpqWd(pSw=)2J@Wt{@`
z!|#ZTwro-&HvWPQg6NL3vgH78r;mQ`rIHyfwi!fi#u;8mjksNT<K}dVxtE@^iK$t7
zCNnqd*f^k>t=2#W_wT-syEW70%YoOnIVG%2d>461O7l1I$Y^u-WE+YwY{9NkYZ3eJ
z)}R&G#KR%c?AXos<DD;96%0?GZ#8k|c=cS0fy1{BcJ`te=Q9>S#@6{Z+bHzRcH&sh
zylPhV%Z7bFw<xa|f3!=T;(+8$XO&s(?!-b%HQ0nU&76fAWN$krG;KUbc~X9@Jtjv7
zJaVP8q^IV0sCPqHo`cT$CxRB+I7N~6<$jAn{a0PV*Vu(q^ZVYRiRHbsc`}Y9$&{Mb
zX5kY15by<q;XLDm!T7n%hcxfmeZu5hP&2fqFPJmzKC>skTCGry#d2R0w0Lz+)f<Ay
z(A(M!nR=2t!pGs*8D2n#ebyY`m+3vkBCUEqLc<1jWU7Ad@%Bi=spx<XWsJl;(@G;o
ziXAcZ9r9S>0wwV*vd?oUM{(uX?V<g+{g1C5-0kihyR>?VmRlNOT8Am+I`8Bs-@1`9
z4}wL!CL}U~87^RKUVl?dyP?Jy5gT$-h04lbhO1;u{R@3d_{xw&6fVUf$y)kafD#tK
zcl=;hbZOuSW5W%7s_MqmvzqOPpy}<1Hd}MfAqf;}>F;57glnBY;g^hl`PJ{rj0M9b
zRY*06*&#dHVph*z8)d_+thd@KbMM@ukUc6(rQOdWpaeu%XY#=m@ZcR?+d3cp+Yt>O
zX3b+=g@CvguMYHayevE*M#}m%F4}*5hxhuu{D>9YOzceAnNwD@mT9)n{xb_B(jI%h
zKGT~!Mx-?0vl^uQp%k}y+R<@{t&!~&-So$`8CGbL9q3cW&x_wJljEGf4g4(eyFA%I
zpK{&|Vlde5FQ~nC66LNp>SU=U03y=gYYi;tEVENfjaJ`gegn=eO%hnw`W(tICkFXK
zv1Z8ie3BCRLg&2B#KZ>b6G`3yBT=w$-SKXlEEM~yAnpfZ|42@#VBs9U>KJ2S{h-Tn
zfZI_Q)XyT1OjvZ@4Zok6QLiAG_^YMvDOZY}sL&Fg35NFf2rvaFX?}M#?8}fVWg+|X
z)iw16AQ`LF0#{A;*fwGLB3HppREf|A=oW6}P8Ll<i(8krPG3g_NE9enD=-8!Dm8RU
zf+}%dhWkHPCem{ljch17aH1>O>2gWi$p;Pc{_}K+J6`p~x`?lZ4~2euwYm?AI@K8t
zV30_S8HsaW-%Uc#Ns3}LDvyNkb~$-kTxnT1Th_HQ@=6-c!YGEm@-{~+PjjTxJ=+_v
z`OsOQt+-gVbJtvhN0uN*vvJen$NohnN^u3fJDb$tNIna_ag5lMKz`_l&G5dJ*Hazj
zDRE`v`g(p8(J}6P$KcZ2!udkG%%1$!xF)e@eG&Y%`6jLw8&U|u>}2aUe{(|RR_k*Y
zeZT~i{<W+;t}GOd&lXEDY=4YDNnc^ruKPH3HJ7NH*M>7N0~Wq1x7x(A8b+O7iDRRH
zAGpT(1IT0Wd+IS~8X>5*8#Pv5LH!J%a7cg8feygeHiXs}8x&MM{K1OX)xv0errLI&
zC$&@2)x3^Z{#c@9^vTA$?2Iub$m4bU`s@j5#6B9ls{3JjU9ljGAE+<=zS+cJV@GKG
zNp$*GW8^|0UQye%v4TqB9vCM1$|$uyM!@m3YX1W!BA!+njHi|S6N~+kFofwpm|_Id
z5b@x3I3B$GfAj+VO)oio6CF%6`orJ!0^`A5x%(LtgF5rIa=O=DPaqQ=bwM(|dZ;;<
zrV*ohWVo~T9!9TTt*U#OKRdKUHBZch{^}1;6h^C*x|C5GpJSCC!oNDJ<-|o<!^3f3
zs@WQg7ZYpGx?wgsk%rEjA-f(tK`)+T<&7sJ0o4e5gwf7~DX1E__gyR2C$W7lR^`hh
z?ZMs4wY8F;l#e$g&*=6I6*Uy39{t`8DB-wM-C(sZ-GpZGZOXw>C4zCVG&&6~!x#Ko
zB`5>kJcdd#sbI29jb}R&p-z`1T-Dlsi6hmZ`iWez0v3~UZWHXCrL`E(<XdjjT<usq
zx3I}M!QfWZ{}rc?<@{!xT`g<U!9KFLY|%WD%*;G%zG&&+Av-L2A@GxWn;QCafsW`|
zJTkayLka2Lt7va=M}U6mAVMOsXetk3P8BX36-lsn!Vf@txj<w<M-)-|0lmp!F-z}7
z<^}CfRneflyN8^gn_epgnol2OlSwP05j%vyrv<zU;Xt#Kd@tJo@sI-#?Qg83vtsr)
z2NjNs6czO9T?8EON2%grsP&9r3<)uWMP%aR6XTT?@rSlXCS~5XIz1QCeA3h9Cm#-)
zC`Va_J5aBh$9lK_8Xwh&6q-*4L|!m%ua)s}x##X<-3N!Wh^MYS(C$!=D3g$bxNFkx
zw3^_(_=R%8g1>Z-B01v{sH(M`uK3LdWo}ruEhhCG!OTf2_w3M*N^Z*SbdAVNs5)9$
z4<dy<B`0|7^GU5r{0KT+o{Y(Hm%deqkY-u>Dd&2AVIc5M(A@FU<N=#YlUzz=H=hQ(
zSPvvrbgQ`EHl!^=!+QP8GNCc^nfi>B--}4L>Wc>JGcIegma%m(u!cQ}Pt|5d@+)qy
zs=Df)`IjEBetOWh)2G;P3?SYLDOWo^Xc)J1oP2Xa^olLfiiiw5KWW`2G&Fto{P<wJ
z0TuQ^_2O3J$En=@)cyM^*58J|JnzSp%tp|Tx-hGk8a^nsdt#YhaASE1$#(nQ)IP}K
z6IwiO@In}(@mXwZ(^SDMv*p9U;F@jU-g)_wY1CnJC$A0vyIYL2J-P@8`Fe|Z+=k?q
zc38LDX`hk?31Ep1V^ewbF7160&mkS5+l+!<k0E4AHJY}7K9@3kYBZ|K-UKfdE0U?!
zgd_TP7J4UpG1n>m=ZI6gtNz2KS2Du{J)>0_#`bWu!WdmU#!J>9|Cf51%5vHLg0e?T
zE=dA@KcFU*hK56|`H!D={s0MPb1?})!_<ijXT{j`X`k{eWGVGc`-s{2Ev<3OlDjnC
z;$K{=mzOd=8u7!5I6@{JH7`3AAR~s%*FqOC<wchW?*Sj^`25-$nI3tQ!P82fV2Q}b
zPGSl_2!^YF;c8b+<j2X)rBSLhc$y1?vGNMnc04y@2q-x1F!3WJwLC6!yi7Tl)!<;L
zZ?xW{kah(<z+(-T9t!LD9i@pOd&3{p2r%BeOg%&i|1#$l@w7XbxXxM~df=X|VRL^h
zA>bv~_En%2duaa`9u(|;39(?(IR!VE&{ub2S(Ddv))SIdfpYM+au|{?uYX=}<ZxE~
zHa7nRXMxR0Ep&2gsX=`EnF>8XS`q^9>bLP08C+hY)Wny6UCdO5dUY5lrthC7bepy7
zzd~Gv3;p*U88{Ia!5onBb<cKsyy&TpN@0tS^hS>jyCNI`7l1QBXs@$^Xn1G=U=CPI
jn*)YVu~usO@<YwNl!$18tTvcl6QPmBn7Ziq_e=f@w`J`P

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/cert9.db b/src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..78bd1528d61535531d652ea1fae1e1a0b749d696
GIT binary patch
literal 28672
zcmeI42~-o;8pmfcNdS=yLTX$pM5rQ*I+KJDWhsk6QI@b-QIVH~NLiyvuvIH4F1WO6
zrAjGQX{}X33${|NRDHas^hxoxqO>m9O{+XN)C$E?%e(g`EOO}awZ(T%Pw&9oe0TZ&
zbMNoo`I4C|vC-kFCY^Y$-jJy_iKT=+L6StESWFOvHQ24d-nsFB!R^d|N3w_gYo;|Z
z&i9TT-A3>SG!eEx&?jswY}0H#Kn8D^049J5U;>x`CV&ZG0+_%PBoN5wi$u<3LTXmB
z?nQ07IyE`VXjEluGE%ixAu-CJIHfo&a*}d}7}bfRBE?<x;xTHLk+=u&kU~6C$WUu^
z8C@;-k0_wJ-U?FpNnE~YxHFlE{EgX~G@aJerNDbc!BX2>gJoFvAc`*<+BuF?qcK}&
z=n~;RB4V!Wt)XDu^P@;Bk+U<oKGUSuWazrwy9|y+CoU*BT-lRDYO+`r6BZE^lOUd^
zOc2LMhDFCK;SoZjB16N&LgK_h!BH`BUSc%^b{6asuuGwh3SbEfixe=cfLR5~!X^qC
zOuS(thlvkN6fl_p6E#dUAen%q7;}mg8K}WB=HoyWmVq)X19eyi3b71SVi_pKGEj?U
zpcu<&VQT4~xqnDmVz!a81Sw09vIHqhkg^0ROOUbzDNB*B6!}V#uN3)8k*^%p%2BNx
z)yh$=++2&4<w)5FwM3Lygh_(ND`B9o1dUgM`Yc7|QdBNQ<uX(vLnSgx2|S97fk%-c
zGBQL)hV*4fUxwzv8~J)8UvK2=ji>@mhLN!F;1(11UI9xP)L5(Ymdd2wuz|&d4J;-+
zy2XTDu$XYP784HHVnU)86Jj-+h>ykWc0;5rrQL4w9&T_-%nf|H`{2{r2YGjYf!Wz#
zV0N|zW{<X=2L`2`{RL*{fq~h1U|@D07?^OW!9D;Jt~ZMb7oEjS?lyJZ=G-n5EgExM
zO?P)Rusg}#Y9?93FzzgeFH$;_ggLa#&j45SN$PBq9_5p|&g&$$%cMZ4h1d6l9oTtX
zdt%@)TStB^?*uUMh6!K-e^CO<CA>vkp+Ml!d;CHN86g0F1R(&m4l4!{y_=xA-fq7s
z@7lV<9XN1EVka>ZdV&XTp@eW7p;%jRwe=NG*6&kwb^2uzY_JaemxxAd=jQAw->Gt%
z5w@mg+}DeyeYk(q(q>o5$pTK+(zJ?($X04kV6@*-|Abrb&;7QfHpJd=xORqL?6Q9}
z9#Llr_Y6K%FjDeD6x-Hr72+IIq=}UmOmW^@dZl7((XIBt+HdrALfumpb86N`x5T-Y
z660hghS7DSOxF&0Qunvb?T9@4a7*CWTQA<2dSf9w`Gcntnxh667gwna;+pp39*&_u
zzqaJmrP#uR&3Oxrr_1?Gz6&mJQpPP_x#06lgcmpJ0YAb)HS^{hM+=WO$R~Ui8sWQM
zzT)PcRnz0Q2UxrBe8cPPz{>qc)~wj)(7GkP*5vr`q)+LfL&4weF{F0z4j%h~1h-+y
zJPx;e(w5oxo|wnY0i3wswh6%oJp?i@!nI{$)4yXwV$qB+fouTd$EV`C)IjezozWyV
z==COXND#ckELQ1_rWAuNHac7!8yhY*=s?D3Ox0(JO|Ypk8$5AwNDc|)VtVexLs25_
zF(<IJqh&qirI`5h<qbLhE|QAfBkIydBp1B1N~2q}WOXR@5?r~XiI>L_!bd4A6UrVx
zz~7FcrzXH~4dlVX)MljWvP?-@^*F7;#N<(SOdi=%LV<ySf5wh)<FRVWsvqr0(w0a3
zabAp*$PT<lWF<bV6ui3go++}E$r%|dvt*fIHjoK0&xjA2k^gNn%%c!%bq13W48Wyl
z$4MSR<&iW2$_H@rz>ur1Io<onE@x@EYr~GibZSj)=KgcvrmXYTZFizK>$a@D=c$=(
zxM4psr!sMab>mg-ScOM}M?!{a{HC*$uiLzK`^zTYX}8ett8cp{XD(msQgLAA#Z3J#
z>9peWVGU=B2Ryac&1TyVl`{vw|BF?|+dEq-{lmjs-s{+v6g){pg?x8v)>U2^G019U
zP1$Vcw0h$^pE)Kr7dn`dX4MxyyWpdMcNQ(WtMXMek{uhlZ;m7;C#n>Qe+w-BAi9iG
zc+-AfR`r5n)5x|j{COSWTVMUukeyOpsGC)E>1IxKxRcME2QKQer%P`P*))E;cDvJ1
zkMxw5xb^D&?{eLOvh%8xK5nCIA95&g7VfZT1k6A{dW0jF$515M(UTdNY`}~poIc3E
zH}9uQ2QMbdqI}bvInR&DrN+-lnVR|4?KN+1Q0{bZFRGrn{7_wWV~*_v_j)Qqw9Azk
z!U?|djCNXW=1;GmyHdR9?JK3Zd+o}?R@N(4+ckL?+<nDCQS!+x>&SPHZw_AAWaVDs
zsP-kaif5Ghd0FqjdVY8IH>xij9o#sZD|0q)9mC`eXt=#nJve0dr_<VV_>~(uE@|bV
zArI1KZd`sSOm)hb;hl70SFtwVdFpM!65qoU1#9;n<5azSeR9ga)8%Kf&P~?(tA@x2
zy%ksg?7A%_`tXJ=H>uWBjwz*v1FjG1U*u@4%WFp6OS`k<Zo<?yC$Ez#ZKd7cE2)D6
zj|2z9bLNk)dUz)F!@`c!vzJdUtcy&oxmB}=$BAx?Il6$%<8pdLQ{n$Pn%);a+Z|2&
zVTgUk)3RAl+YjgZ&N(whw_WXD^m_Z3xyny6auk;(;xShbv}On<J{Om-B^SeZsvy>R
zfq41|2frsDPVWl?%;D5%%ouMDMq>@S1^RSdvN^7D>OlB8&__t^2WXECs)Jb}<6sV|
zwxEOX=_}i)Gdwm>{?%Wupg`GISTuzB349ytg`P>F@{3ujyTrbI2l7sz-t^qIpD)XO
zSG;%p;hyg=l%?mc);GT~=)r8og@r9Ayj-pi{!g<(u+`N+(8-=@+vJw(?h`RJBsJ&d
z)43iSk`#;Ah)zA{*JyR2@z91VMK0ycrekk;?k4Y?k5A0paz2)F4m>=4#LPm^&!Y5)
ztA31bi~p9r?{c^D%?(qJtg^YF%#5`;@_Ez%`&Q+xK>LHk+3lK%`<AM{{-&mCvD18?
z>|y-i$feI*YhE>Wo9@K))m2j>+(raMq^SQnf0)|~Jl)aC`itw6x1EbW^^zYM*`A-j
z(SKU*lBA;Ctrc#|pD!5d`LE*Gl9+iPzLh?vU_QDQ?~jNE&xc=GoPEBM9so`<9(|Ue
z+vsNcDt!r<c*6uR0ZafBzyvS>OaK$W1TX<i029CjFo8b-0c(m&!ne|R$N+E8a4p6)
z3K`%QBgcy3+PH#yZ0P!5aE=h1qelrY(Ff_wKfwTT7cl`$029CjFab;e6Tk#80ZafB
zzyvS>3jr=gki5y<W%lGB|F99apLD1&?lK|SFYoeC0ZKOgp=5sle>FjWO>d;H(3|Pi
zcnM(wm;fe#319-4049J5U;>x`CV&ZG0+_&)B49;1kl^dAJb2%N+i&*?C@9AnPWjpV
z+Lr>%*Z&_AbRGEg|5x;J`r{`xLad7kU;>x`CV&ZG0+;|MfC*p%m;fe#319-hhd}2&
z1Ir_K5H*^7<j037OATizrLgJycQnk`|9c7gGJS$>qW99Zzo#eI2NS>qFab;e6Tk#8
t0ZafBzyvS>OaK$W1p14>5K2b&^&@`f4-LTDzJAZt{22fdC9~<v_rI&8?9~7O

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/key4.db b/src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..5eff0aae8ca3c4fa615a1ae29580f9cc407581b9
GIT binary patch
literal 45056
zcmeI52UJtpy2n!p5FiP?3M4^LESQ8OL`9`5(u;J35E4Nt3ZW<#f`B6`7Mj>-g9-v7
zC>Dxc1Ph9aA_9tl9mED><0c0f#yc}f-g@h<_2#~P$l3YM{`UT#|NiZ;lfzknn~Qx2
zmyPE{M20cBcw?A63=W5x;qfpSOoqS9^7rvgk{?KnAMl^ye~AAslz|z|eTTsf!=z<Q
zVY2<WOR~kXOj%u-b{SKdlE3Q&>Hz^j01yBK00BS%5C8=JZxRTVl2X&whV!O#nSr6~
zFgBNI#pE)_pQSBbt<Bx7@$Tjp_SX3ETKv?IAiT4yt%JF%H{Q<L8^6TS)@6w`-pLVf
z>Evi*Z)@p}ceQr5H@CE&f#-iR4I_^}Q4D8EOR8CF!(k!eLF~Aw)uH^PKQo#e0Ui5~
z>-&?(BeaF2q?#H5?h7?wtz?D-g-1m>M~1{OxooL1bGD9F)?RohDX=in06&#UCQ%H{
zP>_Zvq!G#tWQR^Pk^D&mO8!a1*w98oQca5h_aC(#9k_zc;!bFwe$t2<P5()SOd=av
zA|=%{#zzwp6&1~noRE?DNoF+rClv<SaI-61N{v8(r$s<hHX$$(A;zRer){EMoQX5H
zaB_8@foGEVJAdAo6#i~3h@lEW4Ovjd5F9cDhYaXY(1bx16f{9W7ZfIff*~ko3ks&7
z2;>*DAt};m2`Q2U8f4Pwc?2qCl0b$`66lag0wFR<phPAKq{t+J7MUavBa>Kya?IYS
zKS-G}8bityNSOjDQy^suq)dU7DUdP+QZ|PA8bf`Jp}xjYUt_2*9m>+7EFH?yp)7qg
z3n|kfWfQ0+M2QSxqCn%NkOX}x(0D13XJe?|7^*jh>Zwo-6{?|*)d<c)B?-<#g~(7L
zGE_*P3h7g!d7wdkX;5Dp)RzWP<!h2i6tdvtW1+x3Lr_bC8nf6mW2!Mt&|oYSG#Cp7
zXCDg%7RExsXvadqkjFv+(Xmi~bu@(djD-{3AW~zs6W!>4=q8ww(FP_H9!$nP&?o%z
z!*Rd-aJ(%){6pLE6Z31w{qn={6Z6CI6Z6CI6Z1pCOHJT`9|~S?W1-+hHx>p>gzSls
z^Lq%rXhz!xPS^<)*a@OBNkM@mlA$p|Qf(pO?-s_1?_huOM2zIWqeu(hRWSS=E*S~q
zKfneE00MvjAOHyb2MMIh!g&Y@Wh|EQ?<Y|<rD9?HFDw=Y!zwB!$-xv;G?UcFzs8&M
z^MYpoi!Dh`?{nc)z5o&qkBSPN#R?5!hjV8}vST7vvV)9Rkz9c|NtLWjQj|n4kwD7H
z@|$tlQQYV#cBDi$1vW*Sk(%E3dHZy->2>CXmCxXU4ORs6;Xm@!3|O2E#m9=Ab-Zl1
zTs7)iYgc`Icfx=kr7;~5p0J|gzT;<Pv6+i$!aVP{m7J$}O_uVJXPdlC-FO!t*D=GD
zi&amj6DYAx<l(PUmb$Jvfo}BlMY^RWJr(<N-hMS}dJ=I%nXOW>>}smZCwILPm=QHE
z(%^<Z_xXwG$d3m(BaZjJXPM1>8~1wg>ow$sRVv;CPOAI%)i_7uuYSEeP08k4#`>Eb
zZrR?MiEE<n9Fu%8H|7yyxlw#_%<T@?3<;;-Bpno;ectS?&#u2upWSKWFgJ~!^yXcP
z$CBLn(uPHQXWWxJdAx2*QkmlCtd&h%rSFX<B?_l4x{D)2Mo_2DeSpK@q(t~8QkW!q
zTFRo7Aq*UaAq9}kCl2LER0+J)sW$cPtn6n`VNddEA32|D@LlrG#`fUzJqI@yog0>Y
zf`G#ja6CyyQhHPcfhK85q61PE!P!U&_%sQuvgg&#tVHcKgPhFL8nQ$pTz+GDY--Ji
zs_;vQB^}bTbT6C3F>8{w7Y8-nvTHTlT7sya({8I(amdCyDwlS8$0_=qy4FQ$*KPVA
zwq<5$Zm38c*|~A#414g_;EKioyCZ(cIkBpi+~>Xy#tm9~-w!YUbn=?=T+jS|jcc?|
z{`A{(c9TDvU(vj&p@dwg7t-PUDz0={76Yx{9jb4p?eVKSjIjPdzU;=AMXakMKbCH~
z_i9Ih`?|F=EbHF&N){jQDL?X{*AN%sKI3ZVlxO`0<(vHC5t^)q{c0Lt>U<u=>08M3
z64!NyE8b>!Ht@Q-G}F}r5%DLswnT6Fbj?f0zmt<6mT|&KYsXG>In!<Mc1>_f+$4F|
zw${&xH(LH02@SbV<@wWq5H$^|5$g`tJ~(`IPy&8imB(F-fF0SDO8(y7sn>jGCDXJ+
z<TP|&FW9&@A?#jrbkEzw&l0?yMjpv8<2LS||FpnSW8cy{t2+DhJJ>3++8fW9t)cFj
zM)t4^sct)3|K;S|+rj5Ix4FrFRKB^dznL}ouo#)~va29j{S2YN@M7JA=CDfL?bvJS
z`%K-k_nRwUZM)WU{s<#ICwK6|naY#jTr{4WOMZ<eu!;6k`Im<X-RWMgb(bOwwRHE*
z9jV9;)|0q)rK&!0jW`sNGd)tffBbk~__^;$9pT}lySq9mk2?!4vx+mO8_Rj$7D=J~
z&XbRveLp56@7$sX!T1y&-7YCAlWI>o*?jn3Q_A6GG!?`W#~`!H<p}peS8b`uiAj6x
z3@s18Qa>bj`DsIkB@)wy-P8iRS<6xHpIo{1)05eYL)2Be+V#xl&NLnFNZLh=)ElX4
zz85-ad5r53^{^XS%QwvG+*mlQ9)p^9iMpj$=BOR(-BNu|XXYE&0g}9WN1nyU&6}tR
znHQWA?!+z?hr&4*zdDvf&4Z%BOYjXDw?>XFQP^3ws`~hf@F?Af)u)C;Qc!R&&YgdB
z|F@kthYHr{@+nm24dqPM&j=vq=5u!7hiXQC+jXgBTf=fQc~<TBSjW=Fgnd^2>J@vX
z-QVkeA9%XxxJ#q87W1Hk=G=<m@<E;p<4J?2(VK^5d*YUqIdwItS2a5RIRCz6rLFP0
z*%!Vj%$a>fZ%<b3%7<Sux9t@c_IBOzQ$qXiUnbX`c3dOJG^<z3fcpIK#pZ_it!G2R
z5cVs?q0ryntYYykELXKY@3Hy|O3MD1os74z`at`)tYG|ge_fFjwAx>kEWmYp5k7t|
zT42DZpq8xc5nHbO>!xSk+m;Sg&TP0cWJVi|-iA7pt!Kok@6)MEDW%mP{xYLk@5`Bh
zC(V;jdQ$OREC18o{W>T6a~hXg`;HVH(weu=p|)-xVJ7-5HnM2*Bc^^rWyYlCS`p-#
z+h?o38Ze5rjyCo8#8qJBUxa_zVWFAO?YHH6&Wp$1yOaCh{%E9Yd+^qHA90?yOdJYK
zhdcX5Zf)Hk9;R4_lv)Avp8I3(59>41{nAx=+w|+^i=;3ox^U`T`C*0uwPwB*i%;QQ
zCR?%ivYN$(23gw=RI9E@)k}sE3SNHCrMzXr_g?#ux+mRrAm-JGx@)bX?KHAf%O?F@
zkB2S3S!@dWe!$wd3s$bF>hXQcx4j1vwl#W|wuNfF9&XH=TXg#DP|)hgH_x@sS-dT*
zCN9{PuM`$=eJ5APXUpT?+EC4?5q7@B+F4Br)+<fiO58X<-Uk|RxH$!a``7UQ?{C(E
zoBVM8{dxWaY=8hD00;mAfB+x>2mk_r03ZMe00MvjAn;#CKnf{=7Tg3Gz5f3O!+rZN
z8z2}CAOHve0)PM@00;mAfB+x>2mk_r03ZMeKm?FT7<%;jzXyiv0Z;$|KmZT`1ONd*
z01yBK00BS%5C8-K0YKoNOh5~1ivGJ_W*oi#?}Op`{>dW*-T?tX01yBK00BS%5C8-K
z0YCr{00aO5KmZ2QKr+yO{fCZ5um4}ba4!HSKmZT`1ONd*01yBK00BS%5C8-K0YCr{
z_@@(4LsHRy^@od5{DHx7Uj@UH8GZVvj}-U^1ONd*01yBK00BS%5C8-K0YCr{00aPm
zp9#on3hw`FV3c9FkGMHFEnGD&4tF1yjq}Dbu@=}4Y%ca2wjP^+F~%rkR$*K*FECA*
zQcN0lGFI|uC2#}?00MvjAOHve0)PM@00;mAfWSYIfDY0e9u>0OpT&;k`csTKbfz(7
zw*TnAyQfgJgr-TF+Q<b^@0IK|<DD75cUBXYC8-L_(p7|IY0AQ~R3%|qV?|+EhJvuH
ziTuCgpcymS3_d&PzuwQr2~9Jw!qR~>jIcB<P)=AnkSZ%IO=HRkOVdf{e@|1%RAbKX
z1Cth-W=IK32ht>krD=gEVd+4sgs?P?i4>NmlMu2<ZS*Q;R8(w4WDth`4GPEk!uSuc
z0Rn&kAOHve0)PM@00;mAfB+x>2mk_r!2g^8kEn$*PgI2c{g0AJyabY;BzjuPqLd*F
z9EBx0k<2F!<w#Tsyrs*R+{uNT-IF&h{v}7LuS#y6^e^+T#!jcRpC5|h81y0Fa0DDr
zl97}iRY9Qt81ws|B^&0j1|D6iKK|)P{Qb5D9Kq(%!9AU~;9l0X9QQ4P>wk6Fb{NhJ
zTZP49LgX&X>B_E^xi3RPZ<X$oHkaBjIV9<dDo4pkaF7>~I*7IKRyc*<;XkqQh?>HQ
zk;EXDQRKcVGhW)?v-0yr^Ka5E7cINfD~_!^o!S~Z(3I%?MHI11_}59d<nH$cDqmUZ
z^r7RIk1aFcom{g`$q{Prw7niB^9X9F1!L3tmp|hZ!{e%!NwYU%w{Nu$D>_n><i$B(
zpBJg@JFrNr2}ig+c?D9G$GF}q!hVZZJC2Xl{LU3sdsZj1h!OX{>SaaL^!xT^NAL)$
zLOqJZG4|fM3rDMl@acKJzn-rwtN(?2`t!x|gKh>3I=a^@{L(DSqX*e+aGS((|5)D_
zxvhjOpPeQf=I<-+VY@EOkveBS=*c6f2=z!8gJV_7RE@*9g(gzo3ZKwd7$F|>;yA}t
zWv%lM4TQ<6XYxdOR7+HN`c6Y*p{&D0J6Vh1!YO{-T`WuUCTz`@UDFlxAMgmuLOs&N
z@Q5awuMX|@-J=wzQ?`L>U~3eUkuvN2iMHuML%D{p?_Cz<5mw4X)~zea@(yEU*U%nk
z+Lxa+b=ox)7uK`GPOdFSi$_or>X9mj$KGdECOhw*_uIOIjJfg4qgiT)PC2ZxhsP{D
zIxs!HP_<B$$NM^O;#-ao*Th(bmTq*&aCzw#%MG@zy<EqHrD&`<6~!Yc3iW6#hDQy{
z2rrrM1M9Qheb9F<wVBQuNy|Ud*pv@v^WtpEF02scv9GsYnsn}kvrB;it6)wAqri7D
z3%lSwgCntE@fmY<3m!p1s7Hnv9uu=FrkfztIE;s1FUs|3DpcylE8)-?S1OTi-_~ta
zQ5EH}Fgfy#9h%{HLM4X2NrydfEcl{p&YruD&uZdT7Q|k~@(A)mJ(`H&adK<WrdOQR
zD^e?x+i&&zxWqc<ElFl3A)?OJ`##MlycOkfZP`qHo2J7Dc4f;isd@ps7Vg3Fdr;@`
z;EsL##kAE@Tpkhkr$zkddjevZtZ*(JUfZ?)+CV1xq5s)|&)y3TMBmjlr*k*oKHQ+W
zKTVWLnLWz#<S(qE!b<agjfRQ_&t))c|JG%#vgQYD7>xFE9uX_tq&TxpI&k;6?4%i`
zDZy$ggT;;!sloBPD>e0bi#Iz2{ZI<^5@qruilT!%WcS?OC|hQ2;LRG3f@59=vtjw+
ztSdermu21M5ivqd28y%%bhadNOfCnKkGMZLwP;Pt2KSVT6Zbz|NiT17qS)iNuN7rd
zs$A)Cb^fKSRVCWD&zYp<p$I-tLvE2D4379vD$0T*c|<v(CTW3UOn1uhl7oxv+}fY<
z9_h)gXhAhDwv@cq@AMkeQ$0E6%T$smld5XAiKdla*~E(xX$#(;8PTa(+M$;3G@rp;
zO>VWnK;RK&g_;Z$XOUb0w}><JJLu|oy%kZrJErEwBd<-t+l;nYVQ(C)MIc3fut@3F
z{WW@Ooi<sox7YD>O@!@5)yE&HxjSk$C==7OmdxQ1WrUifF~uPH?UZdxo8dtNIQz!3
z16gmwY&^}^)^^#Zs-@1uXm8$-A&Ml;dYM(1U!LCeoxQL*Ey+zBpClQ-q=flHil!<>
zi7jP3B3h_Px;P&#=C;?MY~NTMsZHr^JvpxeW#^ZC_I(8oZszLIZ*{vUU6je0zKVfE
z3ij8pCo$Tcr`ldYJdb_8YZcYt;mCm~pIaq?JfifUO#XcLP7IPM+h-dj7jId~jwEqD
z&37gGbriS`H_kZF_I_Gj05@}=D3ewgf4E9|YM@8%SxNLv)P~2Iuf1QTT|3z~3H{(%
z*>9yhqLgrx;w(YoI*TU<;3af(rUX3ll|M+9eJHd3uHW-nv_;Pcr-Wzvh%#B9xlp4m
z-3v*vDwTT~9eVY*tGYQ$->%<(OzUl3VnvKMk0>eBq*zN3e2z6HX!v{2O(WX7^WO`-
z-_O%I<Gbpa+|jFx7szP68xUo3{VAmrvtI1|npa#+E00Ng{A)G)ZqEohpxr^GpT)L#
z%_E|OniOjZivK!Adhw%Y(hfTH^rNL{TK3lZbz6e&9WJrnc(2<h(o>YlSMM#D*=Jvu
zY3#B7G)r||+pP~$7k`7*gk@_omF}n7eCH7*gqjp<2}--=V866>1FCsB=dwu*H>Pmf
z>Uad%>wCQ_^P@|h@+wg#0~X2Ia%QA)n)^=JD`1~ZSx$M)psOe;!sL&?tnslt$0H(z
zniOjZ`jGHBFY@c5X~FVajHX1Ku$nj7>3E;SwN<Y9pOr4P`4@{a`B`Ds?n`+O`r*Wq
z-IuGpzGm!}K6?Tw)%sql*lX$?#~vOLA=IQ;OVCx6Eh-DCWNl%3;mC>L`Seen+Y!26
zeOtA8wEmicSt392R;yA;P6o|y8oS`Ep@yd?YC`MlF$)j4Z7UnHd%d&fK2INx(xxUV
zkKbosRr=w|;XyftSl^O+FN1a$FTT~2O5*WIVH4N;7*fEWF8{F|ZK}Pg#ftha(R*J<
z5OaTQ(Z~q6*R^uWkKI*OPW$8kf~A%uIv`~coQ;%#Pm{pDOmmI3_e@0@=$Hq`CrZc{
VuUpY+#=ZPFXt>|`T2$G?e*uT81eX8+

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/pkcs11.txt
new file mode 100644
index 0000000000..67ce598fd3
--- /dev/null
+++ b/src/test/ssl/ssl/nss/client-revoked.crt__client-revoked.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/client-revoked.crt__client-revoked.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/client-revoked.pfx b/src/test/ssl/ssl/nss/client-revoked.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..2ab711880535eb3cec99c033365797487765f042
GIT binary patch
literal 3149
zcmV-T46^euf(%Il0Ru3C3=akgDuzgg_YDCD0ic2m00e>y{4jzG_%MP7uLcP!hDe6@
z4FLxRpn?XVFoFi00s#Opf(Dfa2`Yw2hW8Bt2LUh~1_~;MNQU<f0So~KFb)I=Y^ape
zX}iST0s;sCfPw~S1=#)iPzLB?Di6f2TZ<%3B<YIbE{jeJdsfQ%6)El9J;{|t46?yu
z*}_phVQWpUoLm6*y!lwd7waKfO@!GYbiYe?;ZUnErg6G%OR+qv=q`qtaiOhdd262k
zi1H~A(2^rUrm_-eU6{c*ls3e3;>8p)rM|xM@#2Lc)Z?)XrKX3Dmj10NiKJQM*upw5
z8Hh%s|NsAzvJ>1e_M{DIf_brPO-+=trP^=8rB9o*aUPJXma?LXQZA@UpGO#ZD~Sw=
zKI};c)(sgEU|q0e8rU2S5JNU=wCX0CV9^9Kpapf9z&>bRw=FF$k5a7ka3p*!s9@1L
zo`YoMf=K=ydZ((=n(%-%5%nMkZ?$v{DA01Ctw9_p*Ivv()Yb#kI;UP{A(gezW6aOF
z+U^@)PCs@>k!L{~SncOm*le}XxF#!2#bA}V`Z#-`F#G(Hf`Wr{s~*4vFs#OyOFU^P
zgAR_LfR?J5F){^=eQ`3p4OR$H#M%%cvvg<^ek(3XLEEz8p#^|Fe7Suv*z&WoJmouF
z?Gc4p##+MC=7!hr64!*^A4zDy!HAhwWFtA*CoJyHS(iDCo;2N-F6HBXSR9`Y(s$BG
zj^f#^Mt+HdUM&r;x&&i8O+?+$ky|%ui5+$z993~;!&|W>r*`>j>dCn^@IYudf0*#M
zz|BkDoL7cH7`#}JfLp=3Gu0abhO%%V{8I1xUDks?HG~o!S)%Fu9AER|ymyDXhiK0Z
zTCNv&i(Z(7b6<Z=xR}l0aNEB|t752ol4Iub3FGWz?Q48MW@xJtAwT_VdJqK-$zF)s
zZ)7<cd70YX4ABR=T}LcxVK+NCKk;Vp*3~q*B9>i)O#%pSh8Z=O^*Q5-ZSWmxYb>WC
zZml|^CZQ9AxugM$8Isu1C#M*beH3=tKSGT=(L2rXC#_icKP%!Ce(U(N$kRjW{S+Br
z-f4}}^$CigZg(P&<~V%ZPqo@UX>bmhPlLwlH1|4$rtCvZ4Yyv1M%qPsjb~eV#6b5*
zj{RaHS5pLx*yUt6(YA4J)tZHRaVN@(qP1IiFealHrhilm4<sRu0_J_j@e6{e@?S?i
zFa*MxmUNX^0lhdQ8rsRObQx0r8{1XoJ7|!rZXwV*|C|P20Y)8@vNN1uFruJ@rQq4?
z5@uq`SidwZ7o_>b#kD!$BCQ>L8wKfwh3ea=p4Ox|UOjF>ER)mYDAqQC!as|E+*Z<$
z?5paC)2Ymsz8xY1>eSOm|DD+LWRnH!9Vd*a1=|Su<iSKv;VL%O*w&<Z)*gf2V3e#S
zP?GTlXHBdC##{bImuO;7mc?;3(%CQLt|0{=Up=Ct2^xtu5dM}M-Za$bf?LtQ!CeI)
zN`(Z<<F#{fWB#Qkyga<tTS7?vif$r6)H3eraC_hAH&d<Ko-x~9vo-lpT%z?W*lrM4
zgM1ZHE6_OB#Kt!&t4y%5#?Re1!lPmg6b#VqDT2%L-!#qzVIGF4qIisp;3#msW11K<
z)UEC@--?oNEy{m4@AM||<3iS?Y9lL{LrQomdZwk^Eo$~Fps=j+z`=m|B1PH<?e1Zs
z`zi3izK0GH14jT`FhG%Eq;PnEU>)&LG`WjU0imaU+Zw|*6^uBk-A!^#7|V_>%k1U>
zP}jPDkD6>PK$|GKWdru~tu-c;PC}C|rxf2qw8qHWr90>vggkz-qB!k73q;w_<P}Es
z`ulGUr;%TNI=r;S;>qQ^rjAs1Ib6KEM48<(&`k_&f@Z{HzdQ(j{y3g%WLT-C1(-uM
zXDx{cf<Uap+bNa-D`sl3C=5Tj^BJlF%Zvaat~3|uj2PJ`8ChM*3N-WPJCuo_LxeB;
zPciMxw02f8C}+sN`9@^@ESx(H1s5*mb4@KBw36V$55erM$B*Suo-6EP=gKM?L4eoa
z<SfPV(Uh$u9IfC)X)<T_7@0@3;UhN*&Mt5VHvN9>nNus98g`B7ypCNOv(`mrx$OFv
z&pQPoxtCj1<c(T!mc>&5e}+v2XJjrmGiF)BN3XoXaE;lJ{!fW+y?cQ^q@P?z*{f0)
z#}1%i7iY+6*48{z8nUsBvY>Qwhb8TS(_@3;b&z>4w{Qwy`DyqUj0iORoa>}E&T{J&
z4nYe6IH_9ZWp<&IavmK>e%2oAN|i!XmY+5zR@L#_I6hb5ot$X&FoFd^1_>&LNQU<f
z0S5t~f(0@Jf(0%xf(0rtf(0f93o3?4hW8Bt3<?1Ppn?SMFoFc?FdPO7Duzgg_YDCI
z0Ru1&1PFz4wH1I|O=bcD2ml0v1jv3W*7(XsDg`K7N5p0he?8TL6<@O_oSY=w+j%cP
zI${RUx{#V93K7V@WRQ4-zl$wnUdb=uTiovM0N_>$m^<(cwGYsQ2s|^DH`xb0bD^D)
z!TY0aCbp)j2M8cH@R}yCQUaXMF`UCposg|pJECO{L`_3PvNkZ|`zNs#e`&nFVhm{K
zguy&ymGUC836RS(GvBD_WvApWJ`VX>vz7~Y8<dExx?y*c>bm(DaP^FuA_jgL)4A(#
zG=e$y=6W6xs|Yr_3(oFC$A*cYG}WKKccJXUtSbH~Od8wqdg}Mz6)=*b*kj7)eu&m`
z>n~m~)+AV%ZVpdtfe^dVNYkNk&jTK}FexyYXbMux+#MYK^Gf>!i40XGeJtHEan8^m
z8)~TdXAyCWJU8=ZZkL}uffb;+7Zr!WvBarp;k}-6%}IFd*F$EFwkusV6&vC)J_-y<
z5tmiXBs8PbteJqnmD&Id)FWPK8F?0t<#0Q;`@$(_3o#;Tut4gAGzCYXf{v>u)in_*
zm`BBbTkDSCfjxjQo1YsghVW1uc!?b3Cqk1tpYt`Jx?MM2wLDS=R(yW{@%ft=m`mVP
z*bP~4BU6nljz!LQ#TBj8$mX>)v>fCLN!Hwc1a)>@fOdBS@vizq2R&H*Q7E0yH72uM
zXa&_u=`oBFW4sQdRavg<@UN&6i;@lWlVww?^Mc!`Dkm*zO@}Nk6U*(CP8-uU)}zj#
zyN$8OX6P`tC!@4;RFxA{5AB(goVK=f#~Q|J<0(`3DN-(WADoQOAGO=>kk*0jYhKJl
zaR;Atq{UDDp;xW~%<yHZVdz!aqgFx%fE$FM>Qw`K-V^w9ZK+~zYp<)$9I!v+wN-C@
zIe`>|1+HKeAyJzU1Tk(}<&GXyunilpab)bYC4UV^)Hz0_J*4TYvv@DbM(w&}S@xe~
zL16JK8KsymZ=ZlVdMaL4`NWu~B}unol|Y|QcQ6-t6#`*eynmPcz>^FzK1ddna2#!l
z%HFCq`+2A}SC|~1v4-E?ICdZ?R8k~yn=*yY3q&>05r(Tv7Nq%P77ij3=(zG8Ol_GZ
z{lAw#(Q^BNJR^b4_NkSsW2dKF3x{Z{h?olJ{gh#Rdk@*nK0fLX$|EU8es@5E*R+}8
zD67NTx&trLTL8hr{w{kTqL?fOU)tukBh5<L7m60OPGXlh^}1L^uuL__xcSc}O64Va
zht(+>pCSs=Fu=O>6oNF@+SKv&2Xy{Oa`vvvFRCH82Qf^9&#DQQ{W#F#v%t`&R0v>C
zI4pD>!p`Jy6Y~1^YLxpyh2-4&boYXz{>RKHR0<#`B1>VM{$QDn5t|@~wn{QFS$z!Q
zZ@1enHkC~XzJx}J80+em0YPa7;aLFL4qs}V_+`8JWuv-}L*dXr9F(W<(w*-V9v=uA
zn%k5~B3Qsy8MuRa71HK5YEwpQ0Gq=A8WD8&GNRQ969<lHZxm`__XL%BdvU;eH7cXs
z7@Jx)Cy|$yvGiLDjB~*P40f;jZ`9@+MkJsXc0jjhZv!!2U|)rDBD^wW80B_ibUT$4
z7!|_Y%7(;E^9&S={mgUPN%58L7YADodU9VIX`K^*bS{fmG|fO52Pzo}9DXFDJk~KK
zFe3&DDuzgg_YDCF6)_eB6subt5E}$LUeicrpJ6?jnETg%MKCciAutIB1uG5%0vZJX
n1QZ+K0?v})p)BXJiv|Wvf9AQTG&BSVp*~EGPZ3d`0s;sCDh<3g

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client.crl b/src/test/ssl/ssl/nss/client.crl
new file mode 100644
index 0000000000000000000000000000000000000000..ec061fd17bd11aad4eea2cb4980cdd9620be5f9e
GIT binary patch
literal 418
zcmXqLVw`8t*lxhf#;Mij(e|B}k&&B~!NAGT!N87<Ih2K&$2=spxJ1F(Q6VkANFgA<
zxFo$OH8{{mAvoAap(qu|DK5^;&r>J?sY=etOw9vQsYNBl;=G0yhK5GwhQ=larlwKi
zye4J_CWa<Zu7QYw5ECO4nj$o3FgGzWGQ=5uWWFNvib1cOm7QIfWA#LK*3-R$b#Zr+
zQzt9Of9Pf2QgXg#^7|Q#`?^;~od5q&E_3mbwX*KnbDH;uHx}8yc;&n*Cg`u>*0_IV
z2Y54&+qGrPUC4dt$>ZO*)%q{4x14vAo8!GyW3<{9)zs`N>D*O<h4!Wm&zYD%)*XAW
z?8h?G^mEIM=O3^Yk(m1JZpp$KRu`9gue$prUuR!%Rb1VVhy91s9M8Qw^)xx^n<TUM
zv3Uho7B_OK8=h5cdh)~l<(Z{@Hw(mAHc$Slv&lrgXD46g|EyT1`^j4q@6F3L%d)b)
nrK%&VUs_%AV!{6+)9&7a`}PORtmIRl{k+g!;Q6Fz-w|N|QYfe5

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db.pass b/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db.pass
new file mode 100644
index 0000000000..3ac5759692
--- /dev/null
+++ b/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db.pass
@@ -0,0 +1 @@
+dUmmyP^#+
diff --git a/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/cert9.db b/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..2a50e21d0e379f2b24547cf52127b06329c6bd67
GIT binary patch
literal 36864
zcmeI530M=?+Q(<I5tc9rD2NIXQ4mlk8$>{55fF?J7Ex5h5F!RyEJ+ZoqC^yzRs=6D
z7cBx>s9@oO2yRu{Vyoh{E?Bivu~^Gh3W`;6t9Q;MY}S5WAL)1d+@6t{yk~j;=bT?=
zUNdKAl8_*gTq$EOOiYTGDA_#32tiTAoy|rNM2}c?iM4y769%n2LA;`U?B6r>knyhf
zSXdXr&}&8XA7J(R75cII_Cx|MkN_kA2|xmn03-kjKmw4!A4tHR!7wwkLc`?=(Xtfj
zVu?IDL7@<<qT=LI9j{<-k5F&6U%*uF*=(|m9T>pwDQDYBI5>CgWICxZlT?V4M9JcM
zYB2gKkY%qb@WxK1G0cWpp%J9NLKPJ&lPY@@==~J5rLSsmaL!l{D#L7O_c-JVg-Vvx
zBSPyZqA7e;L&zDM8HnnbSy`c*;+2x9I9ZQ-k3rGugnD?2y!&#HN3+Gjelt9R!`ail
z!`U+f{DNkBgBH931AIh&UZHFc&%oeNN45kfRt~XpiIoRzG6UprK$Z|Bg&-*;lc0)_
z4>kg@aRM7>un~gIM6i*7O%$=2NJ`<FEvbkD4Gykp2dHpxAj83d4hIK992_Wda3ICO
zfffe`VjNrww%YD#`bR2rH8!ctC6&3PGM7~5lFD3CnM*2jNo5}C%Oibxq%V*3<&nNl
zWT_Kb>O_`0k)=+WQc~H8RCXq7l9V_kCN4Q%E)IOT<aoJcpLt|HkId(h`Ft{mPv-Eo
zIiM9j4qD-pWcVZ*KB><q_4(xcARv7Oq_2SV6_8X3O&sTPK;v2y^j-*Zak8>hCgAaT
z0#HF~f(lv_w5~Nl7qliAt=0rX)|!B*)&y8JCdo%@_PUXzw7I=*PJP_KTcWAp+}j7|
z?mjs6_Lnfb`%9SJbqTXi-R_2o-0uDoW_QDc+1)T<b~j9zU{?cuAWX2oX-%-xY0c<f
zQ`T!P>@mrmMpHMcw>wdwJJA9O9vy|_V>uLtnYR^+XhO?-al{#Yq(r4mB-4>S$8{v9
z$D|UWmI=ZwIH^amXTa3eyZ{p}kN_kA2|xmn03-kjKmw2eBmfCO0+0YC@V`TV$p9Dm
zb+FG7tPAVFZevZ@CF~55gbO492|xmn03-kjKmw2eBmfCO0+0YC015o52r#KM)W&DX
zFdfpEvhE^7Yn-Q(hHJi%rZt?Xq~To2rRY#;x;D<0IC=hWI1MqJhK)9CGR!rcfz@E~
zf2sk(&Oic?03-kjKmw2eBmfCO0+0YC015nw2+*hqs^d#bH$riD&Scz;L7hpX8VEvV
z3MD%!F;U6(@&FH+v&D%DWlWMRBuK;#2@$cAWJE%tkS8Xvm7uCZMclj27$6<`0O`;M
zNQdf2OE*PvPmVi2S;NPf<ny1Qk;cho2}-t9mZVfrrV&cI1EHk3{_l!lH?Yl^7j_Gq
zhUH?ef1(`=b_EiE1Rw!O01|)%AOT1K5`Y9C0Z0H6`0o<Xp&FxmkvTeG>SMsBEPxno
zz~%|4K#nqu>ZXei;h5sanpp>Zg(42jwx|@cB+dE%UWB;szZz>No&adT_G5ehyI^7K
zkN_kA2|xmn03-kjKmw2eBmfCO0+7I8l0f%NgZ7m%go>l!rV0n*1U^}o6e*RAmnJFc
z+G5%u>KIgWw}7^Usx6@mqT1;aC;t;PrNBvZ{=W&qTCjSo7%RhCu}#?Nza(WiXh;AO
zfCL}`NB|Om1Rw!O01|)%AOT3=|A~M(m5;iY+`sDenO>?W4Al{Qbh?hQ>5RAL9s^Ly
zC=&&GdDstb^QL@phgtICy$_@cI(gFoC=E^Iw46$92#}xr`Q#^bO3?M-&yqFw0GLtv
zy024a5hG(D-iU#<{xHS``dKuBNWAT$9?V!qGc`0c29D`Q!ngD{e9QU>VoEH)$&l}e
z*brZN@Xrvh5ELP9#(4LKPbj8FOf%cAyf5}N&hWSUyExA6tHyv3lxQKi?}|*fTPXj2
zbxq<fpQhlYHQC3xcjZH4Y)d|lZRcd4+`r0amcYzwT|9j`;DRF`h!NBNVA75FZyxsB
zlj*BTkU3AJi63<Q?PL+Irdr}^3S&2wf>K^TW}L;)wO>1J?PC^->eG>TM~hpUv522D
z;c%TfJmQB)_;buyd?%dG;cJrv(1IGZ?%QpYj!@MohTv*ckD?|(99(|6a|3P1duq4w
zPU^#Lo0uloZ%jM*OG<Kc4C6i4yr%85icpKMa^=olpC1vFKAU=A{o^K!ycG`;^C_aG
zu97t}#xB>c=lYRupL`-8DS2vh>9%>6-REWEwn}H+Q7J*XTc)0CGp|V8uUfPIDJ{_b
z$NWqmE7#ci^d(HZcFmo6ThG3jFFd#D!wvN>+N$cREXMdT7T@DWmp!iAo>e;S;vse8
z_A~>BD%7Rk%6~Chxw19W#?y;8xiDga=Uj)wv!5S6y=a%o7nxU^oA0Ggv>ViM*?I>f
z2DRbYn*Z(S32Is4lL>_t6O3hN4{!JNd9uBBx!v$O&**~d%t!A>xyH=DsVbsSQ3NeA
z!VPf);$EN;CNw%uMbVdinGtU_!3;&F<F1sg?e;52Zyx{49oqC82WxKFT#Y&15|bHo
z)FHO@U-7xCPTgDIRCpoJafPwio%88qiy?|}ZS)s=%^p=O@Q=^pDJ-(m&ODgey5OsH
zi^d@~6*Fryzi-J3tDaiAM^u_2^swH0bV-r_nfk5{Rq>;ZE;}>w^ery8E?FCSzT$bZ
z)0dBU8@E`tEjs2_GJ&R7^WyM#mhb;?O0V8L?uz->>TxFHE5lOPJYQAyST!zx7SsFb
zj`DEPm9+;QU(RPuEIeej@Yw@i_N~OD*{wUTowrGyr`Df6d{udr{m92%CmhYj)a4h<
z@XZP<tIcRmxBdQ!Zpsb2kQ96mqH11h)IOiSirNH@q<7yVf9KG8_h;l@^Zx*<rqKGv
zVKN-|4G3?r-#*&(i^Ieh%?xB5Mk&7yx-ZNkF#GxL`(8fWM0FIpJa5TLn`F(cC>hZZ
zJ0g0^p0!c3Wh>VCP|2V>2Kit-2)cbKq?`WnLDx0kiQr5eK>eoRiFnH*qR>N4yhSOm
z9C7cyqrDPb1^t7oV9r21EJzIC{|>K5ezNR5#7bLLKB}?kFeX2FI{qJ5ZpLhMmE~Jv
zxw5SrIvt|sCEYa|nN}T<#k_u7I!<WcXdfP@oRD+L_m1x0+P`h3pSSh-v98@VI)3#A
z>xu(wzKc)%bulLV#-j0Jp5EXxTiuTyRL>bw`KwM`;ogVUlSHD2pS~=P^qgu&_4?uL
z+}re0WRT9tlcn>lVlOE6oHL2&*k-JZoO@y0l;lH`_bgj>U+gNpj=tPX+cgsLjSveX
z7P#kC1(i~^wHYl*s7uaMj_kTTiT+ZwGy6=EDyD9mZ0?SxwzN8trStqJ){@fU`|g_O
zOvsn!TMo5f9P==AljI*C(`-Fd>LcFHwxji5yhV7mtjg?M^0cYuy9j=u>*5Z|BD<B;
z3A1DT<G*iTzbngo@7QNM>ReXWHq>2D)1Nr@0(FL2@hHTc;(6CbI{kF~)9qJo<t;0`
zwQpq^tJH7J1>rhYt6<Ch4~>PpzxtUO@bQ<qo~f-mV|SZKToI|z#yeA;P?>$TMAa<5
zY+`In$*oSy-D!ub^%~pPNQQWooSFVCjZwXsVjWxV<MkwV&gRv%e&Vx=I6>sK;yh`l
zm4Cb83fIFfh8xO`Q;vLm$2VsG`SObiSA3<D#O6+e3PLYT*|>FgqNs6e8}-pylbC%;
z2Sz=)kV1)KmY*Em8GEnjez<>^rQ<2Fw3>CInp$IU%+nLZqIcixi4QLWv17mPb2F-@
zQTjwv)4p-!4S|#_e#dA^d`VYtG#!XXhEepl@sx3`T~*Ii+dcQ4Qd*bF?P!n;ay#|4
zUNzQo^dL>`GNROV&ehDh==<P9tR1q^k%*`LIJo`s;gtA}G6E+NPWxZCBtE+~5aH+m
z1w~&Cr2_!#jluMH?xucYfIP5q_xOU&6YjL*HsR*=?%7ub4Py?OhGhvoB$jN0Vl==g
z-TJ1(tw&RHynh;#vdwPkxH!ja^nI63B<9Ut<iZ#k7O6OQ>tv#1!k1sZObV!IS;{<J
zG*Oq?m{Y_WsZw7%>A!Hl+NF$}8YtdDH~!-05W^2=ya*5GM0xy}v2~o4`>x|#+8ah?
z9H{a4vdIbiv>;_$agMsfp~Av!-tt;u1@F$JnsWKX!FeuLPZzPXQrDMfbPhV|U%8M|
z?zU@BL}{(>+_O$GpG;k=4C7DPZ?Nd+^INy99G<3ck`gQ&mauyL`d>P;gIbQ@LErws
zb6m<P*t~JdtWoky`*@S*{?j_d;`{?C86aPI!^lsY!`ZQMtwY;<hq7*;maHz=P=j|A
zN11+o_fSEzjxy)st?clO!m13s%YIb(6IGRRsWBzuK6khM&RM}Chvd(`o&4zx;rpY*
zY$%;8_hEti2j}O}<z=z}R@%X25z}!eX5x~2?rGuj=HlI#X2<fj(h5?pP)-$vcBn#X
zzaH`Q+&B9_^3^+L=*D;~j~1V)ohfT6UiZzcIaSA*<8tbr^V$W@$(<*{(^<ifWG2x^
zER~F;pmn2<JueX#@4K6$mL5Ab>6h{HisBWwetKN){4LA9Ayl!dV8NKb$KBi(wA;^_
z>%O4Q)Y7V?tE$;FqEN?gW1HA?L;kEvUZJawL&9ByU$KKAWDG<k1INSf?3}MV{YSz1
zKWaD~A^zY32|xmn03-kjKmw2eBmfCO0+0YC015mj1Xgo(dgsgfI+z;s5kul1alMwf
yMr@p6fV?`FMwaz;d21Vd13uwIA+G`hZ{lL`YfpHIX)sVm{QcGEVu&k&2>Nf=830=V

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/key4.db b/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..3884ab59f5568f08e5c65bd753fe7a24c4bb2ae7
GIT binary patch
literal 45056
zcmeI52|SeB|Ho&{3}&}w$u^8M5zUTJmXH!6LRXrxge+wUm#YR*NS2~Yix#0vC`y|a
zq@<`T+7zWoCEC<&@tYZ3x9+_&^ZNZ?|JUnxf4?)!neUwMIp6a+@AJ%gp7T5}9@nJ~
zL6QE1fbfV=RwRK2k%2&=5DNkU0)e0>-n<XNLz0)mCv5%)^bhvmnP`Zi=`a@m0V0hu
zgP@1-4d^m73$2N|hcZJQ{<}&b9}oZp00BS%5C8-K0YKnClR$`+l#;qSl&c@fVu$#L
z`bV-Bup(KLpVHPYHkQk52+J(39Bc@axdc*>AHmtheu<@vCt<OTC&A6peyN)c!O4+e
z?c`|dU~j#Q;9}$KU}<eLo4`9V4W*2KP-o4NmQ=D<heCqF{QP4$>q2-=A68UkxZu0b
zWPBgWq=mGSlvGmEg02u0@Lj_S@(bf|oFjtPvm*VaCdAo0F0k<+2%LNgQw0bl7KKcm
zWq}aHST2YW!eaY}Ocjy*CWgTIrx>(Zws1)$RV}E`xa=r)u)lBQR1Cy7F*xJyKSiOC
zDYL9$l1eI*y$RxQqWmMK!oa@?Gw%IU6l2P)R2Qg}l9m=UGh8raQvs$diHT6-!#0&K
z&cIn(Ik_yGO<<9EZ{E1EsJu6gZwoT`ITU`DG5@PE|Esa!E5C>_ou4rH36q}~@e^Zy
zV!}^Y{DjR*Oa!6G<EbDbnID5f9&d*qg+k_sp^*7;C}e&h3Yi~?Lgt5}komDFWPUIT
z*_WSA$Q#!uh)f-~1(B(O$W%dOsvt5|5Sc27Ocg|?3L?`4b!mdSG(laOpe{{NmnrZv
z1zx7W%M^H-<6c2zrXaGBprn8jMSzJa=r5JbuS*s5mnzUq6Xeqb`7}X3U64Z;<j^N_
z_^r^%{8s1!GIRkMx*$GX5T7m>2Zo?7Lr|9?sLK#g<;5hEsT6+W6DD81F+Z0qDD3Oc
zpwVdzet`*-Utq%Iw?1L=B}|z7-cFeOE>D<zq7x<`>$oZ4Ght3u6Ofw7ovOzCLpA=8
zj2AGP(qJ^HfjOm@XHM$nnUiIC<{!#VHq6VN)XOs`8|Iml4fD*&hIuA`Q{!vknf&c-
z!sKss6Q<vk=|5!#{B8<1n(?yiDLHJu96tt&?8hdPXVD}imF%?sZepDJ1^ZB@Y#48k
zBF*2cV0mw-WF&<50uMj{5C8-K0YKpYl|U{M%9VgC;Bchxn^7>M;~=~z4hMnY<m8eu
z5V;h!<mr>o$>Kaezu5obk&Mx?Rh-TX0E0p~oRB%bAwm9Ok%qnzg54llk)lABlZ3g!
zVHh;e9qG@BjN<r5Sd@<3v93qOI=Dln7<*bSNM>HOf$|@aVu%;-Rg+$1xbO9O3-~!5
zPvs_y>^qEB-IEIL+l(z)8U#!U)KP}3-K*dCenE~+ziv!EDcT@p_Fcr`j`QJ#9)WWu
zwcLF;ZGD%*XNNU5jzu_DJ&u-cIbed6zLj$Ts}+@a_tK((ip06))L19ypAm8my^6T4
zOTKuzP}r7FlJg8SEq0&F9cm>e*PK{nt&`(^WM52vNlxM`{i^9oKg8D=SJ4K|PgDk(
zOe>tL`CA}iTkMv~<kzxi799<sRGRHR=>1Eb-HL0>)nyA(BHiipD=>jCZ{+1}P)k6|
z$G8})h9zy;^7eK1(#NOCOS>M?W=B)@Wu?zwP7LZeOq;jjy0+`|8*hA}5GXkjnoJIp
zMCzq1Oc}*O5m+*dY&G>2LuSAU>peeo#N{3+Ui`48?r5sv9qeF9%sOA&&=+Z~uMg&B
z4N6GNl#zfE$S6ta@h}odvZ^F<RmwuBKMW4lgX7Te-<K6Sy-|7g?A$$y7d#OvW1arW
zGDvCNXs6<f&l0($kx|e3Si^1mN31JOaSh9{jl@Xo@oO%>U<_}yH5Fk?TS{uHx^JBi
zQQwgfc<VU+R<8|t?C3+Q0B@RdH^%r%a8+zSR6p)&SIOm$pFVeO+!S_`c_Bo16Wr@@
z+)6!Ci_^_+^~^hN_T3s4aLSb(9_vD-hMT-}R|VBcbD5~61y1U|d(1hbDEqf6UN?{q
zubnOvyo*cUI)#L$-H3gC<Un~U?Z?qP`=E%y_%#x*&v<E9QQ9}(IGIt%h`GN}S1rcl
zQb)kTkxo+f8Q+q#5|C@#Gd)f=*7#ZEM5)*pLaxu=+2-yTJuFfEs$k^nNVW2vdt>IB
z@}8G*bK%L(sqZVF%I5RN0VZl3E^!mS%sb~s8(`tK+>c9C^*p(JhTgOXp6tlR{m*9Z
z7!o}WgO0u{Jx(Q8#O(=i&m4qvv)Jv{r*dF4Y+1o<qq|{y4yER2%`~juw{`=H+!Fde
zsr#Zs*NeiG`XLY9Sudt<)w&F`*)OMi*u@^BEu%8}#N_w}=V`Anxt$pao6JV84dxZw
zt-W$KuDIb>xJUTuU=t6+l_y&a<rrO<XMP>?QxDMYs=hk-(5qJ~FYf7Sc2&8m`bgc`
z?74)B_JY?vqp;N49C0ud&tUb(TCr(PH^U@nY44_PTeSC<=IM(c=~=<`RX3!Li^gDh
zHkJCo>&ceDh-EZpI}gKVi{hu5v@Z%aOJZwxCRTHNb4>f^?CN4<4B>}A5f+=<A6}%}
zRCl#bjXaR$xQJ9j+P~1VC_Q{;?y-VuLcPA;F01Cs#q;O*u&2v2vIrVZCQ5tSJ27tM
zstGSuwi~p5>^$bY=HtUNCw{|w%`+V^(yfy73o=rDu~VPARBBr3CF?Ea%GCoJ`(KTP
zS8-Qr#G}Q*;0jF&X&b%T;@3~nc`u{LZik`L&zQMzhH?(3qRExbqA^Gfb840czm{Lq
z?~;5apNApi`JmYvi;9YuClk)!F<W=O9CJCigVr?jXe@k{G;(L&d(T8g`-N#=rXSWn
ztb^SMn=j|RHQug!Sz%Ob6#Dup$IZv8JFw}sS}SF@j4nL9;?>hHD;GQnbSbHqcMCVW
zvc4vG8F!?t%xmSFhKzf+(pN>LWHsh(s2K9vzwoBlRrz1ASJQ)sKB;97h3z-?T9&cs
zlQ<YUnl~~nd^9eveWb}`oG;i2>DGQev&ofo<7Qq>s~N0IG=^ZC&KwJ-337w;$j{+a
z9)<$HLB&JM8gT_{8;<*4QI{{+9#~=L6{u{e`Ly)K42<@*=oxUMGb^MrX3j@$w|~;*
z<%L)~yzA#Ag@gJlkKd&`xNK@4{*csosHfm3qv76nm}BRcMU*SKHs|Si&U){vkG$2a
z)v5Y)_B1zJms-c&T2ds<Yp*l1G{)A(e~?O2|M7HvuiK`T`wHi(eJs0TO7blb2g7Nt
zwQ!?R3q9G?M2*|WdVg`gcwmP9s_4R#Pq$w+<>K{3W2i83Z83=TXxpk@%JJmS4Sr(}
zkC^J}2QSE<;d(Xa9jxO_s(j_4`u2uX^!N+$ORt2>rPp6=&7)tX6xN#SY+zsBUteqa
zmejNu(R8oj<*vjNtrs5*P^}uba*Q1}lnwNxDW^WLzi(p5gi(SDTbo^3i7fBa&o@5V
zrO478s7Bx2dt}QTs|Ug7`YS#__7fQ<HuAv=`u?Pprul(8*X+-|#J_$G{a@c@qxcYb
z*XMaJ@Bjn=0YCr{00aO5KmZT`1ONd*01yBK0D=E90#YzIl79(geEt6!g8%$q)<Mu6
zKmZT`1ONd*01yBK00BS%5C8-K0YCr{5D<XDAjt9ce;)+j2cQ4~fB+x>2mk_r03ZMe
z00MvjAOHve0)W6jnSd(H4Ec9|(m1~UAA;bA{>eQA+5rJT01yBK00BS%5C8-K0YCr{
z00aO5Kwyf1ER2Nw_TL?ium1-i_<^ZXzybsS0YCr{00aO5KmZT`1ONd*01yBK0D*rd
z0VNn6`B(qG7{Tif6#t3eDfIZqKeK;8H6Q>800MvjAOHve0)PM@00;mAfB+x>2>cxZ
zlnnp+KLKM3!N0}N#jE0v<74o*@cDR891CZK>&ETHea6+}HexqpgK%){B^(j^1Y3gf
z!kA+6F|k-YW(4yqrWU&xYw&k1fP6pz5C8-K0YCr{00aO5KmZW<uOOfSvxIVjR{Qw+
zM@0Hi>2xNANn!hp-xZ!p)fVa|YpKKL3u>?NkDaW{`n|G-FfUnMn3t(0%*#*}=A};;
z=B23!^BOA)^BO6Ahl3ViZ0twlu@l@J-b7KT+jyEVH=Cg#%*|lS3v;vSa>CpUmaH&0
zlPvSSn{5(6Gyc6}c%g1%oG>?=ffeRvurb2iY&u$)o54Z}b2G`v@7+dhDvkPk$E1b2
zjirRS*$hcxZU!46%+035g}E6lm@qe!EP;lpBiFJxoapcfKP+!5l0oc-;Fsg7acHbR
z<{U-^%|Ts5%|vpg?@2SHwn;vdv_|ZPkHVM2et{t*e4r<x3Xt%Bdj>-o{@YbSML+-$
z00jPL2ylrq2+KqT$RCcfzBz7SlF3{y*?a2t>Nv9VpYFDv?y&r;%14AH<aWxwk9Db+
zZrm+dL^MpSNj*fUcY0^J^RMpY`-eNP!wD$jW|r4UlG#evuRE{TE<Nq&aMI$}5GthU
z`lrRMDntaAi2swyZw~^*P+1daethQ4uQL|<+v=C)lJ?hl_q073yZk|6b+qp5R;Hpz
zl_Z%!^!jD*tUWoE+rwSxMcU>&kdJ08o^~nz+*Yq4)vsJ4PPj^AF;v3i0yeca6LQ;L
zT~wg1ib?Tau57lOW3>5F+WYdf1lUuNDtA_RuSr&~V3fdXQA^JpEt4L$pP%im%Q;#a
z=UJYoN#qi-LRGREVyM)CC*2BMqh5D><y<&*Z@@vd7sK64rmr7erRK?!?zn$eq)N5T
zsP-Y5lwVy-qiZ#H96d3|&ii%5-r3t8sx&=1Jmbh(E)gSCC4()7O4GOKqlJbajLuxK
zo32(^9iJOrR82a$uekMV3u0kpI$Wg6i;CJ8_wHOg>t#D#S<>yuj2f-<m@k{oBsSG%
zALp7cOXU*LLRGTqVyJwubcn=>NJuzkWEuYB8!c6@oU?<a_@Yn?y^k{a;T^|Bs+5k1
zJ#_((c7EaRro81-=Z&c3mXPF4E{7`bedyWqj3Lh@qJ*ksu*6V#EJU3|J*=^%e#yC4
zH+D#e8o%ss%v8$EH+vho>)!IvRFNt<5B8$2S`J%z$&4htwJ$P$5t?=Pns!tgM!qE{
z&M0Y&OGFA)Db`G6+>>+#UyQ9pyGBTPFRVXqozP>xTK8qI`YTC^H3PD4B2_9;_UEfT
zm{X;{_UXgKq$_8NPbRu6#IyZkSf*`7a(f<giPC>k`R!4=7%bz*5Fei#s$WRTk$h9@
zV0AD)%;Jhtdk&uD+%?eCRD>3(@<51M6I*^^!>gio&QJD{D=)5>z~XjV%RNLt+3+bD
zrOzcw30Eo3Oq6Lu&hWhd@KOJTB2|T*?@#o#U9QorN%mmf)^73tDPmBh%F&gll(1Ds
z^5wFwTee;+@(N3}z4OB{^`B1YlW*@>v3CWRC@EB>SToVbl-fN88T9*H39>?VWtpwr
zZQBQQZU2e{Rl3T;1x0-#RpziYD?%-CnZxmOHfDNS$%QM`($#D~_Iyp){4V8dZxfe@
z5UNtFnaC_M%_Lqb$81IH56laJKQ>5EN>|>MTrE2?&1>CAu{~X+%IzJvXN?L&Po95>
zb6!qwA$n&Szy?)Ke`%`k_AEQReIb_!7phXMndsr7H?=Q@hf<;kjb`t_DgVk){t%1O
zt}1D)59pCq_OB7CGTZZY-@HQ^e#ld8cn3S#Kq|Fwjb`;~L^Je?=Pa!O4wncMs#2_(
zsD1XOAA4UNJ24s+wEmO*<0bZWRe{Vil`~yFM5R$kXMYx{a*OtM8RELbacb&uZ|!~N
zw|T`PGM|!+_EAwct;^4)XLE@XLRE@26FoRXy3$A2D!S%OU#i%5Y=(Ql&nA0}eOygL
zoT!>}zm$qpiR`U&T%Vp;wcvK^I+Gq{d0YVJ>}ieLWmdf#x*HG~a$H>~LY<zdIJwMj
z*7#_YW)5{K?z9TI74~6B$6O0T<|dNErjFgPWY(XK-Q)~!-A{`+4}ql4SC)IB_4b8a
zT|wv%&r3>vLhkz9(;xL$I#nf+t5Oz1{b6vZ9vqi7Um?@PCu7LQ^dMIH9bBgI&W>p8
z(1Mo8<z@RyYb$q-um4LS=y((vnI_#QJx^+<<Qqvx{0iK0oGdm3(~QwZl%hKSXO6i+
zM*#sq01)^OBfuqUeZSlL_JWHzrvh@PJ@yLUR&-apWl6FDZN^1gW>VFcRJ-ZF9W=@K
z93Lur`Ks}2n!Dv*?$&1oZls2&aF2bKK@#^1_Z9xUVfx}=t;Y>qZDqv#i4zuobzw)G
zBU|n0<f8_-#j#iS=&c$g=slGk-aAL8>2j#0m-Ru1IQ4?R+UI?9zQQi&YD;n$vFF9v
znCkRr0W(Jp5s!4-+r3oXVms?@?taD9RuU@GNQ^}S?$WWXTiD0)R*#UKb{Vc>bjC&g
zQl)C)U%mxDL^|&%CsO1xY|Y+zWdY3xkIm__y7)x#NuS+l+wpBlrkppp7@Yz-m#Fyt
zcz<*1hhZXy%Aaf+{o^j}z22gm%PDm@68s27J^w`3rtIvgyXzi*on0wXWmeGMo(=vf
zCk^_w6Hc_d1}!0mJR+}MY`_kkg|qwgn+umXO}I*N2Ar#`(Hs!Ft+ao(&&XlfB3iWW
z3adAxgyskNA-!FjM<0q*>AFbSvQ3k$D;sw%tG}&}`24mq%`mPjqFG{*B-helGnc3!
zRHax;ne6m2^%?9{^{kN|<8q~+Rv%S97agUL<Tuvw+tGQwc^M*A`p7SMlg%Vnc6=Qh
zycXR!w7{Q)YslD!E>WHP=#=#x9WGH`s7kSxGMUdzq~u&KX9v%M7Mws(^jD;YT(18i
zdeA$h^fN{4dXPw!Uu7Izhl@|XKjdnwWV;~afhhyo;Q6Cng3(xI(Y6D1_qaqkp(@2%
z$^>Q^jHU*hyl-jQ=iH@!UFA|tcDd~*9~N?PI3m%7s3%foyrW)LUA%_c+z$cL;UxpF
z3Z8VDlXG_T>4p0Zcgd-(<`T8PSNZL1NfqPQv(y8@t?!dt&{-k%^Ul}Rs5X4K>%NDF
z*S?H`oo6NBHASi%ILF8}yK#6!lS(%9dX?=OGq-t2a~XzFBHGdOt<DqPb}9S4%5Q(;
z;+*<vzBUkQA-`?jv3I1-H3l_?`xNv(lT6zZ^E{phL0_aNh*WuZ$!2paC7kDgr%^s6
zds?EREzSwOr{R{Jd0Ok2Lw@R9Z4IH*r8p>eGb~OM5Z9%divyGT&x{##Uc4GqDPPoP
zx~;c#QG#u_NRhP}Di1HsE!I!yu4;!i!#{8I`^>S#5use??6!kF`5U;}>Ow_|vv*uG
zs}vqr=h0Q7&4hieP@l!PoL86{=ys}Wx%b6}MV-nbMJ~N5EpNWu{rsW#$Yuz!-HTO)
zxAjeV8?-(tBs_hWlqFYNO{hqw7#n4Wo<!_6a<}h|PccK~7o2eR^_geg)l!{v(_Bxd
zs&!k66e*Q(lX$yj{<hJw_5-_YuI);`U3Kr#Tb<cClr!sZY9PzG+NwfDigN<`W8M!0
zJA>QVXsPPe>^xs(EtaZx``xdZN4hHO0x37TMT#7BvDz=;I&@>NM3}=}l<Vj9PV0A}
zLOXp*8Un|XV%~n_YEKs`Qk*lp#lyRQT-{&U|9Bcc!{Jt_vwM3?!rJRvUFKUp>6o)N
z)ru6kd_m{3%2w5fpEm!N{%Mo%D%X@Rj|fj=d_9UGoyg%^DO_z8p(1Hw4EOD#3n8QR
zyBc*=f?I9rK@zx`?|M;svC|kjDAVqZ&n-lXoWbzu_9iL^-3~g`mA|L7#%EWF5l*sU
OLx$%;!>EIuY5xMt<fVxK

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/pkcs11.txt
new file mode 100644
index 0000000000..190f880c0a
--- /dev/null
+++ b/src/test/ssl/ssl/nss/client.crt__client-encrypted-pem.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/client.crt__client-encrypted-pem.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/client.crt__client.key.db/cert9.db b/src/test/ssl/ssl/nss/client.crt__client.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..96ef52b347114a4403c97567215841487f8d9d29
GIT binary patch
literal 36864
zcmeI530xCb9>-^L5sokjXpkyIKtVvATo3`3LqrfE9HOX*Aw&#vSdu7MMTsaLtq3lt
zMT>wIDp;t9;8mq9)&tjiVAV>+VlAr_6szJ@citpi)~@v<-R)=lMrQJV$N%@<`)1~E
z=FLnJ667ye$~f~9lj0>x4j(Z>P!w_Ja1aF1BUW8v?ON!BLF-BouV^p(_e?!xwCi0K
z)`>9mS`hvFSe<@_eyqMdk$?*%00}?>kN_kA2|xmn03`4y5^!fQ*lbHQT%HguOO`H>
z$fFY!3b86GPA=8)3ikF0_2&2nO!S_?A<H;{0i5n~j-7;y^G1%RlM2&Fg*Zu+EUvo-
zqmKev_Ob$h<U|^S{f;FXLHa9HQL!?qvRi@PM?qWqvIZCDj`W~1*n_*qAy+6=vZQVi
zS|1Tj;maB#?#PTlREKS8iEfBjN}}Rq-R|86MXM9);py+)n}a->BM$bR>Jc2ync^MJ
znHJz1G|d~d;1w7!$=}y2l;hzU7#!-zk>JG2B~~7>@_|iefE+H!5`m-$Bt>KrR1pcl
zMhG@eVB-unBCr_?HWILjA~s`5DO|H96>*@!#Wn2!6)p~BxH!<^;y{Rt10^mFq_{ZH
z;^IJzi%Y>)+dWPHNM)YJCY5=lGLKZ|k;*($nMW$~NM#<W%qM;Mq%WWJ<&(aA($|SB
zbs|fh$WkY=)JaoHDm#(N&SXuJ5|_lpBgf0bfiI67FOTdqpUmfz`Ft{8K;{U@9Dz0m
zv?9PkD*}>?fFvUz^#!E9fP5c>q_2?l6_UO}k}9Ez<2){CTx){fi$E?;R+h?yd;wnw
zDrikmL2H86wI=9-)&!%~nqbIU6A;y!0IS9%`Do1^H<FY#x5v$?mm7FXG!>kC`rzEv
z2dAF?5@uI_3A3v%VfL!q)i9CU)nCHwYM3y)8YaxHh6xkwYM>8<3HCRw33fWI8Qo*b
zddzv<Cb`pS>PGc+Ckk{YS}4Jzqi}pAm%?CsTcU_2w7eTfoY6;0RLVp$9oc<cM{>JO
zDiLa#Al!nJdK7yKOkK?jFyR6TKmw2eBmfCO0+0YC00}?>kN_kA2|xn>KLnTzaFJgJ
z`vSo_v3Beh)`(riP7_JEKmw2eBmfCO0+0YC00}?>kN_kA2|xmnz+Z|0lS)Ia@1Cg8
zA&qv?eumblqLW6OX)aA`<WNbY^+GO1hf346ZoQC0p8p$8Mhquo!wnk^a}1|q)mZ#r
zYJjjakN_kA2|xmn03-kjKmw2eBmfCO0)HU_G%AAX_|VdfP~4q69(Q9<r_rbe!cdt)
z$w^8~RC2sLz(eL7aiT&QlOziX^5=wv_;ZqEL_(pECnj)|psGSe+`G=`Cmnh}>CpN~
zhw4j9GevPvt~)+n!^fHA^T*Ig<K(ggB}XbtQYt8u2_@bBP|{rgcSW%4*hb6?yNON4
zaxmAw(2fPW0tr9@kN_kA2|xmn03-kjKmw2eBmfEgZwcs7jnQ4mOdT-w(Qi{0K#bOJ
z^8{2NM|p?pri%~an&QTqSqFWEA`Z;9s1&j!&H4W>gt+g&3Tq>t0I0|IV7vaeU}5W!
z03-kjKmw2eBmfCO0+0YC00}?>kig%PK-Wxz_LVV+ilgAB3J1+S0g+P4Xlas?t}Uhw
zppHQMlu)%LlmS#bUE<__jHVPgY0m#QAXqb2hZSRGSPQlRJN37u3<nJfKmw2eBmfCO
z0+0YC00}?>kN_kA3H+A`m{A3&d&#{kUZ3lw_=ll7!jDeXGB%v{*4$$NN*QJTfnFZ=
z16#c*U*2YxJb(9nse(@4GyqCN6S>VNQ|bfc$A3Ql37ryjE%@_AntK4)RDtfRlv%{c
z7>GAwV5R>K<2?Ng8bKu9bWsmvETNei8X5z~G$YX)`WwDseFQNj7T{zka73($uRQo?
zh*t=T5I1AI{lg~|QzItZwlnX`oefj{>^>C7xqaOb5P}jd1ovK%DR%SZ-><Ar+&-x>
zcyV>sQQjT-;27JIk7L`oS;zORm^59;_F5B9UkbS3$opc%v@e)6Bf;y3{pMtPYZ7Ft
zh&1toj=!BO!qrp@Tuou@pi)rEtH+G97`pbWC$E0QLQ#D>^7d$P3pR`RITJ3=nad}B
zh(s`x%@R1_0<J)t?1vWAs8#Q7qjZF-Mll3eqk0rI0b>8sOC9TITi;c?jdoHWY~8>#
zxpsZ>{$G+8HN`OAWzBBfGQ9{j|2jwR-1)^JVd>L}`_?{cG|yXhKQW);zt~l>O2*jk
z+WAaB((RK^<ijLSY%bn1%e4EVOx(KHS=Tx_NO#l3v#n+oiF;J5);^&Hy8oD;G0D<3
zwk~ZU6R%lydv@-b=W|47H+-<J?s;ovZKe4LU&eyFyy&t=wOcYvCto<AZrGA);82OW
z)LHs1K=&?h$*}SC;*T$k7~?t1;oyvC2T#r4Zt`Wum8Pb<DP!#hv|qB?%7{U2__k*M
zIDCv+R`_^KVZ|6@*_ne|d?r2KQnS=<NUdjd!8PW?_o7^5=G;&fQK%?_78&7&xB+o5
z&`=W^9jBt`i{8wLx0+yvB2#czN^YC|^5Gjt|8ko)<@)~W>o!+nPBq75#2j{rZTVMx
z&We+F*ESZO&vRU6EOzI9`pA5cVpJ>r`7ZXuin)IAnS6zLX6ott(^}?!oo3!J$fjai
zO~&`lnPF8EOLzL0ri(nRb{$?=<afHRvt3pEaJ|d6^gMm@ODzjmN1m&Aw#ezLhy3-M
zEL!IuaVr@^)2n`d@H>n5emJRDXBKza?1Xxh$>_adDXX5XsC=Xvl|P;7{bXx-xc}wV
z`yF4*VT~<3U^(yUeSX%>#KT!F+peCoNtvzIpD|=bd6fOIN1ewU*&}N63#R&HhLzQ%
zH>KHr|5!Kqx?M;zz7tV3EjDVKLtjB{1V_@_?~%WAXubV2a<BM*098|Hz2h($j(Z1$
z*Vu0!ZTiGv;)`bbGY+Ga-v-_1><G+$j{EKx4>nL8MJ~^pGgHS|@hVD&*2fNw-n4Ud
zlx)eeHIt}h&>exiKN<wx-W1YI|NNlaW|~8ACJvxJQ}9H*Wf4*6fhOLfl$VaUx8KoT
z3a-Mw!Bsf3KOPn&2JoN5>!F`4Iu5W>SCm^f6dlCm$4|w7cKJrkdRJM#1(qYrUDx3d
zH9P5!(XiC2h)m|SThdV?`v&{)IOUk^i$1q?|Izks3;mq!q#tYBY@_2>uCuDxx9Yq2
z#9tR+qHoL_F68MAEVI@9=zi7AL3@AIi7VXoplY1I|AS9o6i0eaWK+F<I5X=Oy%ZUs
zGwgWjY|Gg5ik)XoBHA|_D<fx}-#lT_f$=++EV(Ck6<tGLY@}@;hWJE?MG<q|^D2W%
zDVtl37ADj#%2N*Oyflvf!hc)V=_FN5?Pl4mt&Odzwf+{)a~@ksN{8&eW0pN8Uz%?*
z*nUCGgU}6<&pxKvdZ^Tgyq#@_>py>k@M=++(XsGJWA%3tf<V^=?Uea;%c)~##Q4R3
z-?nypruVLqPq)^(tgNZ8y_Tv!cI0{LRCcj7Vn*@2V<Vk%D*nlq%Qy3u6yDsuyo^=q
zyXw4X4XZ`C>D~v%q8(rV%nbPWs~pdi7M+nhOeC&|RAl3wp-$MFb)`hrB)()~Y)i?h
zO3m43hpY7(+Ez&hd6k@=@-&rEwUJ^KTRzF_aqP^ED{FkkXB2V5$g9P9(hN(#Hp6AE
z2VD%;l^vxV`uMg_%${@Q7ZNV}NXLoIoCXwxo}aKjcSoXsLvAbe;Te;d-AVhbAD>UA
zL@~>c5ATS*TXZknuhYWuq*z+TI#xxkHaOzx31ZRP@Abrom;TtXU-h{eRnsWFqN!=`
zIP#i6N*2FmG$p>It0$WF$0Nfi`rCNQxZ0+wW2)_*`AjISP2siIO9r@|JfT;GH6Pwj
zQ@ac;b)9)7V;1@z_z-J{tal{hX&(-5e||V6zN3u5NrcnB*DZ<9uJuGX+DAdrmqTek
zz<O;k{hhn1UmGCzt=}=apyQZ3?Wj$-S)F^<6=D5|1Eyh_A`giL$DkMuFiNw!;c)Ze
z#BA@MMkH^xTRbYx@hW}y#bb$iGv>Q6hJ{5c&fYwp=$P=;S1*zRDw-EFPZf>TWj16N
zv4*MCSC9M6+oN_V<D~?Ox6+NjyfMh|gQ?HMgSk;2Kc?r7vUJ~mbW>Zsb^5+)KQEi?
zuult;Hy3BC+Z`&**|V3{h${HE$5ofh#}3SMv3xS0lbN!%JiTMUVZXiexaDr!cSe-f
z_{=)v6!Xc%)ygozggplHe?FJHY59;;eUs#1(K`t%*RK7gBP*!+5FYgH4}8bP+=7kk
zCrr1NU);?fKkJ`XA?D}qOUVHF(i=v8+8n}(jcXa)>NA*i>y%_=!MbX^y*SGB#GL~L
zO*+c#3pcaE(+exp@lJc|^2e%5<ziz>#68{)`)$*M{T&v4{_Xfrr;6Si9%e)7SiTzz
z+%qsgk1j8h1+Y^0FY;$PZo^Dma?U;}T-sE;<Km21elD#b`7-5XQE0m=q~^rXCuhIe
z^O29<5koh|BYCv=bj>tbbMcyQrq8TA${dwl`;6ZvbY9ePEIf@B{7_~ReaJ$|ND5jr
z{K&Hsaq;du*=p&LljD9FEw3nEcJrr4<<8%--0MRXD+=b0_%QCq=Aa$E&OG<IwWb!9
zC7qQ`rV)iYzUy1Xrt9*j@8uV|>Nq6aG58hR4?;$NL^5zZ{Laq#s?&cIod2VSQxM`0
zE|35u00}?>kN_kA2|xmn03-kjKmw4!A0e=kr_(cE*4x3<Sb!K3|A_0g#5H2$bOYq&
sxiqq@x62#b;2ZD>CklBL7<dyGgI{^VOH6}-GUD&=J{Ln=2}IC;1Gj|?5dZ)H

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client.crt__client.key.db/key4.db b/src/test/ssl/ssl/nss/client.crt__client.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..bd26c68db1e1d12b48ae7b38be0a2df3661cc094
GIT binary patch
literal 45056
zcmeI52|SeB|Ho&{VxO^QXAFu&&usQEc9kVN5i^V>qzo=9HIm3ul$Kj*QI{4%C0axa
zD%!M2<z_7@N-6FCnZeJkd+*G=UjP5=|N7tiKeL?q&iS76J)iSF&z$Eu&-3E(T(mGM
zfq@H;i;txx;7Bkj7#t3>#^GQvnE2$I{lR^p*(q|;=6t~aVE>&d4l^`=Er}h6iHKRi
z#D}q$#1D(p#5KeoiCKsp`MXLW9}oZp00BS%5C8-K0YKpYCV?1XVFficI7>f)Mvq~{
zG7@NZv;^AJr--eGJ=Mz|=S8(yXpfu9#py<c;oLo(U8o-ZxCQq9IB!?yMc(!}H&>jk
zo2$b@XIn3vhrRnks;&JT9Q(*LmN4-_)SD}UR<Kor!=jdjF_M`pV%W}LT4F*R_j~YE
z{9wYAC2E64D=28f7jp}QM$@9gmNA*`@li>%1cvaWIA>Qodp{i4$&oN!0H;eMKtw%j
z6gP%1H%1JN&WM>Vg8m@}*ZHRyBs~WtT0un<9y}pCk-n4>nlK#$^+OEig!@lX2oOQf
z7J*h!n(9pylbOhfpALikA<TsLPf<(=dK*08!U~$2@ccOLkWB}ewuB}_O$^&~z90if
zwQ=+CnuDW3>^FPdXhim##Id;<oE!ot%Y^gQg!9#e`;}9~gv?1OoWzKe7;_R6PGZVQ
zXq<%3PE5I>pox?l5#q!kKojk7q7WcX7y`tJLx4De2oNU{0pf%rK%7_vh!czeg>uqK
zc@z4$k%<#FH!_hMnaGVy<VGfPBNMriiQLFUZe$X-E{R*0#H~x>)+KT48gacwT(1$=
zYsB>$O?bJHjkuAGxh1)j2wY4=Zhwgor!JA(Um{mCiJMR2=99SjWNr?bn?s(=;j}`A
zIIWPmWXN1HWNv&iH$Is=4is)(3b!tWTbIJ6%8m&^L;|PrNt2`Agp&(#3x_f&Br=J@
zDKKer3QU@u)+bGlgh`Xr+ewqt<w=u6bkgKtoiMq4Ce7(;TvC&{)76arP>nMr69tT?
zH5gB6Fq+oOHmCHm&8f0%^ABaG8fNEC>1CT!4YSRuhS}y+!)%kYsc|&0P0sc<X>vBY
zNi%HPWK5gk|1r56%|u!Hv>ZA|P8fv-h0!5Mk0gXvaMb*}iE;WD988$D5$rvR2xqS%
z$$rDpsWA2nJOBYe01yBK0D=Dn0$UJpmJm`7gVFuDF*yq|2F8A3FfbTKMkYf7CX=b0
zp*Z!ND$e$Eiv2ep84_BrTaL2>AmDH&GiGjROcY~Tf?;TU0w*XmgCGaVpb_3kgoHTT
zoxorwBr+NC)@5%V+SZGuEcAg3Q;M%OqVuoY!#NMwAy@$Wbuwq4;r`JEYvcuOf5j`-
z1rI5$GwbAhHknXq>Ntr~xT_Qk->u*G-mcL8+05kay1y92%;`iOx!Vx8%P-Olt?3iY
zyxG?jH)q-9%irT&D|>$txmIE-Dsr!|L{c*`y|Zb4czL?nF=C3F`%aY1rS2J+JeRNj
z9t1kIKVzGLhV`BcTZUV;GESbJZ>wGCQ?WmJdud_%h<>HALg1=elS<Nyd8dy@nab}n
z)A$sL+mw=hJY!V)-2Ccr!f}f|2ZN5*IxcQAia2bSnczdVDwl|Sb$i>EHL7XivdJDM
zD$CYoXTKXQSk!wKTJ)fYH0Kw>{>?d7zFJXtkB}@E-@tn+-+mhkhrywA_&O*SEjl~X
zDf5FQ93=^bK-B545)c`QYpwWrS0&RS>-C*uF9!AW6rLzz8r_a18C^MI5imnMTSo{E
z7lPv;F|^1;6d_Sa1uYtq=>%sWknq_^jN+0W|G<N$GCAaBHLnAZ>2N9A2g0Zry`kp;
z8$X!aZ0Qg_t{rnBNV?c=cNa4@J<x5d;Vbehyn1M~)Pi8`@3AqX=jX2#3d^EpyIycC
z`s#9Et<!8ry@pvV?5(_`C0FM=)@*rxs<y+!(d<~T<;l@G*p`4&+x_n!r-*KAuxNBN
zw)XJ4{rgdu*jMd?r7wRQL(WxyH=CtUFgvSYL3BV#bJef2;g@bd*{7)Ur4#e~id}R^
zr7!l%Atz<oeFwI#OfxJ;TVc0et+0P!eZbb3e3OR1WIW@0c!ZDgDQk@4(OLAofEPQ0
zVpo(^rF1M6T}jEFJ-;Sd&x-<wdaXr|X0|qpF*6Jy%f8;*FXeCMkFVeB`#?KQUfQ6+
zo;aK*d*Rj5WIadrFbMG*hM~ds9j=mv`**Y*WM(ueRBgn{_`Z#JTIa9ang)|wyM^yC
zL~Cz9V|A0UZ)L+OV+#V3wHfZ_@HU#zO|mV&UT1}RX-+(G$H*b9Ft|Rf8(&e^cWuwU
z+#T;i{3KGN<d_Lh2M2<^6JaAq_V*$Qhi|P-Olv;5{!G*Q!vjy6nuit~?k*cTtKz#%
zrk7!~O6b7ZFJ;@$ev`B@QOfq+-Tv61+#<M5t0d**2MfCmm+yHVvLY?4RkS9t!dP~4
z4aFxc{gaEv1_hxYEdQW9vP$C+u6cJHzVY1Wk(@Rs13k;khV<l$6iv!{z7%AwGUHaH
zb_MQeh2GUGuqlw2hIm%ee=+d!QQfW4C*PJkaxuwIt?^>k=8QXKA)78VjL=_v)6+Fd
zalSNIGW+3ms%Cr7$gzTU)UZ@!zN6zsmSf+To^Id!QLo}}D9e{asaWcXt6nWGuHROZ
z-t}h(v_>0e*7Vw*Qd@8mZG82tXUv5?jlagW&Dd!8ZU|5Pw#&mglBj&}d0DxGnbh!?
z=PH6wIH!By9O~=&e#N9Xz0D2pdz8-AZi+Z`dgWo%c<a@#x{iD)$dNs)m>KD;=G;Ro
zKIpS4P)&wHeyR6<Wf>yA(p&mq#)FP+o4gCooS;HOkCS7(MI#n>C9c!1cAHbuJlnK6
zx$}FA^vWws?`FU3JDPOA=bX)=e)VoYJGqbhtqbzo0>7<Ex_bOsB1*bv{p~8Z>zaL+
zul4#;7j#x+B&8O|T})kLwtVlIdtTCcFKott)%MGOd;giV+i;Y%+R&ie;(Lij<q?8V
zz`v<jI&XVNWa^ku>e$$3MA#?4yX)Hre|HrzuJUL`@t>ITmX;kv?Af}`<Y|zXt2diM
zY@=Sj&zYW`X9H?*(u|J=iOMZ63)0`@-ah?c<e|T{x8mxSop-4t?#!6_pwLGK*mXBm
znsYN<cJ$@z-`5H*nCX{_fc3LJo;REu@-SgQ-d(!xM!=0xv2BGX*KHb|(X+4w{T@^C
z#*w_gmbszDPHFK@m3{Bqz8`g8C8jZxu+yQgtkPCpTdoaP)Uo``?f$us1)<>id^k{2
zV?Lsaiv6wTfJr_13CYRTxfGfDS=~(Z{N-xC+d@!nS6g<|wbMJkpx>Lvu_=tt$jdE`
zE?%m;$2w3?#609lrQ?kGZRirGS0*hoJ-E?@EgI3E^opA*%CUEL)s=-;Tn)Uhd?XcR
z;pKU!hy+QJeR8STMc9arh{64dOq+Ex4zKALNSNiJlli@HXM_1+g-#V_d{j)S*Zu6b
zxDO9@4KW<MBBi$sjoB%X3z;iQqev3U18JASuj(JpH?H~ifOGvC{{MYvEyjVszCO=>
zfd?P}2mk_r03ZMe00MvjAOHve0)PM@00{ic2nZvPqMVB#6YKvkFzlCqSqDLP00BS%
z5C8-K0YCr{00aO5KmZT`1ONd*fJ*>@fQe45|NCIrJ^%#}00aO5KmZT`1ONd*01yBK
z00BS%5C8=J$plmo7NURm$BYx}|6v$*_@CTEpdAnZ1ONd*01yBK00BS%5C8-K0YCr{
z00gE9NF#JbfBZ*B6YKxyFzoZ`QosTP00BS%5C8-K0YCr{00aO5KmZT`1OS15CIJNm
zS@f^|aWRVB9XR$gr&Hn+AOFn$0o8y2AOHve0)PM@00;mAfB+x>2mk_r03h&p1jM8`
z*Z*-6<}mC#tQl4XTZ2u;-otLk`eSGq8_W~TUd$IvJ!Y+BmShwLDcOY4lI)i(l?ae9
zm)I_mB8ioFBhfB#N^*gu!QZt2@&N%r01yBK00BS%5C8-K0YKniK|mcrg)^fff<qbc
z3Bg2CI239^hk_^W3Qr{BdAcD@HG~znb~GbpvNA3FKb6&ac_B4kUL#drUWy7YFIkzF
zm!!nYYof@@Ypn1S4n{c1gl@!U$Gthc=?tE36M0^4Iz^6`n?jf6<))Kmc)2MwX<lw4
zNa|-dgFrT&?iiM*+XTbQO{Ylma#QFMyxerMI4?JaCdSKc1d0Ca4h<vyp<^OE-6q1k
z+;j?>mzzRI@p9A2NM3FV4Z+K81PO^F)I^uln9N_|;=?4_Q;`&^9ESD7oWNitqa-d%
zXo#nZ-4laEb3_J2sKUF^AJ87Ca+C-%6j6^*5=wyIgzLjL{EyFIsG0xcAwfVu01yBK
z{xt+xcqtS$T?Y1tqply0Ba9%3wH6ATzR@}ca{JSL*Tb*q*PZT_dDWC9&Xi4Cv9BXX
zxKH82thXx8Znep$b|L@b#=d{J2RjniC_MJ*L`jv{qgl-@Il5i}j+=kM7&w#qn7OTq
zPc6rGv+&qIiTv@HKmd`Nbt7udpCYTf<L{hpD_D_a)m@b5adXMnIahK9>T;@l_=zMR
z(Y_MVs5jIr3+c|m2C3|PN><Yg`F5@x)~3Vw@SVlNV|a@+5kO?O?C7BB_I%yUz~Bto
z&euh!>&7;|-EdV$-{;D_xrFDN_=yY|*_QWG_23?hos1#)yx}v-8OM%LrD`qJB(+Ex
zBU0lmyd+PNbcz5X4N-Pgjwz{LW?of^qIcqR;w9SK>q82I<|bp3k|aK_<SVj%rSUj2
zFMpP6`<XhSZfAFBsaRpb*o!S?rQz3n=51%;C3uRY&;<~==s}{v;#I>a?eShWlbksV
z?37NlTbJ0xmLMGzm%i0X;wLg`%?!(1h3U2G&!euDS|=>24h>ZJb@8?6y3YHnn_O*T
zSa@-sBI#rSMB?u~L_dr?bJuBWoUOf+);V0ru*%yexOIcw!GW>TQE7f6ja@4;XRcfu
zIEx&8qQYv+`LgVx1+G~2tTe5IcjiRYWU}yLJVjDy0*J(2@SJI=D+)V%|4r_mWA0RZ
z1}s(f-jW(G|NC9i&(;R;6REEtKdbgtwA-3z9$B+Z`kUjea^5fgAP+M?k_j0fPCCHC
zi}DmH&=hpAy1-TQRQaaLoYC<958J{r2E@8)%ClU}V(VJQWe0QliA=l}nZD_1t+T9S
z<A!wwGF_?$zC|hGtEzmJW_7GuKU<Q87x|OOACKMzAZhwsUbox$ZidqGyx{>qL#G&v
zg(q@b!n`hCy*K*8s=0-q$n?Rz#MSOYMNH+v`eznhvN~U}RQb-WV}mj4YX&<aZ?o{i
zyhRE!1x1e!-L0nvA&k}Jo-Xnu{dQ{o`-<g#pFLj$OWRx&$7S#nS!<)_?B8C=D*kSk
zc#AR{t*Lb}w`hQrdQR9<<M-}!rYt;~r$~XOpk_a_YID|%rn04XbjHIKP|TqEbssMl
zEjem>;gQ0X=okD%W|@y~FjMt%GS;>)c&dd_yu~nd{e7E}<@Y<szuz*q-owJ9c#0Hg
z3i=(kt!??rlHts6W46iWecCUVd{ABNsfm5F%tv3nvZs@u$laxIw`Jt7{&N{NLz{j5
zAIrT`7%?U(>n*LFSN|s2GlGRj@)Rl16!dMTkrsAUhS4^;qeZJ74Q=1IE_wgqgdx4<
zDLE`%wdgB9kp`bjr9DZ$RVd18(^9vS67nuib>$BeiHe9Et*u|wt5|phPmuymLC4lt
zdu{se^a8&2u7-N$p(-6}{R-<9y<ay<*ieJv?>F!hx$Agr&-3Wc)i=dAhZ@nd7G7Us
zk+D}Q%o;Ycr>UY?rHF+W;we&~DX1<DTGTzSvzkh)SSDPdG)P^_ICi|a+g2y6CSgf&
zk~}|=%PsTWRBbh9H?A1dOEsn3DDqz{1l1pQ3Cy5Ke)SrA!qS1G)X3>_Q|oNInm6w7
zS;?&WeR^?1$>vLQYi7woEEW_yeXu48h5YGYZ9(4WvK70TTit2nid#F8;yW)SuvE7@
zZ(~a7%-z4aYvy0bR6&b|WIDka2qb(q5~EhO>U(%c4DF7=%wn}Hq}2LRnH<Y{TZLDC
zj!Gw+3eHWe|7&65>%>e&w~CC2%ojc+3`YlH12MH2ImzV`trEJZTCuKw%`r6S2p|9m
z00RGT0xZ1d&pW{%FTe<LDxiPe!eH9&Gv`K19|xOzE5~8xvu;;QH65;&N^@@vb@=@+
z_AWo13UC${vAVx6yWg+gJMLLb4grcyqnUhdH?egq)9Em@xz5s5L|ILqulTF$Jc1nI
zeov7*Ej`YnSnq#&Mf+ph&ih{)uY1C7(vRscU2UQ_IKoe3oMyu3(%si09-k}qEvrjz
zy>Y5=@Fq$w&jZiM(G~iDW@#$$)MzZgQlSENFlWQV=W|YP=$b)(cBwU=$SB>v;m|Wr
zU#CUoRe^k$ua4xP#J)FQ&3kd1P6T1sy(_3PTO)KQO;NqbD}8b7-TN&3jGqVlhx0xZ
zQvpPV(PR}CzS@bb^NzmyTC!Z@%SG!ehR<g1OWKfjV8ENM#}DK<fwt9UqgG1d(<fo=
ztqnRditY?`$FsZKEL^i~`roLr@bbJx3NqR~qmeO>jP7DvZ~BYByneJ>%EqPhV_n8T
zFZ7V8ua4ZyPo$p~wum7;y00<%mPdS}^5@+JL8(Vy3w_xoVt>6_$C}B)%kdN`(0V2c
z(VYy}oQD{wE>{nDmUYi<A1iq7<$?Eybn=#8{G73ZpUB3Mek;E#8*OBM*CH9tMXJ5r
zZ|yO-+r_V|P)G5db29q?SC*$pfz~t8ZHar8bT`X6WSw%kaIVYVHhu1r*ya=H9SQ|k
zjhh3`@)NmsPgl~G!s>AHTiMs}r_aTXB=>A1?&&!KJ5{+k5=|6l;bnM=6lgsYhMIrb
zI`6#N+t4#F=-uaKujE9QY@Dlax#|<WT&twLnx9Aq&r`|c*3Di$<|i>QSv`$4+bh5C
z*c$U#&R}5sVfioXSa|%;B7dAEi30p^jHTZB$i4YkG~7zDc0|9H?C?IKCf9TP=7(>a
z=H>0vQsgJnpm8IszQj?};>J3yw&FE=RJ((hIPX~K@a(L3?0(Cf8WvvqXOTbtx&=A!
zqxXhxTufbnnb*3{{}BdvaMSx$HD~D&{c_}@e7~?f1V53&XJy6`KjsMCgsovIQ`ZP}
zZb#!4*JrJZk=+G33740!G}U=dlY)S(YAWj$v83L|o5A%B(SyHrb)*cwef{9}%dpmu
z?xq`t`Dsjfr>bRc>-H%1ct?b}<F4!G6>ASt-i<!VkJtyJ&pd`_X{zzmD9A3cD*D*3
zlBA`ZWvU;&c!5&z)w%xq?)@9rj;i!yv=@jXy7+0#c4!UTe_i{WOxht^)fS}_mmG7o
z>2Y<>``Su$H|&13hNY>>Q=^dp8|30o&m0P%lLIOrg8~f98nS&2^@p|;+I~A-lpJ_E
z{#6M-jU}CxW5w`?%KjvRRMX2aPm2z{5{bFnY>Z9!9u#?5_JyUX!c(Ilr=9WjFT7c!
ziY`c)OI9D8v0Qg7|C?b2>t#LB*yP%s%Y1({Uq)BEUy2{;|B6amQ?qPr)FMvP`ab+@
z{fz6+Hg*N9m1k)x^VBHF3Ek*hbAmk4mvdu7(<(osP`Bv~ucD4W>%D5=HWaWk^@A`!
zj_srn$qg)*#UTrttmGE@UoJR<HWHmBtMl0;{o?hvEH9R(5>JgJ0mk})hAQ(y{rN?C
zyAH43KJb-^9K6?d>#%r{^{4Y1&b6Ld{51MWzc*Ftttq-uG24M|o~8QLJ+JLz!k%3&
MpZrikc6yKh3rY97u>b%7

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client.crt__client.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/client.crt__client.key.db/pkcs11.txt
new file mode 100644
index 0000000000..3f0a9ff5b5
--- /dev/null
+++ b/src/test/ssl/ssl/nss/client.crt__client.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/client.crt__client.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/client.pfx b/src/test/ssl/ssl/nss/client.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..ba13f0cafff3a3d64ab5c1b26e98033614e71fcb
GIT binary patch
literal 3149
zcmY+Fc{me}1IF3r%2_61jv~3YDaSXHIdUXdn45A&jS%}eW6pBrE_b#jj7`FvVGWa`
zZ-m17k~wpP99jDHeV*U>$NRj`^S;mX{`r1jSUxiVI}nED6XfJkN;Xa2=V#|)ufX!L
zfv~(R7?$?{hUFyvx8kh8a#s9~N&xI^zb*g24Lc0NdE#FSeC(Vs0T6euM@isY_mNNl
zfSWB2%X#~gDenqnOnFN+yV*NCB<;|`NT8EAz&?E8lwFxhmmY3x=BY&;)HuOWw(+3-
z1FAb80g$~ER!s?3F%g^aWK(TfMIEjS&~sil?KK?(7W0eG?kxDq@=2W*Q%f|F^ZcM?
z9!I6L>gz@_`85U;&gTZ4+m5T3VK>p~)UOLJ#6Q%)1R>Xkdn}1#G7r#R>mz>#BeFS+
z=thr5`$frQ^A)<;3D+=+vYhuje3D;1Za#gTa{5er^b7Il^A)F#Q%RwVTtgzH9lvTK
zi1wiEov5Nq;dK(#)$AV%eM0FMJ7k0Kr+JLK5^c>3)3v^I?>30$iZ36<8U``TCktV_
zn)JEh+AEc-#4UvNQ}R>G3*rM`B)P>p#IAK`jx9da&(EqTfsdr9{>6%IXC6ttZ(QR&
z-rr7I+Nn{4-G48aTlRGscygPGpTOqQc<=cN7$2+VsP`0E;HPt?iytp4{IJe&;D$rw
zbIpdvxg!rJsO;c37i3ZtH@{@&9ob{yUxFoBa?UEVorgi52x?Af=lAj|=Qds$la5oz
ztnYDVhdYNpY88)#o~WvouI5*=5J&1>_c>IIIyAx$M?y>8-pLKzfi@;f=`2HRWNspK
z84lkD>a@7DRPpi&ao@^pp%dOepz%S=>*Gc4<>Iy^ca2CpA$!hZ6X79JTR{MZjzT8H
zs7`%U3JrlCPs>*gpY*%_eDC67h~~S?0MD!tqi5WQeH*Ly)qjlp5SUJ?47xw7B;!Q#
zOYW;6(63U%W1EcnZgM1a8!EmV4TCvpp6i5^29|4urf5t%*W*S(JB&R`0b4uWmXmzb
z1mEe5DC5E(-}emx9+!%C^5rP;Z|dnZ+jQV|WB>eA@*T6W!8(EjpP_-9U&!(s&zSN`
ziVevvIK)3(xmot-+I-Vb;bP!QOe+D#iVI9zP}&bkvyu*$sqxM}32YPE@WkEXZXmQ?
z)<!L~L&BRreUP#}!$EU%MUln?4*(xxejdxle5kln3HJ7|>eGY%r5Mp9Gb<6J<~}?d
zQ$v9(p!;LVyKIFKm?v`^G1Xx&s_h1q0giU;PHh0pIR!sM2v2yJRg}(_kN2Jpq`AWb
zaZRi<7vJ3gH|H<D?p|pk8_-n?(m)y-kS%VMZ4LR9D)ZzyRg;&Rq$1sv^Y8O#qpi2{
zR89nLL_suZ;agrFy!-y2a45c#oy~W0n(lHzDVaMMV5We2$@^CoGw0My*PfY`G*4gn
z^Eos7ak}u4`;{R2$F9p5hNIBkpO+zNJ#y}IHuHGiLH`g5h9aZbI!J8v<6&-YdNJbR
z`XAM~*GU1TB1>)V&1Lh-+aJl6cGAcQ06OLiY4hrNgBz#<?aFcJdxJn=MBr*%87aW`
ztLtU`y!9iSZ9@m6R9gtDpeoWq#3EzzmhVOXFku}u_Y@=PWtCHvBk?rh%0+!>tfPDg
zT+D&8)tTw6sD_<}&wV_1MiKnwraguufD{}qaMI;#f?AlpFfBD1I3bOF-FsYDc<>-+
zV_tB%*v5Qem5q9M<Z&)49TDI@Wz<(Q@zf+Y@C}q$3odr+g;m;<^4H?zkhAd3lKN;h
zA@N%&IGNJ1o=SLcaW9Sh=4S73_FauR<A6sQT(`O{8(FxKtgcW~Mt5Ysg<Z=-h=|9E
z1X%s0|5L;?KjSs-Yj1%6<dq1B#;1z@^>>{^cts;q-(EXTT!X2Dh!7&WfoLUH<df+Z
z)dz6#>K;W747#=R)Cy)D6OXmXYlgyfdp?TPNMgD28dJ<dd?5c5-dUZE62I|W1-lDv
z1eNd+lRx(CJBt#iY^i&|C5w2s#z<MILSwrqi=n+*y!DjR?9K3HmyjQJdcM-QVc|yD
z8P-z-61FwtW9yZEZXsepfQf`Xp=NAG2u!Bry?WRT_kDvB8P1pqQUbp0n_JU&Z9Ak)
zAg{l0sXSX?nRK){Y4w+OPONkfRU}VHatUugr>zk(Z>v~)-=?{KE8kIp@k;9cNZ9_n
zC$fdQ@1sMtqK+#2f|%%US6-)~m3}!D%0!35*OOZ@zPrh5iQ3MJ0>_fNOD&Lw@xh^z
z`Z=eZO=;V5YBYoGViAs5b>4m@aoX{A7Jzn7BIaqoXkEwbz9_}E^^ppM|7tP#EuVeQ
zx)x7HL}d!{6S1Kd-@rbhGHa*i|20AoY>aM-fnhoH{|8JJSPpd%mP74#tn^#*oV@?W
z)CqP#1s1dc!-7`-k6ysP>2=Z3H+Ws^WXRw20%1V|by&f~*sV+Ki8(S!M_f}FK8dui
z*FKM;j7Cd?E?)P^zG=7_fLZNua+4XZv4oyAv}F8&nIYH=55qMrmmge#k`rk)1z`j7
zS>@swh8On4t(WDdUhBP-RIv^T$r2Jun^*S?b?@+qm|i^q=5DsKf33l@`bv=r(PT>c
zzS&u=Wsa4x!>{PvR`%}LoB@}-Vr`>CcOD(A9AC@ipdHk_jpa&=S*abb4jkO~tSVcJ
zeNlP)!6i*}3;&%<G2#=8(UHVuR9~IPifJp<Dkv-$d7=h0>~Ef1H|;Qz%E`3m-%98|
z8<%!}FFRB>x+l0(X0J6VbG-E%c-N`CB{D9wba}z;?x<6<?@-nEYzwI|!z8D2!gpG3
zHeLQqu4}=s!pGJ^(nj$Qzy4|^tD%b^!YZt?`k(qSJm0P8GX^(KDD>ia1lLci8Z5C1
zf9_f_$G(@g9JeHHg{M7sdQdhr5*e(dw5~d9;}ExB(6htHEGl{u0R;R)wQqUq==zGk
zMe_6ul!b+igW+foNW{+}Z4o!sh|BX=Yoapn62o9%rs+Yre{eraOi32E=h+a3Gia-s
z*5T5+2#Y_b*X})$H1O3x&)__^dwzzal_Yn~%xh-lg}9sHa&4BS@;!4`XjN^NC<ACJ
z_WCqKf2)*^?p53jwU~J;sV#!=rAm*(lZ@@3al%=a?OvU*<hz!<@q34<V>5=tOkOU}
z9PiDV5#9S7eR*a$zg4<A5a|Cx)w4)f{H;P9hTrSvcuB&ikyHCVb$e3I@I3nscS_I`
zvLOo-QjtRjBatns!!9NTx~&_yxm)TbbO|2vXm+`4Xn(@G9fIxI2kk4}IHJhX^uZtU
zT1j>%kvbeeoCY<Y^WFfXo_5Xe9w82XgWBBwx$Q+`8sVYUC3a8^l_eY>Gni}Vn%@GO
zYJAo`w%s(Cj8+fZ&p`fs6bBp@`7YV!!f$rRQdY3(Dt!9_(%`^?)dzC}1ev|N-AV`~
z8Eb`=2%HB;Vj%-{$CIDym_3t$)g9PYNwlKo?R*L5(GZ#W@(BDkMY}s8R0%_!vPsf+
z8--P;j-0)leZ=MRr?|Sf&%I9R%`D2!h=>CG*~&z+_Tl`C>i5irNhed{<Y987Ejh0L
zhi&alj|alSHF|f1@p|ElaodkRw3@X#YAp26Di^-b6IpUKj+%e;R|m@!<UK#eovCne
zFVK0OpTcXl)+myJPGPR0#B@Zn{a8m`<7Bgd&X3mwHS3}_`J*+bq*yMS^`|CY7KD1=
z>_onPJk7VNaDCAH+Z$mTK4<pA^WB`*C^Mg>Q(Ls=Q#bn2bg7N_UgI2V>LLe0Q!UcF
zpp|o=fY8JiiXsP92}(r!>LXBPcqgjl@q+`s<XG>TrY~m|Y#4U63qpRBh#k{xk0YsQ
z_oC$L#LPCmMcP&*b7QB)P*$chCx}Ql#(emmYDDo8f>>m$SnHquNU+D{7tb}MXFctA
z4k6qM^Q3hxI^2tY++Wu!857p;l%q3)jXxe+y5pEg;0tL)t0kEE-%dQxx*olgq3cX5
z(9<N;uKR1L1}w}zhjxExAF%4GO=6KU1HENyB3!ullQ|0`?9-cL({nG;ygpyh8gL1R
zaSRne;pbtp|9M9q5%_5knDf&{7>ygNz%tRR?TJv|9J+N90fWQN!gx42lm&nQaSk>R
l7^TA393`)xPqkJviOZsMFs#r_5Vxr0S<wVk1oz)B`A;Jm^p^kt

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client_ca.crt.db/cert9.db b/src/test/ssl/ssl/nss/client_ca.crt.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..e0a8a94d56e8c8fae91d40d6c67ba5778f0e122a
GIT binary patch
literal 28672
zcmeI44{#Gz9>@1jlKvyz(pH0iXqTdvRu0~7Hff*-_77<-#5VoIj0I~iN!OZ^Hj<=_
zcFrng01xi~^?-A#2Pc1za)Q+kAamz+=B_s?oLa4-qNAe12o}Mq2YOoHd%H<n#v5h8
z8T5WT-IwqC_kF+jd7DgLl5TaS%O6q2JA$ERPeimbDGbXp1)|6>43Ez^d`1r=7KUgB
zKeD6r|B^g2E&nsKaF#J89%qt17yg;FC#fkZ7iZuA0zd!=00AHX1b_e#00KWEfdZ4s
zV##D{{VfgZ-M&R0e?v<+>~8f2{Jyy2DraGhQ!Fc=<GfX*bz()i7^@ejcqAm}%r;Vo
z`P3oc@v4DX3)2_}T6eyKHD`{&WVt4jt)u<Jt==Zp7l}C-$2jP<=X*#<$|>YcmaC%k
z@Q1^#YA9x67-OPUp6}t1a#mKbahA+Xc6D>a;|-{>?lHmXJ~f3!F6U?t{sz%qRd!2Z
zRjoMBSu4&jFRPsIBqJ18l$W^5ifhEeqKc}TsiFtrQ^Kc=Pb<;1fRsq2$U(9Wl6BB5
zY2r{wVk3#2BzYupkYol)JS6erWCpcDT1p)e@sN-<4snqXv5^q*kq|MG5OI<av62w+
zk`OVIkdLH#cv^haS=KalmZ`H$on`7QQ)ihv%hXw>&Q{vjO8Z)AUn}ivrG4$R)=q2f
zwAM~*?OH8$wo~Uk+LBU|C?=WCS4O0-Oy?`pn60$jO3SUZT%jcjEm8CmGKzx8C<-N`
zP%;YjSE#>2*TF{n+Gt-J?Q5e{u_r>ZL<ZL-iQYj<5pC>KZC1r<BMo#(8t9UYu1gYv
zF3D_lNv5nzLR6Oot0pNQU5<34r1a8}ZuU{#$dYIc@<w9Fi^gCdi5JUgyjVutVmYd9
zbYNT>jTg)4z*t5H#xgoEmgG_+F<?oqH(ip8PL~ZMQXP?Z#3a3Fw6@-naJ(d(2Ac;p
zcoE8xIFrSh$uinY%i;ju(bs!gBSD(4k3FyJrI;jp`*`wlYsM#+*v%yE#R(ih00;m9
zAOHk_01yBIK;W_?(7|zShV<m*R1(?J6#8%hK_*{7Tdiq2K8Q+IrZSU1*q8e6>f&ma
z*~%<H1=4KvOA|lez>l-lsNskh3I-!$aUuCSO>_stk;af(UFj05t6gG9#hGx}A8ZjL
zq-nSnzf0#>j>UFWqfh2*OP!E=d%@1(q1F6U$ISm8UDG}*OWw0%;=!hg4UcSD;Z@u2
zeV~N>HGyyg^V?}m`dA7})0OX^<Aq}w?TImr$9eo!p)cT9TO##7&oo~sf;xCJ>R^X9
z@pxkR51CB~xhrm7@gFnGCK;KF=Y=vXX1pPm<UGlWx3abc7PDeUilpdSR3sIk+1iTa
z(G~e&i=oXz^r@jp7*8N;bl|L!;X7D?!R3iu2cGhQV;N`mo7?Z-J$YdBvx2|xh32OY
zzu)*^zPd3(Sf{REb>>FzZJ`q>liGXg*2EwA*!K%Z?m%vBATs^o*GfN0`2FA;$BnOK
zmwePanBCC4Y*p5tXO_R+9Q<aH;CT7!fmb^duh^BH@W;=47F^l=O<drKtwTMtT&|%f
zhqu=k&9U&s9~@fvv9XI8A2+G5>$c3M{_vKU(&|oaNR8Al?B8(HlKr!{w6&df=R1zD
z!)pzXPhv{z+>W|m6?8sb*~M)*nQ~W4?~=~Qq_eNjG7h^Qd+5bbYh&*Qb>XA$oNVuP
zW#rv{F3Zz(?amVu9-h9@w=v_Y+(nH;HLE>OZ8KySwsstF=4D@>^fkw`47)i6C8Kee
z^u#oS5%DZLJenC^Y|M;hGM-*}=B_W_+52{#Qjx#t6nE#8`}pa%HqLE+cknlluW@e8
z`RdW$nalPa>^;(+G$W^<zs0hBGBbfII&qzE-V4oN{^9V4oo!EixbwbU=B~2k{f-CB
z$8C?C{#~kL)4x8AFW>f$bw&3akIUJV=E-M#j_aH&J6gIQdUHqXd+yiMQnR^rJ?-lr
zn}RwL2L_jWt}Nd1;=HfgO+9P5tft*1#pjw9tX;OR%zY>vu+_h{z0<ccbM9dBz4_11
zOkTC?Iqtx=Pf8pA^2+X4TMn1{X1OQW$N#CO|E34mZwk5w)}Q3RIF#17GxW^lbNzR7
z-uT^p*Pm(nZ1d^bxo0z`KJWJRnE&3x?;ZEoq9XE~x%jJ|Jd-ZLg<TVrjy`|S!E%4!
zr+t4ma+OD_{<efo#1V4BDMmPp6F7hX5C8%|00;m9AOHk_01yBIKmZ5;fu93`c;3L0
z&oH?--jF~(#nblxiy2|Ru=wXNL6`#&00KY&2mk>f00e*l5C8%|00;nq%Ys0uVQC6`
z34Rk$f_)M$-bdU2cQZn_u=ldy13>@*AOHk_01yBIKmZ5;0U!VbfB+Bx0+@h-XISoL
z!_xGGOYu(u+W!9-Bb*YB0bU>g1b_e#00KY&2mk>f00e*l5C8%|;3rKWj!$Lr9ZR?r
z{)U7xx9rgN|3?|&r~vom|4A<~1P=s&01yBIKmZ5;0U!VbfB+Bx0{`a(=nn=gypr%;
HHvs$=4>)Rp

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client_ca.crt.db/key4.db b/src/test/ssl/ssl/nss/client_ca.crt.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..5793b879513b18bb5467717532e575556422341a
GIT binary patch
literal 36864
zcmeI5drVVT9LIb6raVfft|}szDo&K)xwp5aAahheAuv>g0fP*0p$f`F+lt_ZQjBP_
zsdFkujjxQkOvR}9*rp6{n3*_rb0NB^G1D-!5uY(SlcBrkwB5xx3(5Z3$gfFHfA{x0
z=X<{Ab8au(lF-?+(o3B-dTyn?oOjX&Nw9>XBndPvkw|31(@%JMA4(yRdk=(Hs!#l~
zP$r3<d@oS@heWN3m-ye&e&heSKkpx=xuS{J?0wlF$O8c&00e*l5C8%|00{gy36!Z+
zy3kO{HPOji%WUN~C!fSSdGD(_F*Dhcl}u+@rlu#;-Yh-7w3wcmnfjI`GmlP7&ZDz4
zQfFl+(=#&Y#2FdW(o++&=*;Aq>6XOgC|dZ<w48Cju#uD0N?l?oB`K{awpBY8l?lZ{
zezCKX92a`^3mI?ZH&v<B>B6ae(xGSpUs_z@aLlxqR`E`o%404yBPltTCPi#P>_Cs_
z8N@~=D2PT5(J14swlcAc@;MDsd_ltyIZdwAg@jXuZrh8k^KC^=QA6>ZhQnQcL4`p~
zWTH%|8{u6|sl&0@W*24T&&jx}FQ}NA$W@t?N*5kZt*s<mCJKm=)Fb8IHZebtjk8Rh
zk(m`m^GJ9K`^K}v(|}`=z!?Uo%=plZ56$EdcQJFgG2+IAn;6`faTALh9yeB@i6v6V
z-4aEFH5lZc2dgj$%P<J*FbE4V2rDrNOECy*F$jw>s0g<ndv1S3nRUlRnI+0BQD%uU
zOO#on%o1gmC>zLF0~u=|V+~}ifs8egs)<xhq-r8nle<ckO+-0{^dyuRf{7*TWf30B
zlJ&C0vw`FdByS*jj$}BJ;XD~U3y1J593jIIG91z8h(1U5!AQm$$yg&9Ya~<!O@vqm
zPwok^do#`=(z(cHG;jtZ?%)Y=2TzD+_k`GjC&a7ugm}rG5EJ!;7^^!Zd_18zjF9qV
z#bKsC!|;~4JH&_{V!R$qqF*8O`V~TNUm@(%*E_M0_4*Y;@5DmromdFH6AK|e)vyO4
z#OIqQ#3!96EEYqX7|#7WBqxo#uT`{T#deB~JSw&#6lstub<@LNc3~9X!G(+%<9mBG
z{;3j(n_%3)0|)>CAOHk_01yBIKmZ5;0U!VbfB+B}tOPW8VQ~LHShp9}1q6Tq5C8%|
z00;m9AOHk_01yBIK!6Z{`+qnQfB+Bx0zd!=00AHX1b_e#00KY&2n>D#aQ{E}_ZU_P
z1b_e#00KY&2mk>f00e*l5C8%|0Pg?c8~_4900;m9AOHk_01yBIKmZ5;0U$8=3BdjT
z;NN3dArJrpKmZ5;0U!VbfB+Bx0zd!=00I2}|J9l<i8eQ=B`7GcG@vse%zvqnfCmr&
z0zd!=00AHX1b_e#_`eWv>D3BL{VNhj>Ab=so84K+8f>i9%&@`{`7*9p<f=mjO1}vW
zDGiSUDMb*Pfh^)-0OI6yNmJX}<|Fqjp6v>_Hga#0am>12uI2Hvoc!MUht2b9<D?WN
zrD&v4s@*D5zrL}Yt}40VQb)AtS9X*~jZNRZ@5iy<r5!(CIX`Lp%!sW`LHk{Lm2Z>g
z0hp}2(mG_=7~7-pqq~<seq;2iQ7b-M^K{LnMH5UL0zUr!)!F@-+<(7uo1tMIvwh8_
zs+7#?*8Cl5s>opJnUR}gcm14uGs&e_`ZQ@Z4#4EqP2<j0tLrRJM%`_GCwh3su}>q*
zPj2s=wH7I^AFS+A_h)j!(avj^Gq0{hKjn6p?T>yIdOJQ$yJf-pB5O-esKm6>rC0bg
zX|xW&<ehI{`!aiDec<X(hN`ZFwM0vwD9SW#L*q*FPlcUaeep<tCWo3*)}0Qo*i%y*
zUvRj2G~E?wzh2j29--{H@kqC7GwssLeVVj#128%Ic8>b>-pg@Y_SJT``2}|6Hr9>o
zuACSmtGge!>S@`A{!IR`nhAO{^pt(_q#<X{XB>EM;__kRmJi$bB+8bvf@Zg*xb!lg
zCWWt@>;H{&JYhss^qH2nO;g6rkJwO?{>8EM-&+ryWlmpc>}Xn8^q@bJ2kk}rZ9yAX
z*3MoSUyx@^YkIeR>ZNo1#;Ww#hFjZCl(_U#pC(Oc04Cqw&N!F-mQ~gDbpPR!A+0rs
zPER@T^`YbMkN72FX__W`dVeP4e%(5M$L#{uPVHn#{fUYv9rk;{?Mu!EU(v?b#3bJ6
zc12K%P_BOHLf+w6QfV(<Ds8#iG@RKYiH<qFa_pkpQ^s7(MlKgB7q2>jXwC~4A#1OR
zzVPRv#?D0vuBzbLlwR({`1WolqBF!_xBi3nYyV&~MCmuDA%(KZ<kSRtP>=1wN4FlD
zKU^r^yJvWlJh*&XLDS8z;%@9R-3?RKPK?HX|5s~6B-)4CIBkgbn6_HmrQNK}`@dZ3
z!6y&^0zd!=00AHX1b_e#00KY&2mpb9Nno_hLcRPGM77VdS>>y2H7b3TjaG%PvXztj
UDjRv3ud)eA{biwk-p?ie0)~o{+yDRo

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/client_ca.crt.db/pkcs11.txt b/src/test/ssl/ssl/nss/client_ca.crt.db/pkcs11.txt
new file mode 100644
index 0000000000..212e72edeb
--- /dev/null
+++ b/src/test/ssl/ssl/nss/client_ca.crt.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/client_ca.crt.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/root+client.crl b/src/test/ssl/ssl/nss/root+client.crl
new file mode 100644
index 0000000000000000000000000000000000000000..1d345a098f4488bc747deaa0ef788d7168beb7c7
GIT binary patch
literal 393
zcmXqLVr(_YH{fOC)N1o+`_9YA$j!=N;9zKHV8g~7%EHWJ8j@OEqEM8dU!vgbsF0Rl
zq!5r_T#{at8XV}O5FG5IP?QSf6c=aa=P8tclopp}mZXaF8d?|{8krj!n;4jyMv3#9
zm>HNDnn1Z|)-g9RGBVUyDtwyVe{1D7zqPZ^SxI)Sy>~!W<pJaJ+>*6S@zp;+c5W9+
z^Lod^S|Z)bS@}Ni`Tpa})~8e$KbpomWoGw<j^>Bllh2*f__60v-OkD9uJ?Uw<TTk{
zmS=us-bBmDYa3p6Z@O9bv+~Z)sT{tk*KH0LCdCP#6Le5|<94^kM*Ttl{XHHp&#Ok?
zW?0u_DpK*4O>)g*jb;m5?;Xo@d|q+aiUfUo7iT?{_rZm4@7YV92Ulqo$lkcVF*#r2
zXz>Ca$%>3A*Vis^H2dH0V&i6PQTN~OPHL)m2G=s5-}_AU9$7i>`SIuP^gnIp_kxXH
dbZjc_b^6{}Z@>M}ghR)eg7;aw?eLl=1OPoRrTqW^

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/root+client_ca.crt.db/cert9.db b/src/test/ssl/ssl/nss/root+client_ca.crt.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..54a75ba497fed1145ef8b0987417e5de6449496a
GIT binary patch
literal 28672
zcmeI53vg3a8prP=O&_66<zZ@9=@qNArId3YNrUY$eWg$cZRvxDi>*l-YD!CJlSon2
zHUeFQr7}LIhzx6i6^E)FV0m=eQN)UmQAc-Sd=)CVJKb&vn8l$5>F7BpH)%l~hXH5Q
z`R>d;`Jc!4Ki~P?do#UB=C*X6)#Y^xOWX~0Hm@Kvu?)*HS%SbY43GD4ya%^1EHuFi
zeq~4LpOQS2mT^8>Kg4LG`WW2>eYdVtSEEb871)3P5C8%|00;m9AOHk_z%NK3ORF^)
z64*tqWmV2b$5NZCYMIAV?6cRp9O1bomh3W%P*9j>St!sxp{P&@^$STh5lP82!l*+z
zb*Q!3owcD6+N&IB-?a{Ma-K$O_(KAFKaKbJ>@`k@H{=j@m4n)Qt%r!j<ZNDRxGlI2
zm&fCCHiS$xSD6Gluk|pC$t^`}xFI2d-B{<f*=wDl@Q~nCpR(*6t7S9?SCvp)QZP5W
zWRWn(vPdW|ESOhrAv5F_73NzDa?6D5oT8GlRKbSuF5+FnyG%4~AT1(kGLx#ARL!(X
zhL{yn7)fCwMLH?Wq?k?$8!7C#m`<%wprnq7c!(%44{;F@u@MpR5fL#G5pfa`u@VvS
z5)m;Ik%N?KdV&0?vlP(OS)$Gob(W~JM4ct-EKz5PI?FUxrm-@Om1(R@V@<TzM0-uN
z*F<|wfnMrtqR#1bB&8%$OcGtMgh;GJ*DKMSW!f&&cA2&-v_+vUirPYEQ4pC$p=1<F
zMxp)+^;hU|Fw$5fjWyC(Bc+Nx5t2kQxhhHaX3~o2V29HvE3%OcP$e0lN;11DNeZeY
zt5qdgvMLEtRT8WLN%^R9B#e?$TSvl7qr%7`2@FUd$ss+MgJ~pREQ9%C861n{sIkF`
zaceMNEQ1qc8Jrl);KW#xQ;p<+B{|<zNlrRdR*gvKh+Gnq^rQ)lwU4A@C+SofZK%qQ
zP_oEr4VDC!3B0w`*Wx?+N}JE?ruE9ubzLcjB)PYbAaA$Pc;})T8QoL3fDH%$0U!Vb
zfB+Bx0zd!={6Yl$6S#*p<6~mR6948{^L0)WbDiTEW<1_VP>hnw+|^$(=EKt5QkL1t
z+=sHn87NcBmuvVj#xkeJD>S&>ULiM|d?_XryFK3O250F!t58~M6&jql;_<lL%LFeO
z>ha;fwYl-J5r)Y_TaNBHK6iG~^ToB9$Bq}4vUrA)(K|CIX^HFP69?Q|^Lt8G9N6@_
z^gq{a)suJqwdSn2>FrmV@)sBlxqqr-R}n6V*-*@kzZy()tn%~AzJ4;JJuw*_uH)|j
z34|$*T9<Q~x6)xtb2NC7pPz{Qoc1p~$8tZuW)!WBOj$c??O-&^>cW^CM~fyJqVXND
zD5Z-szIRpbGej#Uq=<@Iy$Lh;*-4|*X2TfX&*~ZEXQMbj2C;wDiT^*T*<A0>Of&hr
z1~x{F`|{MR{ogb`)LX5sk6zr<wqQFOf9zRT`p}zyH}3v6Z{NDXp7<?~UT|;YtSd5X
zYn<Ax8ADfem6<QU?7Gu-Iq_friEB-Iv!i%mPkQ8Cjq@U(&iiN}uG9UBZ_T>Pnxd?K
zZ)?d<$f)UVULJuCuIXR=+y}!I=8rc1`N{6#fxSoe#@|z*U3y-s>KHuI*1CJvKM(nj
zw>>sy%3k)~?u6M(**%Z<wIt@`$}`&UpO*8-DP0S%biMcB)^SH$KI`p0zjAugE$2>5
z+N`Z+6XnTq&m4Y(?`Xd?t-W*FSmy^_Z8P&PwH;iQbo-H<su#bExcG=Yqq^cN-*%2?
z8FqUtia}%WMRLbDO&H=?_Pf!{@S(=cSY{5&;GR31^7!3PrG3+{nR9CYfm4Z}Rlj$p
zx~2N?l$yT();-(w?)h~+?VoH(eROPbmiX#m{H>m;17X8E4Hr8fm|fQ@d*WLkd;dat
z-vh^*<B#8(*jawC<>Z;x`G3pXy~DbDwK;pz&cn;M&wjsq=$!ARi|g-wVf7YW{E5Eh
zYb!tQyz-Fgt&8&drzZ|P_>at8(=<^BhP%F)_{iyZqq^g2KaG3GKXqK%p7|@+Txr@n
z=$pE2L4@V<=GPWkKV7>&^}CAb>FtLSmVA3b-t@Km@TR^OKL0pz<zl~X;q6VY*;DQu
z9C{<waL<u#FV3CWI=|!K>fYwbCoe@do=PfhL^~K??~2&76=6+$54n<V{EYmGOY4T;
zrnDW_qTKA12?G}HXn(}6;ra~@4;zJ3=Je+n{SYo-0|Gz*2mk>f00e*l5C8%|00;m9
zAOHk@4+J834NE@#<idGPB>Au}aQ|P==nv`Ze-8_UH2?u100e*l5C8%|00;m9AOHk_
z01)_95SXcHj%9Dcj|B3uPvnjJ1n&R$G5US_L%#|>kOU9_0zd!=00AHX1b_e#00KY&
z2mk>fKnZAghUISR{r_o3->*Lnc!2;A00KY&2mk>f00e*l5C8%|00;nq-ztG{ek_Y0
zbHYvFQRELF>Jj+<{|uu)qlahm|5gt%<P8LX01yBIKmZ5;0U!VbfB+Bx0zd%&&pz^V
N0Ryi@{@4QmzXywqjwJv9

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/root+client_ca.crt.db/key4.db b/src/test/ssl/ssl/nss/root+client_ca.crt.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..55494e66c0b0aae452fa1e58ff6daa0ee72341f1
GIT binary patch
literal 36864
zcmeI5eNYr-9LI0D<2VlC7^}I2faM(1L#$`_c8@bbJMa_|flvXJ=G^5LyE?$Qqs-UN
zDX7Ve@&(74W;DypHw+xi7lt4$#omoxY?`zt%N#A0%*eETp1W&x%!8T!Ddu-G_uOxP
zzvuZr-{<q}E$lJFO}jte?UU%rn%XMCM_W|!DvDCwOVcWqN-aO5<!9)jl><%aKz^mJ
ziEkFFRd<d1CDw3BrPF7sV$K@gj(I&sh)L0ZrO(uFx!EAd0|6ia1b_e#00KY&2>dq*
zc%q_=NlBD{v`-K{QkCQrCJH_w^s37#cG#yo=;`+Cd<PxM(xcoix~MpBs=at7J;gDT
zo>7o@{|pCRSU~3#7EH>|%b89WJBsq{IgWH%{>`+C3B0i8yLDP)P7<YZSG%P7-bXxg
z(J9pVYRIuOr0--xQFOLeYc!@(vq^`FhXuE*+UqT<bw4Wjq^O{|yn>02GMW^z1*HQ$
zN?;IczBiI+loAb(AW9yki}pGVQoKRKVxFYY8WU3~XTWxy_>ffLQ#2y4)9?n$H>fa(
zG3ThY#$ln=xV_#wsaBEETqhH#-k@S*%nij<lrc4xT2Vu`Oc79`h@ezp+m!r3HqM@1
zSUf$Q7Lfdu_f25srv=9(finzF+3=waAKJ(v?qcI`!{f$^n+)98a5EM+0&YaP8B3&4
zpe2e3YcMD<4_09imSGUqVGtH#5LRLkmSParVh|Q%Pz7#-_5%KhG8>4AGE0<MqRbLy
zmMF7CnI+0BQMQn=7BbdC##+c&3mI!ARV%4lN!3cK)<BggTZwW8=}9Ot1QScv%OX6M
zCF^C0XA8+&NZvy79LaDb!v!;V77pQAI6{UaWH_SF5q*yA15d{CWGqj{@`S3ai4e=+
z$%7$wZ^KzcI#)=%g|qOuLomc0f+3zg7-9>-5U(~E;w1+|Of(o`tbvg535LorLMoV5
zhFPx}hPNcpAw%(y5%OSF{K{d-uN;Q@%HcJALleu{kY70rO)Q6@iRCafu^i%44SSG7
ze7*%ke9{F&ml8@!SowEIPMSbpQL!UpJ1$;8E)gNKB|>YQoO-hhqw)@RGD?i^?REI4
zN-S>TaRUz^00e*l5C8%|00;m9AOHk_01yBIKwz*E(Bp-{{r_OyURW0p00KY&2mk>f
z00e*l5C8%|00;m9LICdn;Y0ueKmZ5;0U!VbfB+Bx0zd!=00AH{_zA%M|KQ(aSRoJq
z0zd!=00AHX1b_e#00KY&2mk@N|A%t`2mk>f00e*l5C8%|00;m9AOHk_z~CnU_y2=`
zk70#C00;m9AOHk_01yBIKmZ5;0U!Vb@c;kU>3dX$vbff`xLEg)14B|`7RU*B00AHX
z1b_e#00KY&2mpcq3jx1L7inKMRONNgbyi5VJ|}CD1YSZF@)7wmuCd7f1S;1?r`6}y
z{}xL{#-T!FR}P0DPD3YjrCeU{YwFQMOH9p&PM_JK*_D20zHj97uQqP4jnAnzM^ID*
zMI*gd7f^|azBbm-i$-+)e(@vo<41qtGIKlHzi|HXN?US%)yTO$OVhsD+}-0hMTIwM
z8-U5OMr0~(-Q3zt&1lkb3+tA&X8eSnToe7m*~@#QJtt=MXL41eW#w}VQ%=~|r}>tC
zG*ajuI<=vGm-No*&P9j)PoC)Xo3vp~iu?df9($-W`~6jYzGKNLkBQxjH+^vXcW?9_
zSFc-M^vvh`J+Dsf&t#15(RJtAo;h2V-e<h5-T3e}sr%%G<A>&XPwqS)_xKn4{HDmT
zCV6oHCR^U?J|cQ&t@yHVr<h{>u*muGYYEkBR-~QUJ-?*)t;x&#GdZ01HecO&B~2VZ
zdCqTtK7Hl3c71+xb%~H+U955*7=6`m(u6fBasx0q=40>b#I;>1Ld(YWl`#z$K1i@P
zY}t_9dEeQ&s}Jp2oYbGmjt@)TjbF%K9n#6yPaEc#-0)dP`NcC)`rTPC?RaHT!Own^
zI;=_gE9d%u<IL{*ao_0|H^pByq(8f7YtoUY$GrU1g;Q%kIWxCu%1Y0JJ^h(<bfPT&
z>s#*0Vbgcy&R)HXnYVw$1C5L5i7gQcqZUjt`%MvHO<K_aOpf1rho`Ob^QhgE-bcNg
zcj#JLYY&XsyXn(!^HwG{x%vwFGr7%Zed~DEXqzf4yUM+9*%q$yQe@4Wrx%|oJ^y9;
zgi+u7M^KST+_GEe3107GHMOo~>BZ-ygALoY8<r2_N^N_-H63d}em|;Gt~#-3&J7o#
zACeD0xUuYD*8WR}kCu(gZ1<iTesFY0--`3MG@ongEl>Rin~B=!IrX`eq}EVrnz$v}
zf{{;^t3GM3ElMdlsfnL}3SQ=CC4OIeByVfpM%U~3@BcbOqRP-~xW|xaXfw<=^cb29
zGygA_dhiJZfB+Bx0zd!=00AHX1b_e#00KbZUlK@G+o_v>f~X5ywnc?2i@Y{mnHM9&
Yl|@byuFMPSaAhlsh*2j+hd!713q1s>zyJUM

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/root+client_ca.crt.db/pkcs11.txt b/src/test/ssl/ssl/nss/root+client_ca.crt.db/pkcs11.txt
new file mode 100644
index 0000000000..bdbedc732b
--- /dev/null
+++ b/src/test/ssl/ssl/nss/root+client_ca.crt.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/root+client_ca.crt.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/root+server_ca.crt.db/cert9.db b/src/test/ssl/ssl/nss/root+server_ca.crt.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..faf4480a51f08ed862464fc42753d1002c886912
GIT binary patch
literal 28672
zcmeI52~bpZ9LL|WEXN8<9xYMH%P0X6|L@pk4aVVG6kP#1Jj$e9SZNVlVRseF3O1GO
zkerUe%&}0*Mk+?lgKWx-?3ijgbh=Q|4l+iaYy?fF{{R2JUC?S8N1LhU_h#OIzyIU+
z{r~=-_udX~cjr+&!|L=ng!!(z8k<LunP`S(nG8W-7>37tDBc5G2o{<^1;4UG^j}Gy
zNl7~usqbgB5j~9Vw7yf<uB*}|;R<X(00;m9AOHk_01yBIK;R!FkfGHY3~}rn=fVm{
zefa{Lvtps!UFfw}JIh0}i!7NX79lS`$1+=>eL_LL5bPHcY$B2pCxuXlQtD7`vpcGT
zBeWMd(7uZu<is3})^KecdpnJHd+k+@a!=49<N^n^_hJtbiHVuK)^JT=9Zt8~>!=Hw
zXf81EcV6sa789Ea*ib`U9J{*4W3yK~g5g2IsXir{SyszX4$capuqbbOX3-pBnq`hq
znx8kL)Iw&+F38Wd=4F=%nOOxzCCP#f;a$YLgm;-}+CW-F(qtx8GpU+sl?*W}q%e}g
zM2b{Wm`O2_6gE=WaWRovA%9675%Ca_e;(o@B4Q&V;v*trBqHJ@B4Q;X;w2(tCZcju
zs_FUjqt23FQ)h`fOVnAS&JuN&sIx?!CF(5GSeeGkG*+guGL1FSUK8y#(OwhnHTip~
zvxz#V(vg&sNHIxty%Hj^5?!xEbCzklOxtDJuFw{RwkT=~nMFZl7KM^gC>e$NE7V`1
z$H7QrjWpIsV~vz5_C!b$$>gde*_%l#qJzsFMp==KWPmEk09BINRY_7%C0VU1$&yt`
zh^mrc^-Ib}m4jiFl-fENW*QPk4vBw2>R=A3fgDVO`C=K!7t6p{EQgE@OpIFt`C=KE
z7|X!KSOzA>lALNJ2Q10?rb=?ssj^~FItJzZprj{_f2@5l9Xm;<!e~Pkc7zf|PHV8l
zv5fz%rM4R1(U;l09v7{b1+VKeF(}EseHeMWjl??_QP1ce#RY6Y00;m9AOHk_01yBI
zK;R!D;2Xu=r5PC&HJtc2Mw>5jny5=0&oCqLMuMW0Wah>nK7Ibf;_PCU+05LEGQ>$J
zUCWnh_+iEphub66xm+G0JCl4VCKS5dp2|8$@eHd_Tx=EU9Ju0kJ6#I}4;kwA;=i@I
zk<np>vHk1zZ#p=AYQj^6)#(Qg<`=VghN7W6Gc94h^YHz<T<deYik9qJ^Sbnt^P0-B
zTb`>rA+CA*#fIEjMnm=kHS99N1u+j7G9xbp(-^J%{jx8e%ur8E<~dx)-vJT`<J^wA
z#g4kNa$8Dyod@~&(a6VXpW!){`|~xUNNsr1$|)=RB3V`!!dyODG};h}?|?-qRh03)
zt8%L$QZXS#RMhGfn8C-68Jad5!tg#;&mbQg!TB(Voy!jW{GeuStuH;r<m>2N9X8_Y
zBU5(%Qop#nQd=82x2t8=MmF}q6VBBBH(xbw{WWLDs=lt+b@!ZhZQ!g+(rhan+VyGu
z=XGW2FTCKq!FDeGv+rY?6W(kq?A?|ceq;TN@W*mK>Wyi4z35%B>YSz^<GT$_xp8S#
zosEma(C!t-=RWztz&!Ius~>r=bD($ozU{F$=V=$5k}BHz_O&!`o$~1(-@%r9hmG6L
z-qIO2bpgBWzMiJ|tZaEw>+KV=ZX4Gz`+UcHcdj3?zv+wa?o&%ACR}y$(3rK_N;X~|
z8}s<yH~6;JvlCj|Ck%Id(9tqE_iW4VWeL~q%c^+x>##F-+tVuNedFE8@hrn`j7Cvt
z7`{lZAE60BJj?zzlo>wMm>J7VLuuTTCz9^F>Cu#5j%%hJ*}3aT{1=t)9jk1r+&iwS
z=f|2S8s0s%s;l*rb;<V(FU$~M>WjVFJ-#<&V6)*&`yEqjnq_xv^S$q%F73JFKx6E|
ztK-{CcQ+kA);#l-oUNOzTbG+N$86raXyerPJNr+1pFi`^El)3Br;9z*vuI`6$L;4A
zo8CGjKlIq>-aB7Q-!efHv1_2?tI>BKeK(>rruy@kcYNbVq->kHbjA6G?S0<y8)k)B
z&aHiUj`j1EJClE#7df$YPu%=pPs?k*b?sf#^YoV=$1k1h)6KrF;bnW$4SoG@BpYtt
zx8d38lbdI@?Oxv9IQH<_@cJVO#r0?t<LzD&ePUin1K&liq{}}e|KifR?6)axo3$W2
zGig+>h1-8TY|B9H!{u%^0;kOBPcr&`T)+kdfB+Bx0zd!=00AHX1b_e#00KY&2>c%i
zgz*}deEP|S@|tk+VW0p0zn0PO(bxVT76@wq0zd!=00AHX1b_e#00KY&2mk>f@UI{+
zS<@KJUV$G8<YJ%j%lGl$|L<V*JM?@06?`BGAOHk_01yBIKmZ5;0U!VbfB+Bx0ziNg
z(C`e)UD5mhqm2Hz{wUxD0zd!=00AHX1b_e#00KY&2mk>f00jQ41VZ`YEPl)hH;PB$
ze|)Hi|NH-AjQ*G&p2`1TJ;abV5C8%|00;m9AOHk_01yBIKmZ5;0sKGv$j=1~yb}Ir
H4*>if6nm11

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/root+server_ca.crt.db/key4.db b/src/test/ssl/ssl/nss/root+server_ca.crt.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..391fefa234b49726959a94205089a04167c44fb7
GIT binary patch
literal 36864
zcmeI5d2ka|9LKY{nx@AVMPn%~+fdY2)VD{DLSY)xv~*|#Ep2V^h?^#AN)MZ)QgFZq
zgpQ5};z5CNxKzLc6-7~09AI>Gssjj)_XSwW)B^;I9kA|uNn99g+8O`R&Mz~0`R(ub
z-uHdq=WVv#bf%eIQRWZ%nA@5Ijbe!56=@2JQWP?bLZMJe&qV1NduXLV9XpU-sq^B&
zLY3mW$-k!1XB0Ypfg<T=dQZ}pBr$26{!4v<{@K9>K^_PI0U!VbfB+Bx0zlxuNuVJi
z!H}6rg|7*To(5l|FC-R;Au;x<vsXH7RSu@gHm%IT#InrQelIhtvb5Y*>0)L$TuimI
zw4&O<%ycsLna<*}QhOCs>6le!vpXg-(r>1XY~+Q@y<Vp^*fS}Gzsc)s3$`>!MYq@*
zY9`0-n7*5hMTyh2T7w~*x{-9Kn=AUgO~K%-fd4Kr<V%Q}D|Hq*Y8g_*7UT}h)gp_y
z+(He}xPfRih#p^q+(mnV1}R>o!RHpMwT6sr${n%Y>Z$kDg=7uQ1scIf`63k-vAK4Y
z){q`sjXxM{^#x=Z^#wAK>P0G6Hn*daN-$(+Qx7$hEt3W0NEwxiY@3`P&c@lM&8)1N
z$cRXKO8X{q(v!zAN#G2NQ&xOv#fMgMh`U$?+?a4<#*GCxR@~&{M#POrYVwH`inK%#
zVGR~V=D{i~!ZIwvIxNCMEW%1G!cr{4S}ek1EULq8)Lz6NQRX5sQRav;N0d3D%n@ad
zD04)aBg#A(%agG@8OxKgJQ-^yRWqrYN!3iM=17$&n~Ac8^dyv6f{7#R<q#grk@a%K
zGf(n7$@3&Hkc>bwLNtSC5fGk5AY=qWMj-kE(HF=*n8;WY8EYbAO@ykXi4e!)$)h25
zZ^c<eI@kG3yuh1qhiHg9L_<7#G{hF7Azp1X#7mBbm}oS_SR*0f6Ak5Igj6&u4>O-P
z3~x!KgGKgWiFq)~ex)$xR|;c&rSQDIv5BQ@%&!#2CYHk3#8McWSPJo}hCN6jKHs7t
zKIx*NR}Ou0c-!A0IcXw&J+d7Sw&OL4$m>BUmse^HCE0^r80B}co0VgHZ?D5YRZ?)1
zh8uVQ0U!VbfB+Bx0zd!=00AHX1b_e#00JYGfF3Ul?*B*X_QJY=01yBIKmZ5;0U!Vb
zfB+Bx0zd!=5CU-j4<`Z;00KY&2mk>f00e*l5C8%|00;nqkxu~b|405F!wP`_5C8%|
z00;m9AOHk_01yBIKmZ89{Xd)oKmZ5;0U!VbfB+Bx0zd!=00AHX1V%mqxc?vddkiZC
z0zd!=00AHX1b_e#00KY&2mk>ffdBu$PJc*2*QUObnwsKI-kUrwX@Qi02M_=PKmZ5;
z0U!VbfB+EqzYqu;bsF2^OB6x>?e02XAmrwFpT*0I7U_t58CO0Ex1*c1iFwPWFY8O8
zG^uDNvdM?ZNKi9J6Y~E|cWytk&A)SP?TV=-<AYbGH#sNPZ_Rz9=gLWM-lL=_CB-1U
zRu@rGCY~RwnVv;UHx}w@(l=M+<lHjr{l0PH<-*zWf=|TzgYypSC**~V3Gq!@hhg%U
z#-*1pKmGiR-yG;2b29(!uKs=b^OuaOD4x6WWn=9hce{o%nO)!gz?}Kls^`4A^OPsp
zp7mt*Z?10o@r|WI!L&`89qnPGHm*sJX&5H2GCo|mP8glBY<KvM<h&OS^uFI0cy0Vt
zYuRJ-UVkzDyPBa)j_K^$^ywPq2b-%luA2MO!YMmOEf~1-P*3GEd$t@cIJL7rY}CXx
zY4QxiWZ;g66sxZ&P8oRAxnt_-_1;Q@w&dE~Engk1Sx|VSX;;%wCT}XK-C=$!Dfi&^
zqEA;bMS%nFmQS#s`+WI^`#zd{+`MpZ*r<+c(jyGR<QE$YS2*n*o7d7Ceo%GoKhZGu
z(kBOmoo$`v$&CSReeX~vD^@-@{?%_?Pj}D*u8wmmzia8?<J~7`UpD{5ZvE@F_Z|ov
zRdG#9UpY7Q8|U|v_mpovo^@oy^plqTuFRaL^zOt(?{+=&yK!HOruSysP$tJ+wWRYj
zU)<+ZzO!|;r-$x08y~N&X_;aeZGO*^XY_=P%D5)YXc#7smCWv}UUS90#yuZ)f8SKy
zdhqP#mbw{FxWid%dYhkqVb@S5&*+-_KUn2h_|=A8+nA&D$G0!J*|w{{uWU}!C3#OA
z8Cw#bKxs0C#iQ>OgTZ;t0dJ?Psk`mOBcJ^|dO@4|$ew=9>a%$$97c`uRVM}AdeKE_
z>imMYYaUydbIsZ`g>cmS)86~WbT#hSy0<ES#*f=Zo%^S=GDDkq>$2&TPo<{v)Ttjo
zH+_Bk*X=o$Z@%qWv0R<jT`k&^j@4{`W1wO3FJjhi{P%wyouQyl(Ua&5`Zc<ZK18pi
zUH_L$J@^CyKmZ5;0U!VbfB+Bx0zd!=00AKIF9~F+Y}DYNAnM|ltqJkU9+Ng++2qm0
YD|-ZWys}AD#VebUGD(%082en}FC><sZvX%Q

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/root+server_ca.crt.db/pkcs11.txt b/src/test/ssl/ssl/nss/root+server_ca.crt.db/pkcs11.txt
new file mode 100644
index 0000000000..5d04ea23ce
--- /dev/null
+++ b/src/test/ssl/ssl/nss/root+server_ca.crt.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/root+server_ca.crt.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/cert9.db b/src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..1bef7b32e1a48253dcded78d36eb0a22062511fb
GIT binary patch
literal 28672
zcmeI42~-o;8pmgn5D17tqz#}#N>Kq3X0j0$DLXDvc6Y%5VH1dufN`lBl*Oe|p3Box
zS6q*%h!)Ud>xNc+;_{xjved0$d1|W#R5-r5H(|>`Pha)**>mokGdJJ;?!Eu}&2PTB
z$qXT3A(BL;j2kCUPmwCQe9Q#Ham<U$#V|~d+V!cua|3loXN7vjd)RL>^)M&*r^f6y
zjA_`289ifH8I>3%897iDv>^hB03v`0AOeU0B7g`W0{=q-UQ8y3V~tNqOpTSPVrEGb
zV^bB1;Ed?x#29_wP=D`mf9{wGe*TlWu#Fouf!o#2wUd$r&)!oHDnvkqWNEZ4xvK}W
zmjZ0lRp8tEF_@e|*7yuKUXc-<B#TjYDd_c5(6;JokOXP(O=of}I*%h!p~#S>cZo21
ziD(*iHN>QSZV;}|v9`unr6{G*$+E8DT?S376YlLJ@$bnYF_s$~I%d3g=oIca|0&#v
z31dPc{J{*qK@$QbV|>H8-abL0;f`D>LG2{9^QfH<Z0G<U61c>mDh5?Ctb#6L0Vsr^
z5P`x46k<@gf<g+4XsU39QiP_2iUiOg3C%n}g(QFsNdO&^074`Ilt=<dkp$2p2_Qxi
zF`(3jr-=_L^E5V8=0Rm1ROUft9#rN*Wgb-KL1jK1%ZFq6a4a8=<-@Te*eZgpBG@W|
zts+e;R2D&H7uXY0A|WOoJYF6F#`56t@?gw-=;uQ}ANmE*BY+-()&ph{5MUMoBqM-i
z1W;c9^#$-e2;o>E94mxlg^((xNf0~|Os+LS^kU#8VCNW_kT2j1K?kh~I%rKWyVe9D
zXiadmS`!?y)&xYgCcvsOAs?;TJq(i4db@{-dJF@nMAN~gI|i4|7)0IiQf6nol-b#r
zGJEvxoS5=<#!H!<6H{jA#FW`NF=c{O12Ir0$TzJCl1^*JcAK(pGp@^oNu%i--5pLe
z2q#u3C1Rrq!k(ltIsVo-rde9jlBqlTC~1aL4(m}}*L4)xWzwmo)&MNG#?;QxE5eLc
z8Y&GeC<ASX03v`0AOar>fu#z@e1=*7{-#(?uue>BGaW}?)&6}sH9k|#%UgP2wll0$
z)nUFNIJN_uN@U@i2z4%D%w##_jLvB_#&IJ(jPN172u~(Gf<f=+5-w9HxxU`ui841>
zu29CO%fdn=+^{eSH(f?m6pBQ7Dpv`5DP-xHvUF~YEM2MK7*ii~NS+JHr#_+xr*e!1
zB0@k4v{k~4Fs0#4olZJo(6gvV*D2GM&1gEv-+Ez<`pndD=ZUk14ay1gPFS*Wef?L5
zd{0|(N?XQ{np^cZ7jKixSKP`@1+tD_vGJXD?0B-Mes3s;F4$8c*&pcn&8Nc*izE)4
zVhV>{n_=_s+Y=-5)(CHXRxoV!ocY@tiXOZ+Jom6YE7jgvF>iig-p?wZ#E~621Kj)$
zZhf9HDyKHqzHM+2Oa0(juB4@nU;G;_HZP$nNhbcGw9stvmCUx8akbBOx$fRD+P|jE
z;2-{~ydmF)Uu`LOGRwVxf8EuDh0eE_A=r)0Blc%z<m_yc?q06iGlk_xJiZsw#J*TN
zX;#5u(<h2lFEiDvg4t1P50z*AvLU?1`nqst_WL*&ICZA6rIYEMS!bn_Kxz{mM_<*q
z<kauUy6JYWdS+cVA=f$Egcs>acxaMN2$L>dF8|$`mqC3*(#a;>l<S@2Fu4}Ea(^w%
zzqO}q!oI?4H;d)_>W&Y!ZNPV>DEHB#=D+x5S-EN4*vAY#<)CcV+$X6&eSdc6fmjv)
z?mE3S8&+J-Tk@mP>gw}$ZIyQy9$8&|eN~H^B`D8KbveDMz;#MZNz;nbo0%`>-Z`??
zV7%<Q$EmdF$br=Zylk2SY8QA6Z;;nlj&8a%blPof|4N~m>NloEagp5;@u+bXI~^sD
zj6OFDZFwB&zSg+ma?2Ba<xgSr9A*!>as6P7+`LM$#nD2Qu;%){E#9Kn`F<V&eDT89
zo_A!jaS4VyC9l2{I^A{it!!)W_<MVfOI;YRF|Sndg-`3UMW2<Q{PN@(TG)5)0TpA{
znZ7%7m|9sM(dKCuG%9h_CgQ%*=PkasWY!x-nNb^P>MwA_Y^SkzQ<)W}S<l`%iD+gf
z2Att-g{QV(8$Z_WtKejhv)3ks;nWPFJ$G!JU0h<_l5+XRfZEVG<ptmKeonNAAHI8M
z(qppV%)Z3|lY|`Kyfl0P;3CFW24iNu!Kh6HZ#cLf?*E=lkHLV<E~-u~q6$T_Gq{>Y
zXjbT`7^zcCx{}DETM=0_<`y~)r}cf@@BJDjta@Fgg5GZof~oJGk<?q7P0z4#J&d~6
z*%;+Fq=9#ovIRB2E@x~=%kpp%WgTr^Wiaqg{phmis?3IXW}5Nz+Vzu)aLco66J6R)
zek<Jj%J1;9)>_NL&!5RR(<F1;rP(s(M)$UMqbQF(dlEm9zO?<<L-TyQlf}W!r7o;b
zRUxd^ewUifOXT}9vX{MN1bIE!oEu>6o>ZltZ9r6HKbpSoVn?L-(yA|(S9LTWI&sKy
z*cj%lr@YwW))VXV_m2MOk*sU$7xo)*2zRTp9y<#!UDTLs>*LG!+&076XWEFPliQD;
zPuMu{RPN1&hNp8~?FKxlvDv_k$8Gt;&DT^Orx$N~;k>QH*;ID%==#8b7wan)*bP46
z6T9_}LCgGT_xQ*kGm2<*9K(xDi2g)BYPB6QkfBG=ar|{pX4Gc@xIT^}+-d6`J1iRd
zrPK3AjB)j4<@L5V<ImrV&yBAfk<{3fvUc&gr^{-$T`hF{+%(vW+}~>Xv0`MiUdIkj
zOUcZ!DfxVbW&Xko&mtOUo>g03``ET5q9V8MUjD>y{Pu2_>|HAMw%JiRyJ+l%s<tN?
zyINMbeZ92M$g-w!c23lllJ-o|=@$Nq)mF_3$2@jBGYrc+j^4JKfA^eWm3i_F^B=NC
z4s<G=I5)d}@uAj?k((zO_`lq6V2b2MPMPEDNMqM+N37#sJ>wVLmsb`vetqkT?cC{E
zMw16GJ`nBjNo(72N6xSlo41Y+%%50Xv9v)wyzT`{Rc{xjBDP~04RcH$N9rx6*Mh6*
z-81qHm)1KkRm@^ZkgvDHN6r4UQ;!UGcciV1QQ(GD$P9KZ#%^OjVLzk{v>^hB03v`0
zAOeU0B7g`W0*C-2fCwN0h`?WqfB~I>gTLP}pg}!Sr$d8!0!q`TGg#n(pXUBQ9%Co7
z<Jm{pX@9K)MA0GwhyWsh2p|H803v`0AOeU0B7g`W0v{9s1|7p0pr8jb)F$|Q_>w>X
zrNer69nJl}4aPo9-Tf!CZ9XV!C>TTl5kLeG0Ym^1Km-s0L;w*$1P}p4;7=nkhM_jY
z-^ahzG2YXyKOH<rpuN}o|7wi-?tdM-hF$%qVMP-m0*C-2fCwN0hyWsh2p|H803v`0
zAOeWMA0(hpHwC}2!qC3bwXZY_x|r4Xk9uhS{(lo=-=psTZ?e(v^8Z2dXc!`Z2p|H8
n03v`0AOeU0B7g`W0*C-2@P8rD{T~PL>jKm-8?*ZQ0l@zN-h5Kt

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/key4.db b/src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..633f26005c9734b998e0ec8ec699cc1c0164be48
GIT binary patch
literal 36864
zcmeI5c~BEq9LKXs$N@s|A|O(ij9L+ox0}r&QZ<CAAcCT_-f=^MM$sq<mU@R)q-w3T
zo#NDbPRC+LJ43aowPQV6uiB}tr5;qJGunD$XVhAC)b4vpx;oatO#i9OFEjh{+u!fK
z@B6;bTNXCVz=+{FZl8-T@{~;DeY9Q@E1@XK0GgIaBr@Sp3rFas5CVDVM0lqji=P$B
zB)$6n5v}=4qKZtHL^Wy-L~V}ZqdG;_N2W)9@~lCS2LeC<2mk>f00e*l5cq!*C{`-9
zNlBDH)yF%EUDI4XK9l$Hp?8%v-)0$UqeogYa%^-cOLucS>0$X<LoNBE=^?h!bU|*`
z@B$m1mrGmoatG#QSx3_OwqZFItE~qu{A4<f3B0i>y;TaWHHnhAr#oF`-kHTh(ax9p
zJmlOS(zi3ANS&cjXtl}ISkj?zD(`kq_j-qwxM%S`mojKBD>u_NiY7&DLF_<x;~B)J
z42U2auMmx5-r*`1yC|N}AjPLN^eF@73T<LCWe?acbxd&;`b3S0Cp5f)@>41dVp6O!
zg*G9y8n@S5>M9Xs<WI;1s!yqynUux(lv10VOfC12EfWRANE(z1Y@3*G&c<0X^72Ra
zpm`)5!oKmWaOiPN5;())lo_9z@u``d;x1+mHwN4oabv=b88>}!!{f#wG<}E^3baHK
zVGRZa=D{iq!ZHlPIt;=>48lqb!cq*vS`5Ns3@XHJ&|bhFQDy@%QD%uUOO#on%o1gm
zD6>SFCCYj-R!_$2$yhxZt0!ZPq-rEpBdHom)flJ}Wg}5Gk)DJSLol&qy)43GS+ZW1
zc-E7=p5*l;&yfsAGF&i&XW<Z@g(GA*LWU#y9MR{<J{ZVY0~u=|V-19=potL6;K_p_
zc5lX6L^>C`40=v)z#W1i?hp*|?7<LQ2!?pI!4NMw7-FKq5MvF5gikOOhY?c2tT@d0
z*f6{$fet3ogDK>}DEbw`kY6DT^%cU$`i3SJvLU}h7@AlJLlX;OXksD6mm2mUg!p<3
zhWMfjhE6ebiDA({A-QM*eI2452e#uh@W|;vC`B(-Xa^-f>&7U41=|@h#?SUD{9Pp)
zH?g>Z7Z3mfKmZ5;0U!VbfB+Bx0zd!=00AJ-QVB%jg~9WGOWj^r7Z3mfKmZ5;0U!Vb
zfB+Bx0zd!=00BY(p8w%O00KY&2mk>f00e*l5C8%|00;m9Akgv&!1I60-(y%I5C8%|
z00;m9AOHk_01yBIKmZ5;0eJq0YXArU0U!VbfB+Bx0zd!=00AHX1b{%xCjig?Eq{+;
zg+KrZ00AHX1b_e#00KY&2mk>f00i*g|5ruUNi?Hkw#CFmyIXzTs#DZ#AptKS00e*l
z5C8%|00;m9An?2p@at3&mhv_duX~cc&{g8Ivz)<!ig>edM*bOBALL(%#wpa@D+X8G
ziKZfAP#&^~r>zhtr#(NN?8&xmcsVLfb96+!xl&noI(v#qeXz?J@5X+etA3SIl$4@T
zq(T)?k*Xh$<+OI?x~q$-5B2zVTih=y&)lDvG~AeXctxLt?voSVuc<8E?AIy7n>07W
zr1IlKHJ5uW`l4EX<wX2C^O=41j;+_X?MmOf>`sPzOQ%gunS9rNqnk!8S&~|P(XC5;
zWX`(2BDURLf8PWBkDiNJa=Eo%rwD7(VQ7ZQS)K(CW|)j;rz~Av-P$?lwshyCo8P^3
z;no=II_awV#>%EljyU&eXTz{l*T$!{Z9BepNBq7ImW@uY=(&8#>clZqJ^l0ix`?nQ
zg}rZjyKn7Ih;B5+k3H34;gB0!(l@=ZA&$#ATr>H%H_qoxzts1&rcCCY?U^}yM|=6o
zn*HT#GiTf`NY$myy=mU%TzqQ9XMN9{_Uq(fO**({n9Qy^qFwXNn8K+a9h08-p1MD$
z)0+52wKnyhvJD+Oepy=5l*wM#x7`1Vj(%|Y`wqwF?BNUz_Bhr4c{^A2zF&BGhi=f1
zew{3=N#S44HBHh|wq6>yW)j`=aM6OvdrFV(ZWs07t@=c7L@ZmqZFbJ@O_^+{%{|fe
zQ5)UZt^F>!uU#zNw{+R(gWsOm^&JlyzENBIqF*NsYto3CVX|Llzt^MJIuEGI>*rsP
zX=OT-EO}kq)9+=kj=Yej9JsqllS_;4Hr#2LFt#YJt|p_d;LP^Bw;pCryka`Ke_!_e
zxb^-nR74V2-fjl(^}gyUalU!aapc~>2?PF|*}L<kF%N5gNQ)J2LVh$&yz4}xiBH{x
z8Y`Xt<0n(g8VAKM9Gc7B*gmcz^~&j8SFHsHFIn#uAN?1bi3;_^ioujiCa1c~WA-01
zR?I2?Fn^WHcV*!+d2IS1Y5VS#RS7xelV)0K=MKle|5s@eC7N5BG)<zWR#T>_(^P3j
zKQFg>@CgKf01yBIKmZ5;0U!VbfB+Bx0zlwD5_myop`QH-qAG0JtPEFn7!={k21i7=
YvV)U{D;s!OxUvyRqhv|y(B~3=1DlPWL;wH)

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/pkcs11.txt b/src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/pkcs11.txt
new file mode 100644
index 0000000000..9e34f7d8ea
--- /dev/null
+++ b/src/test/ssl/ssl/nss/root+server_ca.crt__root+server.crl.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/root+server_ca.crt__root+server.crl.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/cert9.db b/src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..6dcb06f709163abaa8ff8779475330009cb10925
GIT binary patch
literal 28672
zcmeI43se(V8pmfcArKHlkv2-Lq?ScMg_*pFVlA(LXq2~a#Q+h5QG_Il)moA&sI^ko
z$H7wT3fk(CS}GQl>RGL&*1B$2cV(?Dk6j-JEvxS80xGO~?@hw%P|xnsJ*RHJIcM&C
z_q+H0?{|N5@0`penWO}b-lUT(%+6h+HA!TY2Sw9Vm_$NR6d&!*Xm@N*$iP0wMmvnh
z9QjmG=pA=a2PJTAq1^6@>f9>bvfKhu1~wo71b_e#00KY&2mk>f@INFFCJ>0lKJ+a8
z(hOZ*`eLm<W2w;?Z%#Al)14y|)#1r%N$j*J^-KvVlf+GvbeBu~wHzxAnCL_lQiy^<
zo2D~#*AVnkAZ7g(WC2lpf%ruqdLC(SG^b_h(oNk8PJI;YrTsNHmJ0}H1ma<iap;Xk
zvo5z=gx^QRR@h%d#RU|`(avHYAA0i=lQzwu>u%m{@a#It;Sm~jZw~qlNql1L)bPYv
zk}2w0l9Xw&2`OsaLuA~vXiaQnvLrkrE-`tGM9ZR`L%S61GHeqE_Hfvx!dVs0sz?@B
zQOR+lz=;wkAvjUtWE@VkI7vgvI3mT`QliLW4UV<-gH<>d%Wy2#;aDuhu~>;?u@uK*
zEsn)v9Gi|)dw90^h_cjX6J;q;mJ($tQI-;ADN&XZWhqgXk+w3@Rz}*&NLv|ct0bjL
zQmQ1SN>Zw{l@etoQ4S$B2_=qTl9KUCS=?4i#w#T;%ZOh_{4(N~6OWvD<aQ74Mb6@0
z<b;fzkdYI8InkGs^PnJY6{M|#v{ewQNRwry9PZq1;^<Y_%aY3JI)zLwQ{W1A6IZaC
zxOcmWL$I58w008@*=}N@b`xW@nS_ts>}f_w*}Xl@l)akaQ(~(S(i207BL-zpyvTIK
zi%dsdWcI4-=oon&@gmdFF)|$;Bh%3_GVxTyF(4DqH@k@^o!!jnF?BuW!fumH8e848
zo^aA|I2j5pn~}z{0US>tR{PMD?b4ECKzH=1TC*ve<WsxXbt>0wGU!t4f-kr3XlI=N
zMY(NqHK7A+KmZ5;0U!VbfWZGffwe|v72j*{U{9(bzTaRiUi};cWd{%BwD~-3hsV^Q
zd}rQn{C!en0!{6uX0ulM1J+W=x(kGX1(OQe-D%p*iDDzTFm|GVN#QetLXvexlO!@6
ze_0`k&o-Jeb9G4x8c9-;Mv|*T8KY63y;NetwT!yl<+@x+x-Qpb6uYC((3~`clc7()
zirHd!xssK0a(kBbVm*1ZpkJkaVK7$ot;mu&8|K~kRJQx<R?AnjlY^%(_It4)DSXje
zJ4>40tBU+`g!oX~)K^#5{W>Jv;}7S@SD%Uz)}9|3Ip_EZgR<#BqL`8IKcYDpGx4)m
z{9Ma5fghxo`dyqi@^9ZyPg%cJarw1kzbz|Pl{J@Nd*piNdZ%@1K(O)kRWa*-%!|;E
z?J9U~eAK7A@0njMXvhfY7#=6ITsvN<Y3q<x{F9fleo<YPPWAPnQm_2;%R3e<Y`FW;
zxP3b&sq3p<ey7e`|I+8l7usrqyb7;g-F{)wn&8WV1nSbR(Fd2C3qHJ|-M2As|14n?
zd+SQV4bi!V8H<Y#d)_uK4fD!-SiCHCTUCwq?>my)eEzIhu<mJ`3mTni%KAL-b=#~%
zbHw7I`sqnDV9DdA)PM~rFSOy3!SXSb?~JWxH0hFTlP-*#$WE|LF9n%ix!KwO@f<Uw
z&)GaL4;S&Mj?z<mE>4~7|6aUd!s(0Cl4#UJV(*=r;=fSe_*PB!&gh236*a}bmHwz7
zmN{zQhgr9{;;%l=kDj3rN3PGIS7R<JYEwMr)fbG#Lq71>dVBwSGQC?PGA5KqGu>!3
z1Y;1RZObS%T^p31Yhta;2-eCI{D$Gtyn)BvZ`rU<jF%nJXJN|wu3q`<r_h6y9@#r=
z+KED|T|}Ylkt+```|8#8|Jcaikz<_@q_ozyZgv^+L(`<{dwI*7GX**Ba~n!#l+)g)
zx9LMVzW7{m;9=C^4ebryrElEL-o?|b2-U9B33i5dbh@QZ*uP)@vi5=RpRNxr^8cbD
zzV%Ru@Rhs-;g+axTZdL=e{5d2;Q>D`?AorvXrIumI?FN__Q<-MbGM)Cny>nH^E(^s
zx>~DFR(boy3KrjyW>mDFEGarL>5oUP7faR*8eK(?uk)F_m_GDoOQCN>q-<i@yx@pA
zqibh&)_${S=a5r{-!(ViSvk)Cx!d(4cL*|RU)iXkTaTS!D$4E$msJLP>dw`c#6;gO
zIkMV+_{oTj-9Nartx5~coc|YdIgg<!y4-^u%nm{e<)tBfCzhe<N4=S$3pKeyPGLiN
z+iwNF`Kxz>?%m{1X{xSi^8GIJn=6@xna4(FwcJ>;E&t4&4Gm=%O2@q686U<SZ1;Y_
zIJVWPYp=Mia>3*!MKYsz(VDY&Q(6|Bws>EB!M8HyNMYlZqUoPS9oVBeuvQg5a__Na
z<&)3Wb=)?8)b{rH_t%!XdDpirD@Z+G*|}W#Wt;5nEhAbN9iOl-nD1KCRr~#jRewF>
zS~t{iY3SG1u|t9mO<%dLGry|cJa*R%7xjZ3pUl!+DySawXukWnvZFo=AKsM}U(G&N
z-17eA^S&$RTHR(2&;KMX@a6W76Jx}FCwJ|h8dEgA;>g-&%c#ct!n`K`q&#*HWo};K
zacjO)KGT3#)05B0pIBN?yp{wNnz+dDz~@`lyi+$__I2fKN;lH3C}c)-of373ZleQi
zKmZ5;0U!VbfB+Bx0zd!=00AHX1c1OZOTdNU)A(sSLk#o;l;_Owh4_J=?f&0Di43Bn
zqMT=TfDkwk00KY&2mk>f00e*l5C8%|00;nqpA7*%L(xnO-{L_(g&zq-BOT$B>)7u9
zvnbJFbpN0Avq1%c00AHX1b_e#00KY&2mk>f00e*l5O_uj#PTg(^wanc6@#B6@Sf`Z
ze?29-E@~9jKci?NY#;yxfB+Bx0zd!=00AHX1b_e#00O^A0?v#le$xtLKk|k#D&fE{
z^{{>a-$;qBp!<J#EB`NYw!ol)01yBIKmZ5;0U!VbfB+Bx0zlwdCqVvjKz=TOUOy`w
I=mmiP1_=>&y8r+H

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/key4.db b/src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..572042e848fb394849dfc9a4aae5f811603ca074
GIT binary patch
literal 36864
zcmeI5du&rx9LIatuIpo62M!9(y1Pyu#mUZnwH-pFj1CH;doW}J+;+QlP}!JU%OgYx
zg^5IsOaqRoXh2ax!c!g+U?egEA|eQziaa#n3lxL+Kt;XhwDm%eZi)Zs@@vx5-~Ij0
z`JV6joZGwIE?LJH=J|s@y1K5RRt(adB3VIEis3Y^P$-nrQ!72A549Aiq6g9|bwhl+
zP^lPv|Mv#tFA9xrs6zjp@g4nIy{J#qoze}}t-IYI$O8c&00e*l5C8%|00{gy3DhJc
zn9OD>bZ=1f*7$0DL2;xQ6r-=2oFbRA*hLpRN94KaXqF!6uc8Zz+~b@@rSw==DLujC
zE}Y<^^F4G<z9%=&ol{H~xeD@}Ij&4v`pvYK3BRz`EREWfW2O}T8CAYHf%+P$ST4>C
z){*1#sD3#UjkF`wYLh9QnoK%WP8a=EGXjBv2LCKE=u3#0b9+X*N@!BV7UT}}K#@VL
zb$C3{m`F5gM6a(#?xMa)gA{Mk;H<eSwJ9~7Di7P9>3!H&8I(2RZ_)^a%eSa7h_U7<
z)uz7D)%XK}nZ5>DMs<@+xO$6<gRwqdL?xKg)2XNH$d<_haugSl3U8a7@5;tGN8}e3
zXVM~)p3=UFtn}n?OcFT5;FJR&I`E-`9O5nx9ybDRY`C%G#(|q`+=#gGN=-JALgAJu
zBCNrn@H|+BL0E=CScgGah(TD1L0F1GSc^eej6s#Sjo1tOBg$+zCdw>PW{EOOlv$$8
z5@nVsvqYIAV>vRGBV#!-mLp?rq-rBo8>!kz)fTQ2WgAhplb(bULol&qy)43GS+ZW1
zc;-l+BYBSGd6MBthL2?MEIh)q@PrIc$nZp;C;B|u2Z4+g$XJ1l6$n*H6CswtlSe}A
z-hs1-bguLX9M1{3LnOo<A|akV5@HLH5U(~8;w48yOf(W=tl^OGiG=bnLMoD#huLlz
zhPNc#!7h8SM?KhNzfu_WD}~X%Qg}n(=)_Vs>Q@S*6H8%qVkwMHEQR<~!ycp%pKp;6
zpLCJ1N)CN;Sp9cMPMUCEuWZMQ?NkXOs`4Ua<>J()QR%n4Fv{=Xaz>8vy}btiR59Qt
z88`3%0zd!=00AHX1b_e#00KY&2mk>f00g=#0Ucf#-2Zpi?S*v#0U!VbfB+Bx0zd!=
z00AHX1b_e#AOzt4A5H`y00e*l5C8%|00;m9AOHk_01yBI-Jby5|9AgAh7|$<AOHk_
z01yBIKmZ5;0U!VbfB+DH`+qnGfB+Bx0zd!=00AHX1b_e#00KY&2y}k}aR1-^_ZU_P
z1b_e#00KY&2mk>f00e*l5C8%|0RR7gjqaqvSdz3gDaqhZ+@F}HpDQKc0R(^m5C8%|
z00;m9AOHmZF9bpsO}ukqPes5#wY<{T5G-eT!Jf_A1?h-<8CNz6EkIM$+Chs)FaFs;
z#V4VB<dhE+5wD{65B%ub#YHdOe{jq2lgC#EesWc(=|3BhrA?j0?%U{|x-gES;wT#F
z)S9qLoc6|8MfVLXHyoKU_{`Fb*4e`r)vs+!Jl1@~zp8At=hB6}XWHk5ED5nqI=WzT
zuRwj)K6UN~Xh(4S`CfOPTQ<?AyLh~1{NbOyYx;RstnbWZX8-!emfaKk4^PP3)Z_AN
zQ&ntMYVGGs-`+o1ZJlL!#t^coW192|T`>90plK%4z>?PMy?Z|Y#-HsU>I1DG@9f{_
z#1yVKTix&6ot>F%PIQ;f&v<m7dE}*hy5h^c!NSG$Yf5&^_%!Xr;wC%yK*$mw)1=_-
zg30zWWHe^Z`|YbFucr2La^cmNi-#TIdau0eA<LAem4DQCX7bP%DaU5+?12heJD$B#
zU*FNAPvh@(<}~Mkr*@s(wdc#ikVO^Kq?hl4$)J*5mDGIj!pM$m>+EemG!1!5Tj*(>
z{-nJgZGKq!`V*a*d`nz7YQ@m@-r4p|UvE2RDKWS0oi_jX=AL`r&1@XzF$@b?lrc?8
zUpd$L8>j8!X?x|R;H5c-#|$ysPc3QesC&<U^uUTc^wzPt6`_pIOfKL2;D)i|veL@V
z9B<bJvo|lfo32Tv_PYMqasKjS&s7IQmbjQEZKw+-%jzGU@Ufwmn|!vi$L^J$7dMP`
zTy?*Bezf6QV7pkg?0RP=pS;iA);FVL$G6umzn;9Yz3gn#tG(v7xIbBTXzLTdz8^4!
z`cd&_eqqWZVjwWPuAyp)v0}{Jl%wOc)&bd##nV<T+HKOJPzcq^R~-YYxaA_W?X{m$
z)~x<KO*>}SuUVz{Y??mntELG<Uzjvx*A>lyS5D9R2b-yCZN=izluxOm2C0&AHy-*r
zLwjXg!h)2Rf)-V>D)+7nKOQ^r{i%6dnhw@{bO8VTUt>&F7_S<K7*mbgjdP4Ajm^f=
z|I4Kwd;$R=00e*l5C8%|00;m9AOHk_01)_>1nyQksoQ^osEJv2B*ZFv1$C^l;Ej(}
X_VTJ&WkFQND%((;UTM}wKbQCmpCXce

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/pkcs11.txt b/src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/pkcs11.txt
new file mode 100644
index 0000000000..b54121fc4e
--- /dev/null
+++ b/src/test/ssl/ssl/nss/root+server_ca.crt__server.crl.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/root+server_ca.crt__server.crl.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/root.crl b/src/test/ssl/ssl/nss/root.crl
new file mode 100644
index 0000000000000000000000000000000000000000..1d345a098f4488bc747deaa0ef788d7168beb7c7
GIT binary patch
literal 393
zcmXqLVr(_YH{fOC)N1o+`_9YA$j!=N;9zKHV8g~7%EHWJ8j@OEqEM8dU!vgbsF0Rl
zq!5r_T#{at8XV}O5FG5IP?QSf6c=aa=P8tclopp}mZXaF8d?|{8krj!n;4jyMv3#9
zm>HNDnn1Z|)-g9RGBVUyDtwyVe{1D7zqPZ^SxI)Sy>~!W<pJaJ+>*6S@zp;+c5W9+
z^Lod^S|Z)bS@}Ni`Tpa})~8e$KbpomWoGw<j^>Bllh2*f__60v-OkD9uJ?Uw<TTk{
zmS=us-bBmDYa3p6Z@O9bv+~Z)sT{tk*KH0LCdCP#6Le5|<94^kM*Ttl{XHHp&#Ok?
zW?0u_DpK*4O>)g*jb;m5?;Xo@d|q+aiUfUo7iT?{_rZm4@7YV92Ulqo$lkcVF*#r2
zXz>Ca$%>3A*Vis^H2dH0V&i6PQTN~OPHL)m2G=s5-}_AU9$7i>`SIuP^gnIp_kxXH
dbZjc_b^6{}Z@>M}ghR)eg7;aw?eLl=1OPoRrTqW^

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/cert9.db b/src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..1ea3e8b64630be9ffe7463c1713556679c180e77
GIT binary patch
literal 36864
zcmeI52V4|ayN74C!O{k?EFxt^lp<xevWkTwy$FH@6>(Wsq$3N84Phf<M?`Fh4HXnc
z6j4OYCm66sBMC+WC=oG;1P~jd$eo#81dV=4F61V^+%vkf@0{{KXP%jPne)!sU2iY9
z;21G;USxE*Fowy2)FBv#teH#*f>f{<9eZ^zRLr1sZ(#3mFZ)ZT3S@58s*1EjG^GYe
z`8iUioUa_BY=Uio1rPuP00BS%5C8-K0YCr{_zMYG(`XEa9_$+&5h#umg$jcMBP0^f
z*nqHLk%HY6dmA5nrnAQ+`x#6kk2%?c`5~WaBxIp%;|WwkVJe{zCJYdVeJDZuNP)=v
zRDokWi9%xx(}Vqp`jXgy5V0ucg97y<1$pkL8Z4A$Y(u6ohIa2qutX9oj{YD*`A9^T
z`KgA0Wt==2R$%Dq!5hP4gaKjV57j>yB)N`{jjfw~Zw|qMOwTFK?lx0=nXdM}%&8vE
zUQ_My7VIW_IJi06`7mv4Cr|M)WeQR3#ll`}?8U)tA^}ff;Yk8~Q-E&@h)ukRfQzqq
z_==COEb)~9UyZ?6LVOi~t;P^isBBFrqPPYNm9>Mbuuxovh2lCa6c=KlxDpG+rC2Dg
z#X@m07AnHm^6ts{M<}ypHlfTWl-Yzbn^0yG%4|ZJO(?SoWe!o7L)7IEbvZ;`4pEm+
z<noDJK9S2Oa{01cLYYq}TM{J+N-P2so7i7Aiq~Zm`^zT!%puY_L^_8^=MpJgB84kY
z!CT>?cq?3j43{9oCG@$3K9@KSJfbd-sLLbj@(8M!CW^9Ic;j*t@4Wy|MTx>9F^|LL
z@bCh16E7e)@z&)g-UYdd@2%X#cUf-YMCB%qRb~==<YrGbf|NY9ry9RkHT;ms3Rw2^
z!Lqv#{GR?|W_N!vv%4&2_A1-mFqYcgU(D=o7&E&Y#?0=9F%v)4@IGKBe!j^~{G^kc
zfjy?U$DH@UBu*Mx*?^wz1mN8X<O$Kh02DQ5k!TEiJs6U?mIYzhh~8fq8xu)v`+vBu
z{aGJOGUjR(ad(Rk>S5$9Zqj9MxCs_O01yBK00BS%5C8-K0YCr{00aO5KmZW<_YhE|
zDq%ZANAe-09ce)xBQ?km$aSO?Ig2HM1rPuP00BS%5C8-K0YCr{00aO5KmZT`1pX!h
ziew6Gpi{AxP8ixtM<~h-eFef8X8o8ZH|nW`p*4ISMQ(`6grWJ0M^YeD=mwgvxWxEh
zwFpuzLPo09sHLm9t5H=iAZL*9zi9_Svw#2~00;mAfB+x>2mk_r03ZMe00JKoppYS$
z?np^ghf!<R1ausYJe5LL;rWOqG0f=5$QY)b4gR5Sre~xiCMa6$?d8Vw_I6`Ni?I!f
zBsemH8G{#<#A0*B75hm?p`UbU{iH+fCml*Z>5!c%iGyI&mSv4jkR2~e;&}bRLnV%0
zD2`@|#L+Plk`tyx?++zn{I7NnLh=xQL__To!ce<{1R@1k5?BBMKmZT`1ONd*01yBK
z00BS%5C8-Kfqw!41+oTw5SmHHLm`TN8d{6Og2fRrvZ1vCF4u1n2waTPr@l#g4g1Ns
z9LbH6s7*&5Sh}b-9z{@A8Qd$#(-YNU8KC;ID8n#OWO#UFgjs|zTx=c{WG0b>;l<4H
zm2CchB7~$OxyU7K{(mKM4#`5+Ac_BkLk#)=2mk_r03ZMe00MvjAOHve0)PM@00{g`
z2y{m=<nM|D$fICcJi=cjG#5q3D9CeY2w5M-r*_EGsq%CRUPBfokmr!)IV63u3mqHm
zTgY<FL=k4fh(I%8SPT&gkl^aF@qZMA)FEX^Ha6}*iflx#Aq_~>zl1N?4L|@800aO5
zKmZT`1ONd*01yBK00BVYZy=ya=E9G>O6jTUtKlPs8_j(q8pb!Y-ma9*V!(5KB3X4;
z7vJy*F8{UsFqPz0J>~0#vPlVeF72q>WIG#^!A<t0OO1*-oeS2BBvfLS0iJs<tuwOi
zJ8ys9Y{sCdE6l9yhUJiK(g1_ZrGKtnRg3`@+6yVqQJPLuqtY?+AGNHWM_oo4q^711
zt@nfmC8`U0^)6AJ+iU9!rrH<M|5&oYFzb4(B=(z#y&^BDl&p(NNwmFW5=<fuQdeXc
zwr5;AQ0eYsw9_+e+~rCSZ&Z~=H(BMh>a{8iD^sDqe?|w@WvF651;S!mvN+g}cyMPj
zRJnYV%i_v6`=JFXtlzuaFcl(8VFW^@uo6j%5jef<PTN|_js?<j=6q>!(?-RC)eoFb
zzld8{8$?^6I=g23^ekBGa(b|3d+9k|?%PSH*1WFK%2@t9au3OEk(Dq>Ov|)tf2Zs}
z?(pH@;ld7sA0BI_7?mFNY&vO49}(w8Pn&eBNi#q4SZvao4$5Tf`aQ`GdR8H2iBXDZ
zQBvdVt>1Re5!~9iVQpDwQ$b0A)+lFMXe&GL=<Aa0DY;JHpOsc_k5?I80FN!xa|wk{
zu4qU$u(jh%*zadyJ8N|DjCaM?=4TGPlzgwYwsr9sqX8{<^movLU;~b!=9cpp$w&9U
zvDlw)p&|aZc)O#+o9#u*jI>K^1NT)czFHb!6*TAP*entmhTtr9R1H<Z=GEv7q)<^Z
z40rWrh8=2*84S6iR-~=XCM!m6GJnxXaeZ+5%magaLD%Ynl7r5V4rzE2o}O^EbxqCw
ziVV}`8lKjyyw_SoBxX(2&V!6s`Ey;uQ#cZ>l=$n<r#8&JoTybf#2|laQS$w|lxc;N
zau2xWt`yklA3PtG<#N5Oy(KpL)w;2}R%R$`-D!wg<$pW>-9r91uQ=<{bera17?)!~
zQ99FET&278;Z>zF&9J+gSEObG%}-8Sob)cC;B~Cop6QDA9XpQuy4_uM+O%tq>X`j!
z_2#{O&Pja~c|Nsa*H5<%7SEO{&(Kad9$+&3b^AqA#;B4#``jH<rX4L>S(|8h{|!Cv
zfsuC{dH{;8U8LSThnhgH!7r}9pOIg<wEFycx6k=dSW2QS!5xhT-uFax;te<d;PU6)
z%ph#R#nrf`kOB53EjPXGykQ8N(AE#&U>L^aru2S6W%H#As<JoV{Z;Lr#Z$e_i|Y5y
zX>zz|keX1I7gg)JV*Q9!l+&vn$b`2Y1+6#7y=`v_iG%)nZ>u$2j1j>uppW9&n7>uU
zywFRTzlGsXuDHJQ`d#PR4<FgXcHqCe*M}|(heiaA|9aCglV8J({l!m@U8P^nix`Nu
z&gV7S$0RMFu6R+aY0lX^N>%&*`(YbrAO#^6*0#Be9M6Oy^qafdwiu1b(}~|%ne)ct
zW^&;SEnnW#K(8_Uiq3KCe@qQ6tg%1k^;Ds-pwi*}&L^!)`8$P;1KOHL+>3M{Prg;}
zw&R&o>zP+A*WO=h+*s&4pJe|QYRWOS74ytso5&fyw>vGjnFZV57<Slox+r1et*v*i
z9yac9I&d-Jj(7PM=ZF@k=-q3&GAS06_ivqF7>lQKmt5ktjTw6AYghGyq)Sap%(6_6
z%ym3KRbFQJpnQ35MIAg#+CFvP-kOM{<eWT1ivOQ*ufDU5`CB@jEbW{^t2=${vZr0i
z)0(y-v|x41)Mw(`#|C8P&oAA7TDj@FsrK95uQV9NOqym{{8(wkli9Zw4jXmdOR&qj
zH}T5tvzq=&p^q;ZOxzJPcOp0Sgwt}4A|>NT{`otNB}ac5Fj-r;<NATP)ECWDS~|AQ
zV(i<nZb4e=u-Z)Slhq@I&wg2T%6`=Is<nsxnLq1a*j+n(ddvJrRpw(h{A7D`kEOUY
zy*x#GZf(_td4q2zbv)U|v#@`2<iafS>ewnTeI5V0B=OGNr&6V1$)S^_MYNjy;<S}l
z<A)9@WB5HtmL9is4o<IAd60f>o|bLt$jnmp>*qV?jyVfWkEI&j^upan-_Lpyb|v-0
ziT$~IPFPAI_41~JdixQ)^S`(B(VJplaMj~Y`(YO`Qor@5_3q(b6MykF)@s|CS@pIa
zshv}uxEnH5O}3wMLXhgQGYhKPw?+>p{HY7H0mc03M;sEh|9XFleZd!o8uzFF{V5>k
zVLh-rTK<<jY(FskT_4*|6Pkb5&z5*;bj*FZW`hq!yuti>;y1x;LEx3j6-|B@w*;MD
zCkSTftU9)4Qnmi64P46EE2FD&TPG@eM<8m;cNg+KM$b0YUJR|4v?LCGJFM&6vpjz%
z3q$ly^81x>H!ck?b=A*%s6jrz{JnpXN^@!5+_O6vzf2L)MpplH&Of2eQn8G;b#F#w
z=$)5oaT6k19dc_HJzJ4suzyHES-!4<x%#TW2jkB-Ye!sluX{XNbDy?OeYx+D6aUH4
z@GG8_=wQ6~-SaolQn=Bl{$Td$@E_aVqn2(`Fw@_aM%AG`dUJO5C~-OT-dbAM<>l(0
z<uR*hYDbOpljPDyzL%PZ$}S0MaIS`5+0QaR>xw#~j`(ft01EbLbg2&ZbC@ji?kB^a
zP7)`w*<Z~5<nJ+Y2W;~&dCvO%haT6*zE|)>w;d}rXvkSv@ZAkP&mSE;uHO<qy*);>
z{RnMXTF2NEadBPzh{5;L>G?X-M=BIN$lBDhw|rCpH@U0?TB^TvN%gFQez8}aRW^<K
z?!e&im}@6Jwi(R6IezFk6Qok(apt54nWnq*$i?Gt{`%tZz{DHN4VT3jYsT(P&J|75
zOS!Sk+Uxq{C3_!I%X3CG{$T5U-*-gm?zp@m7hgUc>UStI<Z_CyMbRMJj#3AgrOL6V
zC7ZWdTh7d$d2+s4(?!-@@9jVM80H^oQ#Z&<bjp7CP5Z7Bj^9UR<Xo!x8C9g{SEQAj
zI=4II!EJ65i_{ex#-1Bj=XJhTM<4fa{o!44C*4n1#^;9rFh2gLDAYr04N80HJ23++
zfB+x>2mk_r03h)1An+BN-ZL8Oy-R~MxR4t54~s%!kuQyvD$u7RH6pKfl|OCc-&TxO
zA`!7Iyfzl%`s}R;Hps&Bu>b$xZ_%+hGlT^s6?+ca$Dz1Cat!)7gvP#Ex@QR8=ZGuz
zoaDCy=uU<oVlv12NY~4aWK+S|cXcW8<MrA3IXX8&bOO^3tO^h>S-#pq;cpE{YA?m_
z<gpX;qba$c1SCnH41oF`n)zg~%=`Fh4{zrGc4X1}gU-J@P(JsIZrfSa_=MvlDzl1_
z;PPwXC+_|nw9ZPrM;A#KZ(Z9qI$(D6Q}yBTg?=fD)sIDH0+UJ;->?{q%|AFc(zi7K
z*g(B)=ultMY#12+)mr`hQ%P0fk?%th!FO7f-)ATdK59tc{k(AIkdyBf!uB70SvcO!
z?PXq9w!iHp2HEc6x3eBobD;qW!^?AL>xEQE4%`~(*Ro9`#(!4DwuuYRPB^e+$umzY
zK{ed9iIO=Sa`f{Q_|3J>DDcW9ZEI4GiYQr_5i`8~&Uk8<+pg5>(Xl}#+r+bW)HKDH
zxanHXd804P)jsl6bF;-B(H`BQCZRzueKrbD9HJQ7#7fWETN;j3?)(!0N!^0vwy2Jp
zGgW@v$yT8)r1?fG$QCn#T*B`+ugOfYKWO}RN6FZ)if)ut$19I9t{}TJvPVFgB-^J3
zBG+r-9oz3d%2=}h(UBELRdbz_Dg>)l8+d8YHfRX;Uj9|l<Ip$hwu>7SjQ0){T0tU#
zfqk+x;$-T*oY-2=I|DTgN$G|0>AQ?jsZwQgl5mJ!&UM$f@wCECB>j-%4t8%sW^Veb
z$l3E-Nf^)nr|b+-vYtz`+H$Mnv1)6N{)cq#P@`kevD?SLkGSh78t<veAF$7-V&b~3
zdn4T{w>FVqeLFDdNc5=@Zz|$Q0gA`VN4ABuW<B$DY1cKq>M1Hzy;w*-qjJI47I#Q}
zKkG3s(H|%F=N_QL(!sRe-n92)<o^S2ihV18e|po;K63u8gLO5U7kvM#Gm)7NHB%Oy
cN&OG|Y4Fe>!<<7Q&8*b&V+jt^c?`S%0ah%9TL1t6

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/key4.db b/src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..c834a04c75e060c037de9d211fe5588aa18d7198
GIT binary patch
literal 45056
zcmeI5c|25Y|Ho&{7&B%J$-ZO^D*MbZgDhDhvJ@#vVTQ?)rHo`PM<SJOQrb|oSc;O6
zRv}3%S#DcVq!lfcY`>Yo?e6Y=X6E($o<Hv2^E+o|&V0}HxvuZ|ocDF+nmOmZIIA7)
z{6gutO~E07)KHubL<9nbLQHWu2n2#*zR=9q?1W$j@Yx0CJM>TSzX~xBEyE!p;qMTn
zpb-Q;AY6^kM^n)Xf*pcJf(8Go5m*iq011EuKms5EkN`*kB=FB95Fj8RDK8HN)I+JX
z0D2%jl)8)>N}YX2S~yvnIa}hK&CKmAakHhk#eUwnRZcecW=^g+TT55m8V4K4HI}%Q
z4mgXI4pw$H7S1>)%T;z}7M2<~<}cGg;`AFyRU3(rw2+5F{DQpc;f$>TOwoh7Ei{<D
z>@l0)gE$+Z%n=AlNkym|yMotds-JfdgRv^aFN_*W7nm_;<FL$f9gZ!sEX-BFEv6C)
zBvn&>b`BSIjsPl+9xzu0@ly`A_)88QRVz3`QdSY_F>QMr&7bZSI+uh0ryPuF`Ijt2
z0#VfhhLDt=-5NgzV;enWE)D#rG}G!YS@emjiB3=fNkv8Ifnau*%_W$N_-0Z~ciUV!
zFCAxQzS7BA14kt=U(9}^l9(?YR?IG7l@M7)`m9BL)}lUpkyS-smo+1^W)#*;k2TY0
z%?wyGDr-h#&J5V82-9<RMgl7bkubd;Ru&?Gm4--Q<slMSiHHPNCL)2Aib!DPA`)21
zhy*Xze8%3iKXzu)bj;37VrM3?Gn3evN$kudc4iVgGl`v9huv0(-ByR)R)^hIhuxOK
zRw-<i!d5A4l`^feGgH`^_1HDpl!$ChB=+`_2&}dw_V$w4o^{yeI_z>CcDXLQM3-Hn
zJ5$11i!On+7F{+OT{anAc79!UeqDAyklAg??6zcfTQZv}Gbe#SBC=LK6SCavvq}l<
z%3gG`j;;=wRbeJ%RhS7`Yo7^O7G^@$*3N{iO`Zu^L}x-4*6EPVXC|C$#wImWI@gTy
zr)I1!nXaHW=Rt4Q17*%HGo1Cy3}@>y!#~xXT`{wC)-N-hT`@D9T`@D9T`@Cc?P@F!
z%#gLe&4jF-ZYK1e3+Z#=rawaVPBUGXHfM*%vg1vr61-^yf~pQ5LUOs{zZw|lKEWQu
zxfsU$MnST^RfL!?C_*2?e1a2503-ks011EuxDrUSgaR<Q7#6$YuT{kWIbAG-`M_c!
z5Ui+ZJO(0~AQLY&`<SiI)LGU37gIb&S-$ZwGXV?=WiSG?8T61adWfc1kR~<ATay|P
zsu{#Q8ewR8g@m%!La-t(AjlzLYv5>%_^Mz=s80xewWA#_l+FmnF}5*}Cy2@fJWGdR
zWW9m|1A~Lu3ADEOXfo5Ys%f!iy^d9=RFOT<g3<$8u0d~%-wZW0Ls=8#EMz_NdB;)o
zhv#rovNN2Xtn~n>@gwPb*ER3_u(9%xPuV_wKS}w7!lY%L_$$e}@QOP1j`KrH(W`@m
zu`yYt6bJPU8gdbkJ&Zv>d`x!g`llifYwbmZmc+^U@Q2lkRkrw|m!hy6F_RuwF#}bv
zJS&b#_B(kYR65(Qd&GX$L*6B)pE?n|xn(#l+$3no>U`JsPdiU2=Sa}*URofaC6eI%
z!uZC3T+n^{SFhEjvgPFaYF#CYZ|8|_ytWLmQjHk@G75=;zH{z7n_Cvx`rUp@REmHm
zJ|m4^9??5mv1cK@7BXoX_iD<~*8a4E+toEcx@_JiR=uM*VjVCU3_kJmq8sn_Kp{{<
z9CQ~U5P?!luuk|U1mzbZcoNL!7BK`}IIdgZP>%I*vvTd;-`wviyHA|DbNWn=YW^+@
zgGJI056F!0L7{w596=C)oX*0BBFG|8o(a}aIt&g~gJZwxt~&7C*e`Sos%~lTEqEMM
z<kG3)+T9%zA-`X!EPpqkoz{})EOYO`xUBs{b&Z?$d!%F5=eK4K!}<67ZPv@PvwVoS
z7I-DSIruJSqV;fQhu)R(!K>?K95$0LFp}Po9`}18l1ytOY{L5<JvV`WIxG#8JpJ|~
z^jSuVbu996Lx>vsb*}Rz(H#6RVMnvsLWp14xwkNp{Nu6bxBZrVmha<LO+-$R(Xqm^
zXye~TZv?%<lIl#>$os_BG@PjbG}Gj~@8+V%Um0(0j@<cr?|qn{Hl!zhcSCbmK5+SK
zM!<pfxU4TaB@x|efj9H4&wC|gRqSte_+Hw+_Xa%-buml7(z&mCafY2b@h#H-S^3&c
zt!ut`^)8_6Nv~LDhYoo6UNAC%*$sT$y1_xkr~jCv&%M@DpX{uviMR_r??jqXZmcF|
zNNPl6k(0P~!*6mLM5~y{?7WIX_=#n3AjMkh<oF@MRW#MDS{42U8ZNGPHVH`iZ`W3^
z^l=xx-4LCLuxotz!QZLcx$DX3?^Msgoj!t6p-R`*R&`+eP<PQEMK2<qDh`j$L#jMA
zXg<4II#>D5AT70g-p<i^_dG|425(+<Z{5K!Ve@oNgPTG=6;N=FYpAN}y%bltL-dqK
zROI+Y+Skh)DsDc=Q;CQ~f8vG0N$-~R-%~9vq~t_w^51f)pw(}2f%V3UiE@REt#8sk
zdvT>usPrh=uV3<YJEJKu`!kcmk+Izj|6S!Hiuqqj$7?k1G0%_~b_|AofgP0F{Nz+q
z@`9f02LifA_lYkucg>i*q-0!%(rZlI>p&}9VpjIa#X<);+IV@v@_F@}87VbY{H^z0
zR$NIRKD=$yyTC8$`OVjK35sya?#Lx{&CcJ7y-AX=r+`}RU{BM0My2yv6luy8Riqk9
z*V=PrpX{?WuU3uoLSgu-n%Z_ey(8ks;OdADm3^ocD<R+H_@yLM($}}iPH?BN-RaIL
zsLa~|$yDklD;*|<qP$H$^=(oY28+j+@8Gk^zrAr@&S<^oDfi0{dh$OQ9#P)*IAcg2
z5ZoEADqDBUXfs-6ZMw|4MyuvzyRy<Fn2-{sn~wSCT|HFX5}-uuNGsvOu9f#NjK_!&
zyS;;$%Pj|8E^JfCOd_w_AVe^0RkF1)30u~JbY3o6*;)`)7F|4<yf38D{P$==YL7_q
zdo5XBDBMW<y1mXuB(?UD=lrW)kE`73zV{XtB4f6urN}+VQE}k9FJuC@t{Ut+f|;+j
zEx76jlY*pX{0Xz9M;(iTLY@{XJ7gb}Ip7r_t}~WkyMI_c(LKl79msDy*LhVwI-t(J
zOwx5}ep&Nn<O1vX2O@jiGA4#!XWpd0GOVT8DoQ)uc|5thRM|FW$lQnTK}N6Nf$XfL
zr4`b_?O*-39>Zu+U8de#8O&IRWQ3gad*inFYQyr00mDq(n}e?J;|+$AZdw*St>T4(
zjKO02HY7&5P{Y94Xk&t)gNfoMBbPR4Zp!s1E_CWDt`zDC;j3DeZTmG#yQEL2F)6rg
zdq1)j*x5<Ad26+`H?ls+pfc!zm`)llU`p<!h-<|oq4P9V_mVT6$}KJ9(pC$$nDl>0
z`F>dE>zR?}Be9zVbojS3#`Y|FxY5@*M)O;Cpsi{44V{~pM-$p9&c$06KPK7cAihTp
z47{g}F@D@PL!0l}rOy~la&#M8a$ggu*|j;${H23+Y~R<WQ}@!!4(771Uqk=De_0E%
zATY1bGoRoD5&#K+1V92H0gwPl03-ks011EuKms5EkidT#0Rb2s#kzVjef&QT5gz|9
z+dy!0Kms5EkN`*kBmfcs34jDZ0w4j907w8N01{vmfWaWB>Er(rh;RuA1tb6x011Eu
zKms5EkN`*kBmfcs34jDZ0w95Z5CJ<lAcy)-{W0V8@qZUYxa%LZg`gFX07w8N01^NR
zfCNASAOVm7NB|@N5&#K+1b8Qahpj+y`Nv4p$Nz62!f$v_3)Tb)fCNASAOVm7NB|@N
z5&#K+1V92H0gwPl;GaoA5~hp#yMJ8F&$J5_9%GqCPrv;${e!MR0w4j907w8N01^NR
zfCNASAOVm7NB|@N68Lus2uiW8|1Uz*Ai`gTmk7%WmkEapHwzyTcEwV$=GZRmN$fcG
z7B*IBkB}c0E>w$E66zDm#azUs2&rQ}3at>rU>>6ZG!1<VeF{UtNTGkAJ24>`=YQ7^
z*bXEB5&#K+1V92H0gwPl03`5#oxlQ^8I<AY<KaaQ3H2c961}}i1{9C!o2QdVsvKp)
zVtLq7cI(abh}p*EKN_oWQVGhOREiQOm5k@4>MC+lb#R<ieFaXc-h#j4@Y17^beQbe
z_fR*G=P2vTagu3dSxz#UCc{al=}L2w$y6y$GKC=dSDB_upi}<XFbR&bzBnhDMi%2F
zlWFrg$uwP2PBNJ~kCRLxi2PNil8BVK4HM=l>ti{|G_nvUnM}iQl4-hVPBNJ)$VsLU
zP=A&6H&JxRfAkoVqpUB$Nv4qzoMbYMpOZ|}g>#b0R2V0jLf}Kg<WXCw495205N{#o
z@G1q_4G~_4Ex}@i{4g~b1$3lfvmgPr5BVBtCXj*nhH&C9<VV82V7Fk>e4)@MP&H<Q
z|KtSVrTER_L?M43CV%?iQwcyUVZ+=Fgt3H`zuZq4(vYz<P^BTS?b|*%|Ni?0y&9)4
z3*cHKvz;STeDmyT{^o|2f4a9Y92ejA_DglojwjY1A=_cHu41R3ZdCNtI8f=BPdBlO
z3X=iwk{nG^2t1f<>aq(`_gYq4Djqif@|Wd6AHUT-$>Ho0HTB}U4+k5YxtYv5>MnMv
zq~^D`!Accdk;6e@@BQ5ev$`4=)}IcmzGE#4;3a-B`SVD_gGr;2o8xNVwcb7}6@Qr7
zLr*>$EB<JCMEYwA-<rq5DeGIgnH>0@71|9C9J;)^R(t!Rd2)J<;W0P`<Q1fasdeh)
zn<4-&&e^0s4<>KdCcvM$%dVkVC*JVV`IzE&Lu9G(HTUT2)UuE>m~yTpr6|cYcccfU
zFMs+V61S?M_gI|wM#(#x&=>cp1~(Sg=>vE%jwWej9!v(6pWCzQ-pZKf%}d?FWrk96
z4D*|u?!P2uw?5i5k+3U;8_B7<tPqb0WK_pMdTq#k36}!;))=uX2RAMx-%&8p4R;0b
z^EsL%(|9mRl(_3G=5P&eX*PANIDL=H)4g|<6piBKQ+EkCoh4b0aWiSN+Tl2##5lw0
z^I@CowOjP>P@E`IzGLT7QVp$*Q_`#fyeLPL%>9%5r#lzs8B490y4(`{qdTW%@5Au;
zh`TVuOSiGnZEufNn+$L>DcR>e^)*`|t<X8xY+-4}75wYy&Cbs#Dg1ZD`AG`CSpa?>
zN0Ve;hM)_K;DSPfM70-h5Bo!-{Z9&oEr@^Tlj?s9wqU3`=fo~<CNC=!;`-$md$)i3
zQj~eTAx+;!pG*_<-VXCR*J7IDn+f1WIGW^X2>M;9&G^EHAQwNZJ^I@IM~G#N;q)(c
zp$E6NN=I94=wHIk<h%98O-=s787g5nR@&~fuNFII^dc8-4FoMw8sl%5TngZYe=+&<
zZvq~=TjLgR|FN#+webr1dN&_?5%beE?*(=zVd9Qt;4YC2CApbwPwpC{nSS5B^rmPm
z-n2~<`J(H}a)*KeU9y1i(~ED919&WFle`Q;E$wcG=_;N5+FMJCUiCYExMIEmu%+EG
zdKB*>oU;{vo0~~;6!n~Y8T5j@=U{-wSW3~CwOVCI7x#?Hm*jgsm#Y^8@Io9-@-zgg
zoxmXcifGl5d?g-0V_b=}pL|V>1a^mM)^oH<toArJlbLT*L&b-Y>N~`Pb-k{O9Xoh*
z-jYWp<B4zWyCfzK!zutghNDTIh9HIZ3b*yD@2*A!Y&&+Jl4&)$eO=PIRs)Nbllt$X
ze;b(KW|An=Q0bxGUTOP`GOG10O!>!68Rv0?)N$z68m$(Wm7V||&Cw)JL(rEZK=bRa
zkvP4*La<U7BY}Z7NrU6$>dL{%ObWKGBbJ*<(N~YwUlx0QjbAe{^h7sVdf{4UkBic>
zHlk#*8UfWw1Mq?zP4YAZb?=HBRBrC{zV5{*b`;%rB^34aUS-C2<kUK!j|ph^DQ+eQ
zZzaB10dX;LoOgCmF0h2*dDm(YY;$w*<Y0E)fqJD*0FUBmlBXfav`01NorwCk;@0wr
z=dT}rP0kY6IWrM;M7x{3Xe8?6B5o!(2z<FeW}C9%`rVi3>m5r`eb`mXc_JmMsm;Vg
znS6i=fJgpf^5<XgJPbiQs<qafmkbIHo#<^tDm&n>q-9Z1rE)D7qHe!z46es<Gik0^
zUVmnHa!AwEF~`1?6k>ue^r+0y=Ot7Ic0v4nm^XkI;B1nYA!sb^evjg5;>e=ohprh-
zU6oz(#PY4Z>&TCKOBvXLR$n=8CSQkiXqyV}f0`E(*J+*<x3@rTZC_o-!6=DK!7ke$
z6tx3*1V@uR4MAn!S4=fDn#0HWm8I?$JoC_vmcLo>a`B>Xri+za<KGaunT)RsvoRO1
z9s7Fb!j;~XCL>fh4BAVVUA_-;KIO5E6c)hqb2Q1*5Oj#%dRC_6RA339rWbiKYhqcs
z@mJdC#8Qn)$3)b}J%!v%hQG}T4UzA~7fX1l9B4l#6f@Z_)GsWc@!;&|=<;oodjLF~
zqe-5IpwZ<*9iKl3xxFchGou{6N^Z~)FfM&OTw&RIF-qa4{3th*zL^uydFpB6wRPTb
zgY&D)if|ofuNR5ET3Nri&gVe%asUtGXp*NP$j%_u`&rX)iMe#r`f~o_(cYkYOUtAU
zUDuw^MW#MDdzhQaQP+)P2h%@L3%|Hn#n9isY%zLe_HIeefwSv=>yK99I|$(UIGW^X
z2#SHfykq3wIFXXI+Aeg1na9<&2TO#LCUQ{EIz?7njf`+JsSG`QM53LL+|^AhFnH0V
zY(XWhAbxA9Yd$~|J1Kdl5m15h%j?F8%^qh1yS#jF;z~|@n9PYtnd)gyz(yw$0DurU
zcTg)t@ciYV_KhIHYnkba9nBUcElUjnJCurbnvQ<#sFW_z?X<I0{omM>MW8$rtf6!m
z9I6J#I<5?Q73u8rT|daQZP`h<$WU0`k=uJBRUdtZS~Tr))nFa}3nMl{gx#=Z*m*($
zn0pu{^iIJJK|NF&au8`NkSoB)l)(uk01^NRfCNASyb}QMs=s_w|9tt2hu`7zGQOUF
zb_ga`o!exS4Lf%<_cp!W!AkG<bK16*GTZgZfAbai(|O&e_EI1E_GW|$<bGH!c*=LQ
zDQ%~CiSfI(tEU=Qn!Jna2JnkHo8;xZuGolFRfk30@^1{Gn1wZ|G(G;v5v%WRTgi#x
z5BjPdpxjIf(bV~ZCaSBhHzz#~whhRNU$6nbVsQHpgZ$*GK5MfYKv9K%>C74Ozr7U5
z14x(6JNWIt`CC|o?~_Svs6XwA_QFxx>^4+htE%fQF01C|@iOtoVZ-xYS=G<(498;5
z$j_7P9P7N?cUR1$$)@q#nOA_KGDnZRa4a%ZgtRPkmwIyA$^U}(RGmfKypZ`*v4I-b
zUX~@LM2K<om{9OwL7<UzSH5p1X5sZ~O2fkF8<{0bH2ZW<MztpJ9|jbaIC`Y;z!7%V
za42(#4m&DR+|npvwJ!GLii;n0!cGMI4rCJMYh`ouxc~6Jhmi5|^(XnBC|r5g`{2l!
z?Hj`qnwf;yfR}jFBO^c&&(R|<C!Q(zoR0<3MMj@@`Y7U+pdm)R_Q?H>O=r$GReh`=
zl*n`Qcq>D7IiDXbvCG8uIyAX3Yt6{VD^kC&ZHsEP<ug`lc>pLXa`ec{Dcu<3RGW&5
zK%=<GW1|S4+Y3)gMJ0c&7)gKaY~y;2pTPCJ^Rpc`K9DcIXD4wl57XX98NA(<@<_y2
zTb|J(U>JGcryEejarCIeLthWyk5A9Occ!Y;z-61b*t+<T!y4Cp<66o;jR)N;Gfcp9
z<G4>TQIrbb*&Umt<EHoHNZ9vYVLtVBlKTC@=}!U^P%40;0!NR$oC7#(nz~xLy>!SY
zKab{hN!s4<gF8&9tEjNS^vwG+rwqKgc|;Jp=eK{$8ru$EvPfxJZ=hsqrHLt4`IGCu
z`LvD@zEyzY0*)T_c;RSw!ZSqaMqw_|Ib8)Obqw#TP<t9Lcgk|nra0UiG=ZDP;SCvv
zLmyi<zcb4#%2j;gxOZy8tqMBQuwmV%k9mqyC;%`2%OL*K6+{CbOpYQH<ouKl2=$n3
zJ6V%!utu<%Qrk_=yKVD4Nt9UNQpL@rXdHz>F$!ZurQdojih10OdU5txaplty=t#0g
zWQ%GHfS2QJl9%3oZ+N{dXpes0!13`fZZ;h!$m!~8{6jCZ?`m%xDVypH<Ysb8>ixBt
zDqn})17as%`zyR(Q=Pp();&Vv`Yz{-j4Ihg058kYBu{62`qUffhcHb?;`{F8B4pbK
z!yHC~`ag{Mb_>L~SGL*A=VmfoqF5OAwkJ#BEL^G6s@xB0MAh0CzHN()`0c5lEAyG%
zEyK|yPiK5C-oGkV?P&6(HBDypR=*7JU0djG&!|T^VDYs;LEr_~YYcHVdi+B3_iL9_
zEG=2v^D1~1Ftp+UZes%Vll<iN8fQ%aFU`>;PiK5$@PR`&9`Cj|PWBVXPdgN#2$guJ
z@$`7ibs9fIq<y~=H<Hi8$1Sz=t-l;M8a$3^pZwfw{D5%jv}3_QGH&DNkkOj|0sY9v
AYXATM

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/pkcs11.txt
new file mode 100644
index 0000000000..bdd10448f3
--- /dev/null
+++ b/src/test/ssl/ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/server-cn-and-alt-names.crt__server-cn-and-alt-names.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/server-cn-and-alt-names.pfx b/src/test/ssl/ssl/nss/server-cn-and-alt-names.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..7a6b23bb14fe20ca32e9b1055a9c783e9ef63ca7
GIT binary patch
literal 3349
zcmY+FbyO3Kzs4DCw19-bK#5V314a(%5;kPgjS4DANq3BHX(UHC(lWY6gLL!a040=$
zmr!`G?>YD0-@Si)&-a|?Ip_KF^MRu8-6sSPLD7_p#AN&tnh}@x03-kmnsOM3rX2Va
z_dwAkUjM0xF=&#ve<B+~0KuPU@t+0&WhEy6?*&Q#F_a2OijNY`(g|wlAS5Iu2u71Y
zFYcJk*pf2)rMRj}5W9`8obk*W;qS!{WG|}IzK0FTh|7kEXfpu3NZjq7TgOCF-;h6N
z|4HFg!BCnu%T&ZY-<H3V%ELy9D;Kyy1euw?3i@G($E%S%(SCOv;j@e4Q-<|c=y&)W
z`I$embXA9N{;IF^QEV4gSu;`ep#j^$a#cj7Q|vvC2S=ryh9_y{@MYXH)bv?OJr5};
zFNT{OTdN+<4!W+}c)!uOWT~J4Szq4mKkRKPsjGVw`$CQkndc$!KC8W?yxN3nZ(!yT
zYt4~!-|~eRbJ(1}KchK$g%6)aaoU(|-gE7<Tu;wjslV;Z-hdHJ3ZZNqf(oT#iMs7J
z6O$EiIYy*Q@}u}_{k&+H&|;mXa`Tk{MaLr-Riahi9i85}+wHK&-{=E&aWJ{<@8mra
zB-@&{3I5=0Sj2QW6J31i0UHaU)gzJXz{;=^0psnSA<~t9l$@h8b-P#Wgb&L;XpIVa
zXqlas(QAC(w(HbZNuPQxeF|5dNI5fNVb4?@n(RngP-%FU<6LO)vazy`cFoAKRV%aX
z(*7^*i3AOuPc+7LHbjCh?K?jOzm36j(q{o?r$&}-aTM2e*IrkZYTihTabGv0t4_I^
zjCX?Ai$Kq??}w$?z}61y>R2Ay!z*1a*G(THH(ak_B?uaUG?=P3u;B>h(46cI_2jjG
zA^F)$iP_`(4*mlhwzjW88l85%hb)A2`%@m_qXU&SzUGN~`vh6(!DWT0&^{UM>_0Px
zmuQ{_iA_e3CPA2&X(vjjE{}uPFFNiEz;n5j_iiWVH=BK|=<R<W7OH<YTz$=XKy1=3
zrPL=hlTg{0jofuY`Af?LGi$2wb@iO^<afC}?GhwcS@Gp^`6>;`iH(1c;X3#+zdpuc
zVDutt-3M|AKeIE;hnpe9jmVkiR_aG+*-CbiTu61YUGD?@t`<X`&R~Tv{I&)rr4P@=
zwWbft8_riPU1OHWHR%u@Z?a0?mRMHV>&o+i8I&K-r0G#p`ZS+i&YL{Hx;vAO0j~?!
zN6^$SN|x^x>lSp_$uc8f_PAKLC1OI?7CvT((5dM&s1;ciizAENK#B;@i@~n*+)r>4
z&JD9Ja7v?A$geJn^SzDkyM3Ab#&!N-jl+0dG5RxqeG1YA&L`}Q;Tx2Ty0r_Y&gAjy
z!wT78oy^1ji&s~uq}okw-=f}BoKYbrNM9Dl4%zPG%_E4(cx$W8%BQalAWT*6LGhdy
zv#q|G2&C+yZtRS%nQQ%|*4JK@Qp^+{I^?IGF3i!UUEFEykxYVB&<K<MJMDH&ZQ!*)
zZR#6!2M0r*neYsVI=naBf;pkO)$Bo%-(*)v;=!{v<CIc}E7A}t!9YT6St1qt@>@5H
zXQhT3DvlB=^!1m!p@J*~@={JN!m139GNu~~IMuuUS`kNg$cn$Ul<z4&A-%vc>U@~5
z(eo1(oq0x|mJ@lZ$8;rw)mrqN_R5=R;#Y?be_RnUglyf+sTF(iune9`a7yLHRb#bW
zd7OHqrfBkGccx~JNzDKPRHriab8AD*L=9B=M$lif3QZ<{qtVD0j<7h_j~$M;{Z}-R
zKdwsc@=gZMJd{kML~$OeQ{Xb5){HUt2=pjRbM3R%&KIZp13;GVX@JaUbXzr5_ML4u
zd%HoKTAumM1DL2|mdIu5&bvra+>{)L_{<~<Wg7ikYMcx&luKO-B0cJ^|KiseLiwg)
zXDDG2hZ=1dNp;~qpte>K-T`WUK3C7(MA|Hy>FDafMcry|Sfg&ERP8I)fBIw3+TL9u
zPEvx4vBbR3$C=I7T$Ka~P61IRuHN2WI%!2fF?d>MB&ek;TRTd2p8TTq58>BgIjkFQ
z%-XMGLt`CM(2|?(&SGsTa)cve`RznzYP0lx3A?`4s@ALv7+zs+zfY`YgI2sif<~>0
zD*2KxIn*w1k+JQzl4I1j@f|#8feu&R3g_{|&6I_<)`=~jmG5nZ8ocX52s!BKI2x!(
zd@<P@yxMJHMqnhTawD8e?JB3F{9}^!`e*lv@7F6r?LdhhH!s-}X#y^7>NBWR_Rq$&
zruJDYeYrkVDaNKQjnQ04O}GZ9hqOuEAHWCz5w*92kF$y8bG@vMSG4;%?kt+rl0J9|
zpiofplNy2MdE>kC+f>T=0|Y?bQj*k`BZW@r^Uc|l%zzuc{*cv;%z1(b$q-Wf#UzQv
zaf7o!pit8DI`NH*4I3zh+KNZf#={lK%{WOaK?S}a)h$T^mEWyO3cs;bnH;Oe^baU9
z-ocHl*VsNHr_wG6jWB$PgE1{L%1{1&D^a><R<G}*%9?{PyRP~;^o%LF4$j3BT@Hk~
zUauOSB-uBzjxqHWPn`V%8vf<tnI6^*S-PQc<2v_|v553A(?1K+ZDy}Oq-!}BVUui?
zLP;x(MzI^Pd{ZAnh{^c>*oC4&O8-Z&7&J%>hz1G&iTVE=4>866=$0Hnh(QAnp=jX#
z|FbaBzZRB4ZuOn_Fi-t!VIUef{9W=f-w^4=p4hD8!NFa7ufBp#m_*d-dl^3)LXz!q
z>Ab{!&$KOzCl+JJICFr1XSGxm%h%Hwtd+2*VsadLX<%m2cuD0)*t+4-W0uH+MGt#i
zcCu^!w1&8}bCi#xAvt>5G2+gACw0;Efk(@<LG&jJY%t$oswr)V<9_#H+1d2C+=t5k
z){A@uUJ#*orM4HO7Bn&9(g=4NLPMSM?=s?a>4<rrG=yd{j1PlhVJ3s2v3f_96cZKZ
zZ1cUvFk^XZaO$YeQ|gryM|LHAQ@ET0o3OQ4N<fXdhyxR@A}->r&YMs&8yygn3f;fv
z64k%=lYy!&Nqlv5ck#z<2fxY4oNv{1)<2;u64e_fG6#G=^lan8Pp@o!NH>(X?e_h!
zdtq7aqY{ck0Z>^dKvhB3-#HZVSbIcDWg+9sjyH8&FLRe^10{C{24tM^UR%B>$(FX&
zrdN3|1U()w!}(&5S|^tub1;&~7>z;#CiOv$G+=Pn-~+M#bwI<5Ee18lh3KRH1fCsS
zO8qXTKDvEY?<~Ge3@kym3VS0pQ8V{>GJY6k<z5_y6IP=+mdk}jCbdv040-KWPa5yo
zB{=Ao883)AK53zwDMrVv>2i^~gWq|1dW)^dmoEw!&?Nd;5Gj_ALlkk1e1)!>dJ9)r
z(f+ui>A-{;Q_ffSSW`L$$hW1lUxTj<#vxA`fqbj|5f#$uqq6wT<Y3M`eBXQ1SUGhz
zWhv)*mW=75Ci&ERrsduHm3_Yqk-w#c{ZeG@1>Uv`M20w8b8voma^=YDUlYdPdtey8
zxTGgi%e*x1KBL83t9uO}_c*d|fu&m&=>Jn-oJ?3hO!!LLfGnMPQ#m|eg(#-#T!VJ`
zxlf`<fISdYBT+p_)82?py#K|f$MlQz&Mw{<^y=-|_>jC6@rkdCmy*8y2+~zT?VhS*
zKt2C8T!nRwIlE*SUcn>jzt$9(EK%M%YjbH!{chggcB1(`m>xOirp{PlJlO1)A4w=U
zMrgXFk=Wil9O~qB76k#rq_MxvGnEcmx8W?BTolhXY)hVw96oy(Y)RM<oSj?+me|Po
zbVs&~#>$E5Dyrf-hl>48<VY)g>wi4$>XA>xQYDrZP&M;vY(5tGxg%YMdL_EgH#j5I
z<7%+xq0x7ZXUFrmItSIBE^#k27q%?9!Qrfb@va|gENpqw#(_==fbJvl@WYDcUt<07
zwOXSdJBEkT;)&Lu)NSK;{maUcWQ+xS1k*&qrM)i>(vnef@ph}xLEYH2{-e>0ZgcZp
zM1-xGE)hb_j~1wX8JrBPqQ&tPh2A?hI+3pmh<rSWMy;9pVcw-CFDJ(~{sxsr-*%K6
z=94Fye3G>n)ejaF&%!A&G7g#yTFqe#LXZ1ch*HTx#V32-2nU}H*&>Y4(|`}lHf;8$
z+S!QpYg<f<Q{-q`!4&=1s>+Ea?U{&^sP44iDYKA=?H1dGuUYi_VcZT6F4KQGrWl%%
ztids0;bpBa!Dc1c*nAD?hZ!}dJQmjZn&CB0iw|DUwOfKbfjLI}H6<_CUAIS=Z{Cil
z<0O9`Sh{P<_uW^}DjTIG0g9(Ja92&|>DV<92ASYL0!h9FF>Q^8t;!7_xQTK@A^%H9
zG6vBHK>BY;N0h>j$z$+oR_^MrZ`5Bc*FvD8P!1>=F-U-lh!6}S0MgfO+S#@lJ@*~K
cB*>z3FCt4X=N*8g@0r=P=BabI|E1)A0p*KFjQ{`u

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/cert9.db b/src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..03d88f8838bede656dbb48a5b56f42d64ee38d43
GIT binary patch
literal 28672
zcmeI430xD$9>;fcfSfBx3kXV7q(lXFlT8S=mCGO$6uAT{HUx+oxr793y%0RW7I_|3
z3o7-#rTP%BYM;fz(@JU4YNb5Equ@nFK%cD&zL`ll<k^qyr?j8f&zpsv{O9`3%y(x0
z$!<0q780b^ssvM0)0352ftct|kR;(H5D)~>5A23u@7(yn;B`j8E7`;TC9@yl`ucq{
z>L<d$_!eQ(MwOc!FqvU80z~kJ319-4049J5U;>x`CV&b2fdsq^46Lmk$Y^y+f@*er
zqEelZqR~vuh)Yt(8~TRIy~E{#fC*#eQ38}F2%aG5$`?2*8CoP9!$%4cNFhlXr%LK7
zVep&+%ImEl7LMf^Slc;}Q&4?PM%)ZlytYe$|D1w8x3>mEGeU2!fwgVtIMf<VhAO>F
zg!i0?F0;3Wj1lGplZMs~4rG3^RvDM1>Z;ylaP&Ii-abL{o*dK(f{CF4<Gn+p1%dKt
zLBxcBkO(<!!8dq<Ur>N=xWL;dI5d2eKuLq00lNt7VrZiTn8Ls$8H~zcREDCkh>V4S
z1O`$VxWhmO0}mJ|VGsub4<tqFLZnDT4TjdW163Fr$}lw4VQ47C&`^n?p%g<yEry0-
z3>^<cefM<zL&_qZjg&=5S%j2DNLhrGMMznMltoBcjOvO}T`{UFMs>xgt`y};QLYr_
zN>Q#<my498NZB2gM3fkWNrc8LqG4ST8m|cTS&Y)fC|!)wS(L(}6jq-CTVZL~3X90F
zhzyJLS)|XRd61yG5>!`$>Piq*ph?pr1~#rYVee%yl}3f*RT42PmcRmf6Bf{$uywr&
zyP!AWX!Rx>vfhM5^(MrsGZ7!X*<B5h(x-M;llG_vr$kr4y}J+YoqdpY_ZOI*{RL)c
zSzz`k+u1Nk?d&fwI~xXOXT!kkY#5kuslh$~6RtPC2^XE-Oz1XM-R9IT6D=BD*|_fR
z#KG<)NR)I!98C)uj)Aq@fh2UUB`pb@(JPc0+Ef%*bRE|Urpx34R}0VY2{W+sxt|aw
z$Bh4Opynq46K|LRCh)&WV3CMFhi7GOZrQtgR+cPb4*m$j9OPOqHYIu&L3zEa{ie7h
ze-aHUa7bc1@iwdpUXB%&2e#%lWq!WXe(jL`>j+kvJemX>%me=yOTyb6@3|^|P9AKr
zGi1OI7dW;3Mh0_MlvowL{(5BrQ}o{Pv9Xb!gFhKL(~-#i>{N<P!R*VPX~m-9-@AHT
z%2A8?ubq*bE>C8!6<HP6&AdTIQ*-Ss_dVS*Lb&AUW$ps+qK0pc6TcDEj9e4;!Ig(j
zjO^4<K`7^Xt&A>RJG{g9>7&gVBR5pv3!2-UA)VFsD4=0h)$qYj7L99se`7(|;AunZ
z4X?e^(IDYC3GD03raTtb*G3I;Ams9cKVDa<w`6Vcd=R?%*~8qu%P+7errkZA?UR=`
zx20nFit6@x&UFVz=bQf{*VOWDr}ncu>SJ5i@7cd}Q_OMovK^Lt3(YzA6vs$#m6Xip
z@VX~0tAFo_dD$GmiTiDv71&@6b9NNr$ZgqK73Ld;W`y=)#?WsVa3gqJQ%Sf=qZOp5
zrfLPg-tYpjU}CC9J1t!m77`=~3kwpYt3X7fQKzN|w6Lfq1H7+rz}y14(4IR{K0Q0F
zcIT?gKbqIL-E~;?Zo}qxn*2^Vu3T7NJo9Q`X5O%+yu-PE+<9>2IuUuUgw^vDvaHyb
z5Ae5R=&1=X>;Q4FFg2?5S*mnJywWv3T}x+k&FF0M;U+GJ<bbi!W(GzhmijM!WJZ!E
zeB$@>q6b@>fsb&E$ej^`4`1xt)@H1fW*Jr=rF|GLdW>#H+|i8u%E>^Z5X7s}wHh#h
zp*=fJ@(FG>Nf993n3D~LeEqFiwkgxz{A|Vk5kDpg6{@@Y&l>%+IAs8Rf4bz3T)QNV
zpZVabjjMQ-lbL;8hh2UYRWjqem(SjJ#~n$cjH))Ye&{@`c+i5vi@SbytI8>j8W=6P
zn-Jn5J>ULD-ghe#ORvZeh1@kPExG8|QF#0QTxp^5jz#OeVKu4a-{gMX5LD3OfB(q8
zo4@QheJ8&(dOAn`glO6|%10$}A-z+hqO058*SV<Wm3F%WBjXq5f4%n7+1<j&{@YG1
zycAaPVL(c=e|pifXB&BLypAUU4}_{ncFt)@tB385&jR~z=bUbu<Fa+sp4f5Q_$KpS
ztFM^9_xufVa`sOVn>SraS(3A>_%)t_!v#m-*8a3PZ3;*a8o=YzT#|g&lNp$7z>FlK
zV}#NV+x^{r{S*Jy9`3ty(wX9clQI)aa+@PsRMq<}HXfK>w&k!%(>D?FkH(+5<*Xe$
z$^Cev@vz%5)rPyBpVch%-CE;$ruvwT!Z@+<q@!oSv{+Ae<w5`X;(omK-$_qgy7T$I
zn-;<L%7Sy-X0Lp3FSPmb+R4_Nmw%A9dZpdfjqL5*;mVeqOApDN+G^k5tq@!rda~&1
zkjUogKh(N<EdSo8>SK3R*_w*K*~eb3JvsH2swIzauamgRf8KL)GB-D)He~1^#f>GZ
z!o7F1jqP$0gR_qsTsd%j_2RP&Y+o(6o>HHa{fT>kdd&^f`ZZrp9q3awd}CSvb0^wk
zJ&qBP8GPre5O~b|{#6f;q&`^KpRR6CZT%)pA&IfJnt4XBb?2@5z?<?oJ-n&apX^OJ
z)l<5?X&(#`xSjv@r*kegFA5m{)q~`Bj&9y^?^xZ2MKLX3Df2EqwQE?D6*l7}!{0D2
zcPxqgsf@@o1^)Co4q5hpyg%hs$LRg3Cdp0bQ(fXyTvAh#-qSf&&QsujegNa^b(r<V
z!g#4y^<xIp_Ry=En7-2EZLRx#jB%ug>b$O9d}?xXYKlvWGFjz1bDE1rlLU*o!r-Nz
z_5c0z4f3qLCK&nA)fI2;W^41mD;$-2z4i3e6@EgSsgBF8UyqUH72X=XN;yo?W_;DA
z%xk1)*oq;G?GEj$Jg_ieTW;W!F$V`NNE$ysb5q(T+uPe7o;bQ}K&eUNK%1B-O=-Q@
zs-&WE(S?ti&Xvcmo5)GnGe2kjL??@8?XJ<6z1&`zm(zG_^2aS2RpqxA)^9(zY6+G3
zsj#u;{3DCwU*$h?j%jjjE0!08Im`=ae<B;(W;=UDS$?v~=XEEG4+*z(;sVv<i}Hw@
zX>L*1HdrvlEsq~H&+*QDwe^cBe%rlIH7q!+t*G?0FTQ!<A%9ATB4o~yrF?_5v_a7+
z&(6}ax~*yN)zl~6tlSf#IeaG>`O&`d4|E?b<`;fcHwGQ$Q{NKQPgFD2NL>LY-Y@}7
z029CjFab;e6Tk#80ZafBzyvS>OyDm-pdXh<!td(%$N=B}@btzGE;7J1OpYO!XXFU3
z;i2<?^UH+!Woo$j73v6uu3Y>D28p|f319-4049J5U;>x`CV&ZG0+;|MfC&HsJT5`<
z$MLfIlfVCNCSD)ua07T*R(*0~6vrPZ8TG}TG`jEqBMGXQQcww02^EQ#4<>*KU;>x`
zCV&ZG0+;|MfC*p%m;fe#3H(X|hFnV${QQ*<FGKM9?6jW?<v2mSEPJEA`cZ)H{Qm?&
zRf4<!>!>fN6TfnVxELmY319-4049J5U;>x`CV&ZG0+;|MfC>C51UfG==wEpjTqp9m
zryFtgIUHNA%m_T!;swv?(4GJ9Bd8lxIdzNLM}7IHbR9Q>319-4049J5U;>x`CV&ZG
o0+;|MfC*p%zd*o-%aSj8h@b8*1DN}w2d3(78nEWFMlY)SAHsM+i~s-t

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/key4.db b/src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..4c91baa85e018d37071a3566256c88dbf5d53f09
GIT binary patch
literal 45056
zcmeI53p`X?-^XXn7}uE*iU>1P%Dp`o8Y#IZm)tK=Vus<k3zay@I7O18q)1AkR8mQY
z5Z!a@j-r!}O7{zua(`!UJkEK}IWzM<&-;Gf^LgI2&0h20>%Z1-{q}dwtg-D6T%7EJ
zVmPFLh^R1D42h1CL7~wo6A}r9LP_#=Dc(N0;dlXd@__e@{!RQ>p(IMr=o6m!9VITg
z2qpD_ctxs2iY28c*(te5^7vnM0`-6ZAOHve0)PM@00;mAe@_CTVqyv^Drl~D42vDg
z3FE}DELbtD$!BqMXG>F8OOmUpnVltRvX-O~<WF*Rwq9=P>`Ah<^d!02TRXW~k{s+w
z<_`8t?X1mRNzRszcBbZ*IwanAreW0aCz|Gbah!s=3K|s@?$3#hUK7eo`mol<L?FjL
zllnf?$w<Nshf`1>qgNsg{6bhk{^8Nlj!{ADSTP*233Jx=7M3eWND{U%)qteIqCzxH
z6H!FN1JMX&u{ohrO>n={K$3sZpldG0;uMt0XrFQ0YuUjZznCcv(cfuAkEj2jLWQWB
z<`|s9%*nF}ijH2(iJFqZ{!V5*`v(;!RWrpIEv7&wqjy9gQ#K_q6^TqpjZfQDy)YAJ
zYUbeVszYKyyq!01EE;d8!!c3;*HGaqCVa?*51Ggz+=R)13w^jSfQtoi!GsG#xM0Br
zn^zbjQqXvbC_=CX6&fE0R-r<$3>AWPs1Phfg<vHr1WQpNSc?k5VpPZvE+_1b`$Lpz
z<1wO4LzHQVG7V9tA<8sFnT9CS5M?^jmyYzMBYo*eUpms)0LdC4Spy_%fMgBEvxu?*
zqPzfUiBO^<m}toP(jd4m4LM&L;+c-r(~){QQqMqY7)T9cq6Qv?0l}j%5Hbve3<J?;
zAo>hs9`upE`bb}Wq^~|gm8S_oG%7s!L<qZQ!nF|6*pH)6XVCTG1`{FNU?PM^p9o<K
z6Cr%I6Cr%c6Cq4=B80JyhX|jEaH<<ZYNB?ko563o!BaBcV8N7!1(O~Oru_24Nx!^s
zvMn$CP20(Vd9{;%dEw;1yl`@0UN|{0FN9xeum@fUzuqQ7_(eAn`cH+NsW9LlA@ZUb
zZ_A#t!-nnn>$4z#HUw$XMQ{pM<iA=Nr{2Ln)TtQ5`$Q3kKUMI&9gQ<Z@g86U1ONd*
z01yBKgeS0j5t@s^$`c68f9@mCoy8!acwYnp3Pq5W-7JlgO;*~hIQcc%o|lK4{Tth6
z={chA^LYXoG&(vubbd4^Y8@v^*DqW*B0O}1o?lc9EDkNDszS4H7&okx^mNCF=$ODL
zj*F8WDTWgrLyBI@yPlxVfhceuBdzQg5f&B^t{cv~oY9L6)a9wd&Gg`+D*u{o-}ZN#
zE*+hfO)lMwVz9y%qTvlyg!1A&TFYHO&-tL|GZ3aa?WmL7^ZO#5;@S=(8Rhc%Mn=s!
z)cg$>EPOqdsFrC*&OvRxSRbyK6Z>$<no~6O4n4!Rlpwn3yqlKN>0yjt^W{%HiF}6k
zB*rVto*X``rMac@Atu2z|HT8zkUOMD+Iw8me)&3=%B-i5oJG1jnNUTx`l$Kvw}Q3W
zd3Qh9#eZCDu<r9W>lf>8sjCkCWYx3nK#q%QAh}EI*VUsh^hM^9W_4Zm9@OmWT%n?d
zva~$&zMB(tn0t817w3YpuUk)~-)GbWzP*xUwtahi@AdSIyCXkpJUO#)2cd4Ow5-?M
zk%r<f-@g6FOOp?+x)79FEPEoCAo9Vd3XMWTN$8)TFr0)|^0MS_c(f=U@`X&N4y7Rm
zmbCovUQum}a!rHw5NF@b5fMKhSk(nBVr6-Med_kZP``!<8ZCk*L6SJ}aTO5>NEs*L
zo4gFo!C=u^SVBsDk<Kw&bIJ!!tl>rsHVG|LBA=9JId(p@q7Y*tbHkIFJsOZx_#!;*
z-In{AJ~#*Vj;_J7{wmoQKBEp<hLGLmogtr!o)$+h3oF}rpEUHL++*)my?#@lXIlQ{
z7MqIq81!#DToZamLnm8G%*T2|-{SpOwtN`9ZR1KQI$z+jX;^BcT`bgaU5&WsyN=pK
zzlaCdL=4;0Qf+%POIWpL7iwO1i`RTK-}YwFG~@N})$IHv17{4jA8L!-JmcIIaoVF&
z$<^k&RlN<@Ro3Z=dKO*y<;RBS2aH`#W15WJSEDyJk)Mi{;XMlc7IkG<RcU=t$!HkS
z{&h_c?(*QS>&|l7-CM;x4RDX&Z`+?9<E}nd-D`i|%BVU(eaxxSC`S+L*gBZRn+6d<
z(@<K|B69xZAq$h|svARA2L|WNF;Su0iR?!A?~9H-JL8(bX;?Trcc>%7eqY*$@+DR-
zSZ>CwB}&TaKYSk>=w%<$wOIO@L#U~jFTha8WansE`R5T%?M?}eT(9W5^8`igHl^xT
zu2|D9)I%9Ev*j1#>*r+G4kgnp3`+}xGB3DavXi{!ntpw5`yQR|EBY=RcwSqP@>EmR
zkbV2q;N8GjD$C`2a_1%H6PqIu0gLr&QtNz^6>F0r&5n+u8GZ4-?BVH>m8rr|2x8Zl
zLG3o5`coCu?q`+tDW@fGVOPmW?T`(%elOa<5=cQNYYz!!+%)IM+38G2B98(`X2;?^
zWSu($&cU0czgj4WY{}cR<23ek?6!e|r!C(59XAifQpFQ1Zsz}}`_{4LT?6jdu)FkU
zOZV01_<D72$n1iQVqaD2S1YVye3b4-e-S_Ds~-CW{llAc1J&#!g<I7tmoOx4pAO}=
zB(`}T(OtSt=9+nEQGNPwyqQBsbX#oQ+?>rBqq*LPw}|dIKUa?_422!KVLC2vTijjE
zA7yAcPrEL8#G;G4^z6%`dRZ5@S4X-9QkbSOK(~tBiM#sc61y6v@O(X1<yI)E#3s4P
z$J=>uX4szFt~aaJmkqVPw7<!y{)wv!1(8cju;1r%)<u-Hns@Bg%PrD6p;EZGa7+>Z
z(_k&Rxk=R!iXGeU5aQ7s-gz=_?)@B6Wpn(`@)fJvj#CB?HjNnQ`(3`^ooaJ?<Iv*b
zLgSkYYGg@SWg6?6iEes*T{r4WBz85n7%lQnlQ{QP7z%ZfQFZ!U|I4*oEtiA^GHa|O
zE6mI^WUcECE`Jn%J1trug>1#x8Q;%kB;>aY&-}KXN1>pno2}N`$yKIFD=T?Rrd)6`
zOa5WcEY@AmWobulm<*{<7c^Mj(#{Ta*z)@7!!1yINU-)o`qA>l_)7Ir7tR=4`IBnB
z`>vg)mJjSs#AlQ?H9Kyxo-2Rx&cM;*1Ab-2HHAq!-YrE|zeKELS~OKzr#D1ZDOt{6
z5mWIzdG%c-o6Awdv(!Vyv+pO+0+$~v?G%OrG*maOdEWFWH65K|#bZSa7dG08zGK-w
zi9DK|n>Cn!L?DH&r<-a~f$K;2o4;3TwB}JrO*-v6Ivek{Cdpva!0Q_dnu*^-{GYVl
zx#fUwX3MHSE4*`Y{&_|Bc?D`@uXxFIj=$a*3K@%IB*xW0nAhOHvMbnIXYl0qMsKww
z&(ig)ZF^4D`K_=K%^r>l&EssmsIU*`l$T}C4u&eUj}H{zJZ&D;e<ifLdH<VCi+(68
z$1w^MsrGW@;584=A<vJR37gd6``76I?;qCiO@1`*{ygsiHb4Ln00aO5KmZT`1ONd*
z01yBK00BS%5cm%xAcnz8z&B0Cum6Wp#Nq$269lIN2mk_r03ZMe00MvjAOHve0)PM@
z00;mA2muTRB{6>eUydS{11Nw1AOHve0)PM@00;mAfB+x>2mk_r03h%;B4CH*&XV|_
z`enxP>;E1UvFC4ehQJCS00;mAfB+x>2mk_r03ZMe00MvjAOHyb3j}6jm=b^fhmppw
z|6iequl@yD&;<|x1ONd*01yBK00BS%5C8-K0YCr{00jP41Qaj~i9h?p#iBfyXyOp;
zRdW34Z)F>p0R#X6KmZT`1ONd*01yBK00BS%5C8-Kfq$ETloEXZe<ofYMf^fsNK_`C
zC&m(6iF=8j1Qx-J@C)G}VVH1{kcg+_<?)etXZ$OCBmN|Q2Vo8Y_iqml1ONd*01yBK
z00BS%5C8-K0YCr{_&+D0iZMk;2L<~0aiU^;XbebS-+&JJjQ_iP8cmsR8d6fhEJ1pQ
za5hYIrUm??vjV>?G=pE(U^>67zC6DyLyljTF3T^=oW?J^K<1xu&;zKf1w3}hf4w&(
z@=Y@d{L*ZFJioL)Tbf^*&5+`k)@MobOB+BE|D2}zQ}zA-abn_p(@ZgbX|_I&Us|6n
z$}i1kVELu>Sr~q414u*)qaqQ>ijH0%5#^8Pz1z^ll_=f=Y=8hD00;mAfB+x>2mk_r
z03ZMe00MvjAn@NOz@;dQnkLDj{`yBr5H}H8g_F=qUY7g~j}|3B4v^{8p)|z6l16-5
z+aFzBWdBUpfMso#Bx59#+dbqzC$leza4W3Z9uh&LMbIQj5+^>cA|mnI7)vV0Vy1N-
z>HEh1CUx?&@j%$tr`1YEacy3w%4w7$xocJM^}ix29YtJ0C?^o`LDE;H)uiGiTO}ch
zH1QsBQ?WeUH=MKRDN#vm0Om4ARU{7GhNkg4{BLYriV}ZfkPyUPZ_ZsMUADsgyJqA_
z$n4}0#~Aj(6XABbmo#mb7Q{tl2qGr2f6*tk{C7PMS3k4sZJ9|+C{^;xLG7aMEf({1
zt?!HFk`+XkOib&a{)|rukF~jOW#&H|L+#mXYm!p&HtdPB{f7;Q)jC9@2rk|C4w(q@
z*dzMln$hRtpxJ&&@_Vl|y5{ZO;Iu|D=?)=i6S3%On;w@ugRe(nIDQ^>jXBSFB>T*Z
zc3?p3>O6nU^<ZXPkVUWJh05hU61N0-Y|D)MsBt!Pd4LqQ&g0@nqYa&Iiw)zf&N#Y=
z)qFE~v4%^Y&ex-X5FCk@@0P@~M+S@Xxu5z9sS0f;ENU`h1Ky*Pr!Ai!7Uv_#;~ved
z-H&@y@`6>*m26S^o?`CQeow5+-$6p5YjN==-8WpaJYSFcLU<&PL_9f?S|~OD%Z|C{
z?KBMca~Il0DGuyuzw`KF=8{=U1$n%;{P1W;;t|q(cRe}nHRNM)tzWs_M&goh(kiU;
z2TV%1WI4Vb8A5oxr{}bM?(DVpZB`Oy8!j2%Kx?bgAHF_!x}<ns;%RLDPl7xSB^0;5
z9d&1NKc4=`IGNdxRdRN$K3lmRr&sE=-xaUICCl>lNEgCm!qyr2YuVL?;$c=<GwC&0
zUD|84)P}4?kGHwoJ4c_#3G$e*?UGlfSH<jepW_Fbg422*OEg|+lp0`Ll+^nW$lH^-
z<Y|08GKKJn+2HGUu(7ngXUQw=U9!a1vGl+%OepyDwbmVF3d2(Af;`sF+$?sexb2rJ
zW!Aiyb(hYh;=1DwEWk87xXfEg7uC(+l4baMTp)zU_q)9}VvnHiJ7=FiS$L+RBca2g
z`O>n)>=oBCr=4B1cD5joUeM3Ovkn?qdl}zkmbuMQ_p+<1a+m%2t>23+t;QvFWG;pH
zheiDN_XLD6=>|R3wkrB;loFD9*|30u)v^2PU?In5KO8#Q^g7|Lz&FkDq7vs_e$mJ3
z$u7O#_}5-vuW97J?J~5wr?J@n^!j((xfB9_lfuk)MhAZ8W%I6woTgf%dh?ImmuqI(
ze_p20sHD1lIsNz|ydaWa<eoSTVNOI0^~*gnaq9~3dwLizVt=aA*!^m+`q$81Tne7A
zNwzS{&-!4sU~fib?cjv~PgLC@uha^U3rXiq$~}m-4U6y^1VJXHafK;Z%lLvjSDcs5
zXx$kY{wX=|quwCLIWMcqcTW6qE=8KJNqx2u(|xrOx>xG)Jn?SbnzqP!zN(i7v^^T5
zImZj!iW*rTcP|oTa`|+#=)4}SfL^(gcjggymWmxh`zbj2D9LIc*h9-WRKcZ4@ioa7
zW|3@YUVClf70rukSFc1Eb$@7FdTY9KyPc8FPY2X{c1mCh1erW)v&#DC@6B3`S++yA
zr4QO9H$_%_s4984^Ru~6N$I03E=7{BNqv?OBv(B$A8~!Nv03ZWoGnkx>SS+?J~)un
zt=#F+d((lv?46q+lihb#T6*YmYs1rT7nK@(Ix3oal>2DqnN1oGZpEcI8CP;C5`0Y>
z2=lE)tc6!kz|6kJytx|U%c9rrHrIYEb|rk;_fUU4o8JC3RFFykySX>CW^a3`Y9*C7
zKhHego4u+1hT@ZoL7gkJM;YnWT#EP~O#c4voe(6w&HEZt>#9wzyfP29-m3cb&4X+w
z&2Gw)c|Hv`&hD83f=phkxJoOOE0r?n?C~Dh+VZ^rPW8NZY8j`f9h%l>^D_5wDPsIh
z3bO=_+}R+>P^*7d`)2rYijCM#=HAVH?u#UxUGt6QpV`c`5oB`iHt&&}*7cD5+ZXc<
z%a!SSCBCn|S-3jhLDBcoTsyO4Tndh_NuidYvPi~Qn%uXesDZE?-{&350jH&9RoFke
zxL^lP93}4FCdgz*%d;Fy>D=B2>ER}ih~@{>&UN~zX)Qe!jXhyFKln>9mm<p7q)<!H
z%hh_Q?v?`R^BK19ZInAZLG6p}%1frNPROOz?n^1ZEy!e_M!#ZfU<rHHKCSTn)qzw(
zRd@OHv%B`l7i3c+5;PxkDOkQHg<66bTMut5zdPOf;N{Jfkugubek{7hTD<vQdBbxB
z%F7nAAd}(6lB>qvXQ~ooZjY_?FI`sTc{OA#*KTOoXmfkw{L_(K3Wl#qp_ZTu(Z=iR
z+n{`%1#)Nca@&i~D6I7UP^oY<hogN%M)PsCAd}g2yY;zrqn<Q3&YK$*Z%uM+&J5(R
zFLSO8)Cc)>esAJZMEIH%Y6(*LVfwFVQ(N-T!NlaTsyi6gngvJoQW8WCE3zKyt$+Pl
zkjal-*$Enw!N$fjKC*N}WLYYZjg8-e<uB}ea7WOuwC;1&(V{AhB>Bnv?9?K^?$4)Q
zZ?%iBq_kcqtkhKrc7eEDC~WF_9}oHd;qu?9O`&+xqbN*(Lj8&4mm6B1LZ$SIB8=Vi
z@S7>sMq}^(#HKP%!Z&#tnuEcjwXg(vtA<{tT6=ZX%(&NXXsirArL?2kMq%^AQ*EMp
Ifg7Iv7nl1PP5=M^

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/pkcs11.txt
new file mode 100644
index 0000000000..1e4d3f5fef
--- /dev/null
+++ b/src/test/ssl/ssl/nss/server-cn-only.crt__server-cn-only.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/server-cn-only.crt__server-cn-only.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/cert9.db b/src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..0d2d3e5bd060df6e7b5fe4f574a14ba91389dad9
GIT binary patch
literal 36864
zcmeI530M=?7RP6@u`_H6B0>a|MS%%PAc_l%0TEOXHx!5gB8D9T)|DlSpdyME6>&ve
zK|~P+)K;`m_f{-ci!5%4N<l$IS>Mbg2wMAWAN2KoeRp&wXYTU9_x@()d~;7GgNM7T
zFiJpQ7#11AkD@an6$pkQTRI(rAVqAI!`7aKiW!ui9qbeCWB;D12$|cwR6^cCH2Hc+
zp#>>b$WsVZFvWJj0tf&CfB+x>2mk_r03ZMe{DlN;X*5kuJ=jwi>MvO07sMC(hl)gQ
z(Z0b#KN*J^T)UZEy7RP2+_`ijk3M}G{X;(8n9o2hO(swYg;|6`FyB`Y{GkNxBLyPw
zQw65UBnnM)s2=Q1)E7nj1`7P5J}6K>Qjq3;s=+`RCU#_+=8&Fo2t}f3LF5M!%10uS
z%uh8q43os^u#Bdj9-I;q#rF*se5n4xAW3y*+S$8u`*INa)7@q`PqmxjNq6CT(q~O`
zcAv$?TX2{@&C%7_VJ6+qe)^1=qv?DUTN&7DiLFfBCKB)z2A;&hcRBbjhuFo7a9H?;
zjc=^*jWxdE;F~e{hL3N2vCSAl3YBaLMHJUypptfQ6$XmSFi>2Ff#O086jx%PxD*4$
zwHPQa#z6h>t+acR{t?QS5}Q!AB$O=)WlKWYl2EoJlr0HmOG24R)MXNNnM7SCQI|>7
zwIXt@h+Hco*NVuslH?M~R)n%OQIep<ATU`H<F!Qbx|YOvEr~ueiF78B&Lq-VL<);Y
zVM$Z)R#+(B3X34aBFL}^eHNk5B8~%_sLLkmvWdEEf-0toqLvK2ajA*-o`a{NL}5Px
zo5^Cb@d8p4FCaDX)}<!i1*wUTR%+rymYO(GsflBim;@iG*;|buB~9(EX4R(}en=z*
ztb6-l-O~rF-u_}{Pk%A9rz~dnDcjR9mfF)_%<O3xGkY4w%$|lZ6F=4PK42z(zDZ5|
zq?4Ndy{4eoT=>BxP8vyB-`?){;@$CQ^HG0a6g6RxXqsF-7?QY_h+u3+&*Mi&g%SI_
z57#x1@xdfxu2vRzxA>$UM%r;xPV#}9U;zXG0YCr{00aO5KmZT`1ONd*01yBK0D*rF
z0a>a%HW)c14?^A{O-LP5h5UqELoOmkSQ1zO0YCr{00aO5KmZT`1ONd*01yBK00BVY
zZz3Q|roaZ>dsoX5Mi-MOD>Zy%2&1EGJWXnhqY_4Y=~{}^NFozPoA@S4hD?z&XcONc
z=Ko5CkWwKsLb*ygO?j#^Rp~r(1_}9_1_+u31ONd*01yBK00BS%5C8-K0YCr{_=o_7
z48d|vlz0^wwPj2|$I-~MC}c(UOo1qh9vK!EMR%~nf7DHP3ll{JL<&6IUFjYkuJlL&
zwj&Y=!$Rp%cu`R__N=(<0O`mKkPdBtbf^QQLm40)vNI)K14iu`w&(=O@v<h4*B?Ao
zg2=^!NV=aOGD<|6j48<tgc33TS3V0Nxd;zYQ@(^~DqlwYk$fx(EPwzY00;mAfB+x>
z2mk_r03ZMe00Mx({{jISvKo8<nkR>cLS*|jwe|}Z3PPhKQ)?MqZoncCxEQ5heG~PW
z_LFfrk}D-%M-Fvl=%PA!6hT38P@f=AZ&Zh2i0VtC3`70GLPEkq%|iJh0`u?yGm$75
zFJ_K!B+vh^gODA_Ddal#3xI0mJ0u6$jI8@#IK-e2fB+x>2mk_r03ZMe00MvjAOHve
z0)W6jjX+O0L;5MJN*)PI0uwwxzPVpyl#DcohLH7P{232vI#rrZ!D~pu1=1X{G>0^V
z%#p)p{T7m3Grv%?u+ZS8xTs|Q9}XdpkW%CjvKE{Bry%u6ICAx$#utnS5C8-K0YCr{
z00aO5KmZT`1ONd*01)`^5zr#D;G*57F3rgeu_cFewhlkG4Px;_#!8-Iz;kDYF&<r6
zdVQL(?ANj*RFeDs8Q(0HJd}Xv(sEp<JJ^{HYT%MCJ(oS)8IkNKq7qLT;JIhFbcQwm
z=)q%qX=;RDrtd#gzY>x>G@wal$$hR}C2Z(as2x%$l0QikQvEUW|7A&9NL@kEP*&E5
zlHDMUcoj~cfyb+``t1FVsr)<Xe=OOcqiY;i68m$DePTJNn5>J6NwmFW5=<g#sK{y>
zz00_iRWWsn@ea4(ao<-=^FWnoa;9r0uW40+VFfDG|DXS$x|&MZUm0OoS~Hl~-v?pM
z(^O(vp)3YVx;p?Zh++M{-G-?USqvi(Du(4rVvNA)6?dA~QPLyC<IJtZ#SJO4>i26V
zpMJe$acuxCLdmOY`<(r-_V;N*>vtE=va{PKom$&krJb>|C2SAL^(z~Gf`GQm=3R#Z
zZ`_e1!r}Zj!=LK3HX2{dacekfEoZRAU2e;y9~!js!j45JtZk!Aw|%lF(NWJPurxkg
z7A;J8?zQzsrw`|clnv`jI~(##^0h}g(}G@F`scKkY~PqY`F4@GVtb6@sC;;Asos<z
z_+)H-qM^M5b3&%Kh5h_d#dAA~uP)l9ekt)@ZSBjYV~kas?&zn}0$@X?k=EDeE|7CF
z-&<tnS*Qta6mNHOe80VLg|SYFz5l-ZvTv9B+64GKh~7^k!w|e*1yx2Bu}5}>sZ*#Z
z8HT(2GQ$ov#tepBP#e<LM$_04o6KK7r?}LdK2u|OFW~B<fW&}vqXO%ng`~w@dAYVK
zvpi$;N;NlIMsBP2V3An^wex`H+q?x+LN+o*+8bl8waltt@O`{?#bCp{S%rz!k2cOO
zn3SF6n!TE1r+?sF`2H!^O5Zg_A9}lf?9SC03fgz-!`JX`<#jB!`tB`r{TAJZMd!yI
zwxGzL=`60)UH<Tje5qFOU9HPvGj;QmvzI1x#O1d}o9&q+%WX?P?&*4W&FRtIK1yRU
zi}V(@w=h#5hn-8U-}%ce!=+wgg}FL$$9+wQx4yeDT61K{o_$lDHqOo|TwNP)RQ+CV
zNsY0`5;O~nuKh}-(T5sGuEH;_{-2S*b7}Sar*xll&#;(8S%y0rHN5ZfD#QnF{=wzX
zyBQ5^!NrwXqag$A{Vz8?96VqMdsc1$z`-z#$<64yLZyqu5tWBF-~Cnjp2Z8j&0js)
z=hNVL!7w$hG&j7~B{tb$4drx_Bbo5FBcWt-+}rl05U=sqd)xNXB#a1l0euu9$Na4l
z=7ru!{4ETBa>ezZ*B71Z0Q?#d8^FJJuMejz9ugWb{+mt5On(hF;R#+GyCU~}Zm2r?
zauNGEH!2~58vD9d%bdA+q>@f`*U*%?NPb|st$p@aPG^D<xtlwizcx0=9Tu~r;_!Qm
zn~4Q;wLRG{{N2Y`m3NLy{y8<Mpo)9S{e?_HeuZP#j%P2ITkYUKS8Z-IxED5cJo$$w
zuIaBPzdZA{>1x-d=P3oAi%8sdsNwKvdjZ=FwhNo<d8^ZUo0*V%edrOFIeu{|KWx2o
z<%mh!<g5#EcRb3zb`EWt9JzaK_b!SBrK{cfwTWO3YuP1s^OzwAzj0AHK)Teh%xwSY
zqYIp}s0u5LYRXn-mp_8%i{H)Kx3?-ZA@Ojo5ry|B+^eUTiPhJgldT;l2i@<S>2PTF
z<y`IAu|fGsO|xDJZXHwImAB|(=4pk7A7^p5PrY1k95rdSb#a}%!85O0GDnQN@5MRn
zzc=ynts*U+d{Eta!-?qu3nsEsPfT9Pl%-_+Y<2F=^OBsWs?&A&>DRKBq`q#P(bTqe
zzUICS>m#<L4z1nAdX_YT|LW<QQ{0g)mFtf1=nwSI@2(v_r)kmSO7k%rezCu~$69bP
zt!$&tg4)XS3kTgyXnVGeZNYti^!$8sQgo%e{xII71i_B%7h?ILi9yrFg|w=?;w`JM
z#0(i+s_9*mC_ZlOEKGZ(Sd(^jp|<_S5xXv`TszmfU`!D-Cz@(}(;ask{XgqT*p)N@
zC-&!VXJIjg)W@4@^z|cn=fAY{)0<-N&g%81129DFHt)CobXi5yD(9&;UWfP;?#pZ}
zs@}QE>(vc@az)3`Cu#8>f#(_2olZ%UV8WkrpkzhNpMJz4Ugxj(r`Ws0Fx0p|{p|OO
z*iCE)=9eC0<NMU74gj?;des4XI{J&AwIY9Ji(#WV?|q1_>LGXa$G1t9vZJPxHsx#V
zwz0XM&e*-Qc+!G76LpV|3O9t3zPS*pmA>Te#E4wW5x<y^xsxblQjIQi6*q*i9_-f0
ztqy+#dm_t+s^xTKnwlgO-X+J_?SAr;e9({dd!y1k)>pk5$>3bjr_UfgtmL2tTSs&`
zbhPe^9<}pUqwDgfXsg97t<Fyt-yEUazRIa?-L7;G-GJdWG7o&Zp0G(H={hwRz1vJ`
zD(4Q<gSgxizdjTQGvhNSzMiqK`%O~zhTE)j0WU6z?UR$2zbf0X=~m|o<LVP*Q<T3=
zQdFBavh&Kpngz`nM~|)9>s2gVdr&QVhcc;=S44Q$PYy6~o4TcJ$`Mv&%FjDShdpe*
zv~ZK7iPl2HwGSV9aguk`kKN2S;I+utYF)G)HPK_!@YO?4<y_B;bIwX~X`gUnSWNKL
zm9cvx_6~WL_2yjRTJ-{jI&CelxuSv^rbd2Q-KyK$8?Kcu*ycv^Ke{q8!)>H$Q`F(H
zcWo^Otw^k^pTFmoNO1k9+ZhM0ZB9U9&zjWTD{oaTzLC;u?A2i2lFLo^&|Bf$+0L2N
zGGxi7izy)rCDrG1PnjGb`ML<F?oNiDMp(>!uv3+h`>L(AX_;N@;O6hV9S_)DcoK6u
zs_gnio!qCl-%!1~c<#&2tfA5(B8GW}c3(j`)%zos-m3|Edi|)o==5{q?Rf*?0`co-
zfKKMmP5)th{!fv40x8$a?~&Vq8DIef00BS%5C8-Kfqw>pRhDwSQ>MN{(okbT%Gf_F
zRD^}6)K)7(pH8QUyuMZbw2i;57^_4g0#JBuEDrVATM;a>gy&)Z|KIPbv0yNSMGa+p
z58B7^vOjVR`Z>?V-Ynfa&+T_u^s}?vPEBvb)W`N{_nQ>*XwKM<M;l|t>s#g>9(Fx&
znE#fnHNJvnE0Y{${?@2r7t;rWjh&buJ&F5C)bKYm+<x==WPZ#3_$wLqy#I7&(f5bW
zU!2>XeX84Bq!bf(+@NBAF(NFx8gk<9gMjrmf<3xOnqcd?=25<0kuOw+#}s&Pl)Yc)
zXT~wDF!c<Mve^8S({s768-K2+-ZFB0QqpMTAF^tle%`5s%8;<GAcXUycE#-s`9V2G
za=Tj!<_$jCB@>)^;7!4JSJyYW-G_MglQhW=4{yw`qh>>@GQ-QVz4QXhMOi<ndpB)U
zi{i~M-!^e^(S)pJ%U-$JaPGt1n<%@6Lr&gq9Pb6T8Tsznq-_l<;h`mqGopsSyEC5J
z?YcAdT4Z!U$u`0K^s0uK5?5VopZEIwY@MSov^HDp@!O+2#55@2&CC@3iGvg)yJ+!Q
zuC>t!h0Z?_HPp>dYz}X$I#cP*nr;)+L|SAVOSYIBFeRkAaqX^++yf@<=_O-V6<#m7
zAEPkFq?|le^N<0gMY4Zk=;v}Zq;31%#~I5qA0Lg)QOb5sDCZ<8)w8#}+MveS`~9!7
z(++-@X1}yv#$>NL-v;vI7;+QEp(j)C9gePbyQ8jVL`o}&N!w|RisdUB6ZnH24qtO=
zkD(Q8BIySncXW6kIB(OcLT9%dqF^@fmqQtTiF#8Sl~>vnk5yim^DXJ@!RJl^$8H_J
z9eUTvZ@in9mFm8k<rCL$-5cgwv9*Ex_J(@E(a2K<@5`5vd}WW9jc5*hx&M{tly|zL
zuekXYC|xKZpHVz-Z;v~qfruKC2I9p2+!yGuco40xH|_gf?|;FYVsGUiNN@Vt?}dLG
sMszV=D6C#}CTy2u)r_ysq<(ApLO3MA=<vb7Mn-Dcu{g&$Y)yxM0o=!f!~g&Q

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/key4.db b/src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..4db1426c3a88f0bd27dd3dd1593038e228c82540
GIT binary patch
literal 45056
zcmeI5c|276|Ho&{7|V<qlqeZvkiBMQY}ukLWlbevhOzHkx=O~LkYvfNBrQ}ZrG?Zb
z*{UmANR}i@T11P4`ppck+wFd5=JEZ0|G2;3?;JB{-skiBeBS4Eo}c40XL)e!ZLNI5
z=@`$T&;V*Uh6oY`fx#d{3<d-OA((GC^F2Som;rQtf%yskQ~a+&1Zbu1dlA$Zkf5+0
z2>uRL4?hj3!excKh4qBb{HsPlIY0m)01yBO00aO600Dr&Ka+sJfPkco449!7PNn(N
z1L)z@HPmqG{HLIaovD$7DaOIb*vb?$Uy4!o@xa*FnXfmp+k&w)-GbS;!Q6JEDaLvO
z#>9GqnU%ST1IEtO#>&XVR2{=SG7Z4beh^ev3Bn{zWWXSwKo5FUScpGUbfrdw2eFr3
z=kvSb=OZCw7)(-94!o6J!QGGQ;}IAZW)tcYNe!n9%$YOau*P&VhApxzEL6ZKQ}H;0
ziXlHc$0l|Te=3dczfcACLk_n1Qx2kv85AZdEeCd;wH-n8rMrhO<lz4yN7$_VQx-f9
zuVMm$NiLn=8lSMR2zuy38t4ycX4RjvQ1B|rc3=TXIXQ4f5WCA35-db~bE#&#ZK0f(
zjx#d0wsTO&P;tyRv)`x$=9|ch*#)c;JgbPpTBNWRDeOg76$*(pBeQ0jteF;TMq$mg
zSu-kYMq|#j*{N`|b9P1?D+eAoyB<~+JdTwHk7MP*<5-FCI94V+j+F|JW97o*Sjq4>
zch-E)-mE`%X2NXD&P-ruCa^OT*qI6J%mj930y{H-otemPOJuhtvfC2bZHer*nru~*
zt!lDWO}45ztFkj|vNLP3YqBZf*_a6I?Iqw?Z3*n{C9pjc+2urbIgwpXVwaHEC8W6$
z)>=q7)>=qxG9)$`5<5SMou9<+2Qs@YncbGmZcAoUW#+`;2zb`Y=R%fy3ab>yuIx@H
z6G=oetHNB!sxTL_);<@qEX;+ht(^;5n>-h?h|Yy9tg|7T&s@0Bj7@5;bfKB%pPI3{
zWVV9Vf(Na651I>pnc=)&W;kD$8UCs6{EC^S^M0A({EC_3{EC_3{EC?&Ygc1=V1}&y
zZ7yW(baSD{LP%c-J^u*VJI!oe+JYS#%Z>+`iu0i1a4JMTnB-cye>E^J{06(?7h(wW
z8%2=yts=sFgJDJ><_nkr0ssMk06+jBz&n8hdSC_wx)_P1{I$(u#&Qx8#QZ@bK_H~K
zcme_>p0q4MYW`=wK2v8^`wylBg#7oycxD0!7#tSnzbcF#8c7e;a1Yc73iRKx(mgbs
zl^kb=N8^^mARD1@goI5{Sh!ax-QLy;6HX5c$Am>N&nNH-I4nztAf(-c0s?{pH3FHZ
zGb@9=G?-ag)mE}*RRs-}<7sbp*A*|%l`G2wk*EPWVAcdW336h-9$j?!pzv;`>tq00
ztk`zZ-~+yHK{ac>%!`W)ban6M;|q3FuW{RCfIg=dtN=>6Q5z_gANANEq@1AmWTkdT
zvJa78so4~f9zc3lu(-T0_&InBDq32+bh=1YCGqNGNQ_az&_iLrHcXdVj{V-=Pb=`0
zS}ewnZ=jokyOgW=&18DwScKZ)_IFm%qY;{sA12I)B3l*FQ}JtGq#nt)M|;UV6?o?I
zZHUab0<-+-&23**o_24Rkp-EWR=gdc`xG&X3_jW&`~E5AZ2ALIjo0h?IODXm=&{E1
z%=Vd`%6%0&8OYyK5aLcNW?D`?bsIl)rYxz@x!PyXDe<$vBKh9AR)IlaTpTza7XTAd
zO<I>UAp+(X!MWj#78VgW5)@NJF&(Ywjk*5rxuIF$Nd6UQ<@PtK^;<lqCZj*rYo312
z2L|(jF*sqE;A|E?A)GW!$Sr9dm=1x0RiQ|^J?7oH-_P-P7--67AArVzMY}%~C>DJV
zEERJT{?(~R7Wa@EC{iM$+9qBZRCW7Hl?-%I#;t>K1PLwSx1BX8dq2Xf%p31_oHA@2
zpMVRRxtxaHi_bF{lx_|9_8Z(TGH#ni39aT(?41BTGokZQSs%uCTB$@nb8^V3ze;b(
z3b<RD8B_dJR@7GM?(nOFQ(vjOv~r#t>e*GB&UoHanCBbyEjwzh{Y5&a#{M_7(|h~Q
z-r@(p|K4L^By4kN^YOS_M~j}T$an0m8Ay$HhM<C0Ozatba1WwYd#UU0#qO#tD)y%;
zx7L5Vn<+SLU9@|nkm`fO;d_paRHjMZwb_qL^ysTrM2D2+40fcI(kDjSj(Y#@|6Wsk
z`%MA0rQ@r$BpN(y5}4h<$E_R8bF~ib$=SEF@v+Isz3P+7W`kYRV8NE07Y`(dD5}5h
z;@S-z!k5Z^$s2e2zPAF5vV<}+o#e!SciMBcO6G%r%zk&FxPWJ$8_l4RXCKG)*q=zL
zsa%G0QSw|GSavJZFDu?Daz_ZG?~SLWy2A13U<wiLtUO-27g?bkwH0=Y@#`&7!zTNT
zKD!+=*IbI=O^ju42MMaD%bZ0D^7TWpO&*7^uA%odR6tTQk+I%W5*nU48%JmM^GBEa
zdL9KE>00VZzNzGe!pI$1=>B#wGjEsjfZK#a$e0@84ISe`dv%Ljb|@aO8RAO8v%hsR
zYT4Io4zCZMFxO&IFe#XPeFXDe-i)^Onvmt1oqg+vL$sq)Ep>5%3Xgl$eJ0Nv*vn*R
zWC@3+7Emf~qOqUeNQixZ+}yM3h_Pj8VMD{i-8;UdN$B6<lWi7AK!lr2+8GhHi|@>_
zxq45Mp|4Z78Yw1i_xOUB|8LDwNV&cSyO5n5*N*w?uT)Vcgd7q~^4gdb6Ck;`>Vo|)
z8`}stFBDXYi&h_kSC%;qzCqv9-ISnZ<lc7EvW+oq)I0Tifg^@11+~Uex0y%#O4Q0u
z2=hak6yD1wp7%MTFgVb1B!Gx+Xbm#6z93Am$%`Dfa!@@oY3V(@@rAz2yZeQ4N#!Oo
zRCnYkze1z)<1xEC_gCp;N?AL*HSW^hx?MT!N#g27g2T_^Pyq$L!=(>}_x9D5e0v2x
zGA6OnJN}u;+Vs@stG6om@ACD@=`UOn-}~vH4eVAJ)y2B18giTO68Qlg<h@e)J}(rK
z#5c&x)UP;gbhRV#U8=`eRIRmH)Mv*5z3&l*H65ova;0FlF3QD5do<MM5;Sp55tD-H
z!@d3Pk;FrgHsSkmqwzb`bjA|1qg$Z*%GQGu$Mwy<+aSfa8UieZUN(rGyRy9VbYK6q
zx4JP$Gz6y>N8Zh<!wfR7RLCr&Zg@n8KW*6e4qt%@-f*GR+n=-(ekJOcb0~&S^m0cE
zYIo>YC2HkwjgfbUjn_hEh8@Rj9G!l7o#OC3PN6*bN;2P5w}(bgb5(hvu+o@xc3&{)
zP1-7ttVoS)F$<5*LR{Pi{=-A*Z@M-Om2jo7#ANVxhLctXRHFBw!6GIF?|b}`6V4gv
z*3SJVNUzKGXJ%|aPae2xT!OvVa(r*#6^~cABk3sToAw>fBYk#TU9I1RAs3ZmAs1>6
zWNz1NbTxaxpc)%G3f&!%RxIgiFNi!u*Q|Vb2L|c*xHf3A2(LqH`;Z&;{uzvRrO{v)
z+O@6i@~3^3hf}ZgJFiOl`ubzGqStuQ9oyHG&Brz@St)jvb^jXt|NYBam<54(f1ddQ
zCV&7y03ZMm00;mC00IC3fB--MAOH{m2ml2Bj}Z`nK!sR0O=i#kr$MOc|6>~nYz{yG
zAOH{m2mk~C0ssMk06+jB01yBO00aO6YyuDnNND!_{~`!=5r6^^00;mC00IC3fB--M
zAOH{m2mk~C0ssMkz(0t96_l}D=)d*HjI-zeFF>dl|DY`dtN;W60ssMk06+jB01yBO
z00aO600DpiKmZ`{ZxC1tp$Pr`KSr88{~rdShX0MUKofufKmZ^B5C8}O1ONg60e}EN
z03ZMm00;mC{!s)ZAta%{`^UxnOqXEP6w51o_TwLA8!!V900;mC00IC3fB--MAOH{m
z2mk~C0ssMkz<*3YSc-N3UkOeFp+2H?P|~Q&s3_DUR32&zl8Q7&_9BlWr;#_1u_7rV
zK1irYBT`;uNTe8X4v{IMhIlJtA%Z}(!WnQH{06)bp^1=!e}(rTLJ<!Cu`wV4KmZ^B
z5C8}O1ONg60e}EN;D0FrG{guT=Hun+P7e)tB@jJ5sW=MBb@t)u1cC}j8K*1*F<`g$
zqwkn+O#Gv<A}1B6z)97V=cJOcoK%t=CzXidq*7!#saoj2;-C|WWKSkL_A}JAWjM-|
z<(y<1S(=kfrY++n(@0A>$z-Y&Cs`9G`B&N9lTP&bW5bqklqnLNWEy!fCz(uJ#7U-+
z#5u`isu(9(6DRstndVNWX#cTcD2_4($w{V>ML5Z18iJEdBf&YzWU4SHSraGpSD8v7
zxYPgGFhPzoMSzn`Bf~h!WEwvwnMQ(glF3vECs`B62ZzWA1yjSqwg-iJh%iT0DNrH^
zwHbL4i4^fc+(O90e-VBpj1$@`_(IS~;4o|gX2)N~F9>yq+<+|Q3kTl=t1=t>Hzx*G
zir*+s9Q5a5@`qo1DvlA0b6$9WFcN3|)ANJ{#Dg~Kk2UzNrKaQ?tCQMnsM43^eZepD
z!q&;vNs=!8%>yg{^lV`$Msa)Ajy^t_>0Acp#QQyn;L@_uttgt*FMY!aw$CpPOE9pK
z98GHCcrcm%wHI!+@xAA#b!T0*nhf9%-gGrxnM#AbQarU+FF-+uo5?uupaWs1H_p@V
z_4;OibBn<BOQ62x+@#sstvGRd=VfyScF9jBe;jFeFj*>VS+puX`g=u*R$z=_Rcp^t
zO!2PmbuM&BOUoTUj2JhQsR_LbwQ{axLEWcT)thegeAwP@+VZY7QNPmlSJ25tA`Gkq
zXOk2jOeRdEQJ)pwzXuBmd1&V-+ikGEIsY=B+m>9!a^v0{wWZulW~hNDV*|BcVgh<U
zhXxnFx#4#0wUvR_CAp@kzRNMvB@FChjwWej9!v%x*5qAwjTR4`+~WQD`a^jm6y&oM
zY6@C1roM&o?p`}LlXm?j7(4S!dCB0YPmbfG$qhCa%aU}`lT1slv?+<oRx+@QIGQBW
zcrd9so!aEtT%$7d%Z)~pMu(VZ*HCSpMdL0zXe8qDUMD0slkII)gBIh0;j1F*s@gAN
zHzS)JtCmcioQ~>A%cZ?teT#t==V+2f;=v>(GIhO@Wq)i_(rN^yVHZ>~BkTlD!aBF4
zH6s0h;dfzfCPTXv`BM1dUMJJC3W8<pKe?CJSu15ej5rqVT>^I{rZBK#98HpW8G^FT
ziMpL?JzQEo948i?PQPYe6uSp~{XTwV$tJvzLH;XlCOtdv8f-0~eR>%6+-Y0>SLY8i
zh1>DZeP2Pt;{}p>h?WejC`Xe#4MA^X3pB)Be5=Thgr*`7KkEGYjnAw^3e(xpYxUdn
zD?M@COz!STkf(mhLF+#9QnkbP*gQ&zQY{s!2{7n`&p5j%$TF~~pG^LEOu$2TFRnQy
zuW}&9<8|?blv;b%(c$5!=PkJ&Q-zy%lFigLmAIK4iaQ~KZ588Nt1<o7+(b?wi9f^O
zaFyfnXe2&CrQwnq1B>Krl9wR}e>6|lL_4=q<y~p`e#g6m2eL4!GwbQ_u)DSuWxq1g
zxS70~vHqH``wIW&mB+P9PaA9h+V;{ugJvPJG2g>r+Xm`623CZlNuGwF{CnPIi(H}{
z3$m}SeK=X!92jf(;QY2t#|b9e`qN(F&v7$pmtzin_TtfKisstux9WwxD+}UxSL;#T
z7SmxP`?WrNVqg&*P4YAZRiR<4-eVn`)>-W|BNuPUguEzN^CThZa^iZuk8A3KRk@jT
zZbBNTTf9u$vJ*5-D_avGvkPPPK3t~XYNf%bl&{ny1{TiIBu_)ot1D;7?RRVj9M29E
zEh<DmiuN<1PD=%nuzqO{+26g}xS3Rwxe=Z-c_BQe+Ltkf|DfO5x9n4?wx9Z@fiq8I
zCq-T{u)-Wo@-zgcr--(;(v!3MuRzbgj0#kJcowoQ=dl<6KKLEao4z?o+)Qf4kY0{c
z1sM{;wOf^!1;cKu41hCFKeZJK)U56LO(v0n72;@;ry=NBd<+cK@uk~m^?6EmqS&_`
z*<r4YkW?SzT(4f8G;6N=<Vczt;@kwh_jdCbbzOtUDOjgoN&0$2@yWw>ha(+>PB5^7
zKbidT=$(fl=%{P0Eb_^>=6Gexe*3ZYQ9hSGr~0I*Cf`Zac5Q|&zru}VL`(s)b8xHg
z*0IN5@olw>P3lwalQn~h2YWn4&1rfJ23CNxNnVB^k<!w$Wf^DF&O}u!O{nHf$u{(r
zS?(Nb_`I|Cif3K+FWgM(j9r~TBUU6XU0efwMo8{Q8@5;Gq5Tz-<E(7@<qm2vurQ7$
zc^ZP6oKLS9`TXia>5TdjLoMli=WV_Eh2n0;ioPkQB`PEs+)OUvm%3fE_CmQNt@YZe
zgt9kIvH>fig<|$()?N>LIerYx!18l6$<q+j28+9GVP_NZa5FLFAO^KBsRr8Y5*&I!
zCDQyPWKGp`ZYDS3&KL|R?t3eKQ<jj3OHRRq(Ys@VkZ85|NxQK(>CA&(C`Xe#4MCE(
z4V0Rm)KsTEPMCSTn)tw{QRCPu1N0Kl=)^O1CdFKjC!;*y=pKm5`am=S?Y%A^v22Eb
zyS>icIjb>6L3Rkf!k&SJa5Tx&5TyQDP{u?;$IGrwp|;&YPua(h&sx>k;>n%Ci%nPu
zcdjP$_U3K+>cuA?E16aueH35(N&lI=&-E(j+~msJZDde71Ix$JBu_(7o5Y&t9uTp+
zCb{jaYUK%!uy(T(-!r8_U*JVc_vx*KbL;L^kFPm4SziF3J<?-Zp>p`Kb)%OWw6FVE
zH7RyKXvG;Jh9a0>h7`AW{yf{YgVcO~M6636>E<~Uv@1?Md>D*lFmM42C$%Ctx1UaG
ztL|4Up1v+~bwt5UpO!4<S=p%SYLaOj-+>YgQgr$B`fqGX!-U+D)`95|C|DJWEWf<!
zk<G-GQqNbSp_`XLMc2_Whc>(TqLpArM2qj=FJhhlqhQ-WsIAD$NHGzAL=!?DzFW9k
zSWD=D;HaRbK(PQHQwAo006+jB01yBO@J@h%Rr%?g`p4T}JRFDbQz@$~+~V0}yy->4
z(zPzz*3rtczvhLH2X9r+KGd20=x@FPf4Hvet9$pYN(?Hc1znB%p1FJ9?uHPUOwz%Y
zT{#6aXJ*_#FtEy;P4aSG_gG3@hUytFc{6i^&)>4ugQKNgtLz4;b=4nK1qKwY&AFLe
zuXwTbCVj)2(u02EF4EfFZ>-Laf&I>3Tr(6j_%yCmmm#OfZ!mX-{BLgs@&MA2SSrci
z_Bun`)a^slph-)24&^;*motA>YN+F)Tx%LPkI%(-_ZFykdtc3q`A}H1887#7>bu_M
zl#<k&j_Ur?LXHeM1&$th;W%V*!?xol*7n(?4*JB1{_W4*wFPFN7w+8}I^D_k7xTG!
zd=_i8iXr+vmU^F_-_oU2mhd!(Z&My-^}_;^>fy^*V;OSt96f6Cz_ErFpzES+?Y?WN
z&G@I}i}y)U8B*1&r4=)Sj_lQVtscwG<Hb5Z)y5RRI=#@P*TncNA14h4y?$$Ziu$r#
zP<E9}?sbM7mZL{rE<E!c?C-U_wd4KAuE|On)6h%8{jQe=PPN18`N~C3s6SZE&0|Bw
zR@7H?i8yxI(vh`K3@_bob;3Yx#KD^-1_~k_a@!elavVMKa!FTj)ArM+3?CR<RrH$l
z2aq4)Lgo9<Z$CefoZUw02six5&10XE3As*4bzAm_dcV~%W!Qw|tVgy_NV_BMcLr<M
zOhqu{FdRJ+dFX3Yqq^jM|K$pmAL|g9lO5+T9rKu?y%Vp7@`X%C951Ni=CKD!f=Q?7
zBv|=1pBg`Yt2wyq@Xp|~ks8VG^Cd^SJX;uYvK&3~at&ad>Lu$GMRpIU-7(a$xX0ic
zCA-88Kf2O>q96sdu^hq8W4%8%z-8nk+EJ<eY*-{lcVOGejmN__lz%yHy?mM07i)$b
znxjW89yn%c=pE3FG#9C?9U9BMhCF0tx~vl;u5?DY!eJtCa+w1+kGa8F`d`HD6U&|3
zf8RH~mES#_>hav9M}J$K$h!3E!YT$<=BGjYhdYScJeU;ESYno^n|^EfvT?y+e^uP>
zr7c&f?<<L&9cyf+%vM@*Guhnb{yOz_?dof?X@dnJPov%@Qd<n)lC5a!Z+ys)Gng0n
zmUA}AOK%^2P(pZO(O9MavGDtZM#Q03*yex`-^O+1S5Ob_1HsnZOnz!IdD5kyQ!St-
zfBr~5I!EVtd&0LBXKXK&co@}IXzXNQr8%19>5323@$OAY8<<6{Y(akc%=Tmh`5e)7
zY=yeBn7Si+{d!4mCQ)fBG6xT&Y$-pt@fs~YMR-gpC!&>qB4l_sDSyCQ<UIqsjH5}O
zuK0+rM{iz28`fOqynfOxmu^v>_iJH?{N|-yZVk5hhnoo8Opao$TkwxItWg}>d*RZP
zz)hbl*3R^YU%pf+aDC7%-eQP>UCPlUPgi{E7dhggi3Xjg2P}3?*^d~7fsQ6Xy2_Q6
wHJ3Y1)m+ZvW->A4{1w!;deNN+_kDh`1%5YKlm1Nx`XF~(?27fLMAfJN2Nb@>s{jB1

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/pkcs11.txt
new file mode 100644
index 0000000000..142748c1c9
--- /dev/null
+++ b/src/test/ssl/ssl/nss/server-cn-only.crt__server-password.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/server-cn-only.crt__server-password.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/server-cn-only.pfx b/src/test/ssl/ssl/nss/server-cn-only.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..052a8847cb8f8feef763a7220540f540d8016f69
GIT binary patch
literal 3197
zcmY+FcQhM{-^NKJgxnI1d0Ww{y<%@_#NPDQ9yP9-MQm*~wQAL>nHoXSqLkRG_6~y9
zti8qF^VfUM?|tw4{_#EEb3V^G&!5i+frbPCNN*v~5CssJCtN-J<PTDE(i}7d0YpRi
zeq$~K8Z`TF1j<2!hJK@d04d4u*YR&cint4+{BHw<6oj}9q?kKD&Xc1s0s#ONBq3-}
z+D9^w9;pvM-gbbWelghQ@BEZfFFNiYVTonS?Ow7O@k*o4MQ~*>%}kGQ=+c8UIY;U3
zo?g4|1=U&BVNEi*;+BLs#9VfIe0`br(O#Q$@R+B(Eza2CUc__~T#U<CYB`j<^c2@4
z*=-(=p`DY64YT(FX5O4)q(^^{Ht9|EyhQ<;dfl4)d7nsrj{V@rctm*cn1@BjF!z4M
zRUo#2HIzP%I5QV^UqPRI+FFHSQ+(;#n<{U_w2*k)aQV^A1Xb$%!$vb(i5`syacI>g
z`)@+-gAqp6YprGEC1xUB)I^m^WUq;4WbMH4fTTk!H0o6OP4QM~eG<z1C>sfmjuVak
z8MHEXkuHuWM?DF76H5Kp{7f1--*@YB%9|+}m2odQZau42mzUhszKt1%r>_3q?e88@
zi==qw=oU{LRKb#*2MU!{x_1Qp%mxGb1X5!6CAyqAaIf-G>&=HM@uDc9m$+wC<)xPV
zp}3+k>BSGgcrlUOphe|QX7Lq7$dRLsjnGYXb#0+a25!-jM@QFH;HAL}GxiHp4x9D<
z@-L$^;HK#z*$_@6d<`Sjq}ho2S__to<x(YC<gF;k{_uHfb3=n@UEVyM&R5|`=c~f?
zxb4H%Gn;0ghtB7sKl;kDrcRz=tl$#a=&f(jnJw$IWCOV(Nj;H@if*iz^RH^rRgwp!
z8Icn*r=QXyC2zo%#vXB|4w)GkQvDASd=W03A$&m!M;ph{Izm}{i)v1s##GJFA#kK~
zJjZF%7mF_A_^Xje?Ahvo7y0sKK)P_Hjm={roo%_gTTn~AM8gh9D*ST$mWoU^l|D<D
z9*f&@YNu8u@xd9%{>1g2`5BVd=*m0kG}`NUFf7Z59{EKp>;COyVZWzF3uSa#V_g^Y
zcoo?&bJ!|xlI`Folzw1<@HfqAY}z=q+v)+I{>zXFI}9C%Wv;}cyH}@bmS>Y)s&T{&
zPoxO?)1<3`juhYC=Rb=rIzR3+$;lcpaQG0C!`^+RqPUpsW^z#iZ+tt3+G|i7!P*o}
z#p7zT%j`Z0NX8+roSCc^E`~mD-C6(c%bQw#s9<FNS~9gPI((IdkU~y<=hygx{EVO5
z>LE7`+7l|c54seej4u**lr$eU8ri_<z$z|O8uw{`*?IF9^dNV!(lt^NhrCiA>XWw4
z#;z7@O|=*xJuS_WI>L7%K<n8gxzo}>+Tx0b$fcoWdTOP)U3WTS_Yp8CG72n_&c(Pr
zsYh1FJ<_)PAh4x&4h5Cx`&_$l#c>*DTgjFpLDu$~wvQDe(SO@7a?Ms%XDh%ZwlmnP
z;u0HnxSdPL+|TX*r5(isOA<RFCwgpmWxfBbkS*g6^S=Sn!#q<QP&-U>r+(aBWBqO^
z)mITFP<#wO23NX{91h0pm!Xs-nid+DO&l})I5`uJ7A0FBw*$x;)e4WKw#{5C3}yn&
z#?J{F*iTK>u7_j4ELD`O#tpm9g{5-UXU2pRc=OUxa}7VjO}C!KOr79Jaszml$R@vL
z!j%k@m-gU=86WT>{!yR#t2hXSgDN7^->rWcDzp<vb=Qr9F=1_;f4DgqVg|x5C=N`H
zeuhLgQ~ho6mBwN`k7B(MG2Dj^4>OR$?h>MqNA*;?M5@u=IW~+GB@;3tRMtEoy6fH#
zlY4{8&t6<!2$D0g=;kzBshW2LM=U2=6Bj!b#D!&CwFHiSdb&5MJ)xV#A+u%M*wg##
z$sxj;4k*`9V>?Ri8l)zlh`q`#PeB@EejZXMjA4Fl(nQNr4U805&-7&`>Qb)`RO0rn
z1<6%<<sw@D3TuC?l-P!}+wt>bXbO(ml_Hir1e2sacK(Y0zRFD5u4|gg@6*_b|Di77
zbYqut$Xry}1s(-aPaOvqoldI3<44!<G3&T_ZSyVCl8JS_xMsFzc`T*DO=GXSy>^ck
zJ(eyuZ#-Ab&iyHv1m~FIDkExG|Kc(iwrXwvV+yI<7O!k@Gi5Ju^QyEw<yfZ~zxVFU
zfaOM)ce%Ir0Ab6RDU1;7qp0Q_dsS<xJ6h{06HMUmJV2?<%<1LQYP(3rYJ5VUvd0zB
z)j0w3|Kyv5T9hze4^uV5%iYR2thcv2AQk6OQPp(7;O-EA3GGeSxD^bKJxpK^cb*F*
z^GBNc78Qk{lYF#`Rm@O#U-Sy>Ub1V;9_>lPc}%_bhF4_TUw&ECH|Xn<dK1Z#UtT$c
zO;(5T!y@Sk=w9SelCOG)a}+tK1%W10{68YgL6Zps(PRR@G0*Sg08#yq)+k8<IcVTE
z0u9{wf3~~zkL_;I{i8neQ)2(v4u}SJCy4nYb2EHi4-WFMDi+*);||Jm8pC@*sP(BS
zx@(UGZP2<LQ~Qv??_K8|#Hy#h$}}HqcC2fT4X@sdzQQ?r?2-*odEe5ATz)wU<}B8V
zk%<93uRJ^0yQUdph5o6r4Rff_nhile9ev;Seqt;H7^6-5x67R^w4j(Qz4H^N!2@P6
zsdBQU_NBN*6wc1>anMnM!L_S7BcLLxE*vnuv(`TMEUUy4=H9dtu1(SN;m7Kag($h)
zxH9FmzTU=3(l*Xj`4hm(852aH9FJJuikfgj2GM86$yFzMrKxRmz}4##oC;qDwK6tV
zP@0)EVmc?^h`9PS+=+d??#<miGU5pQ#HbchMKXKKIA6a(ht<?_d~A(VkH6nT5!I?t
zeKlPJ?=-*O+4{imv#>`LC3yHQAi{XDy|b5BrFsIEf)zZRds7*21>mMN{fXF&o{G)8
z2Gg)V-deRF-pdF!bggK)Tnu~5GPUxDo)HbeJ0iCMoH={aa+MN)T_0eTP_`lP4Ie~n
zu(28wW+-`buGr&f_DSCdEOl<u++;Kv?4*|vNAm=%dA;r)+2}jGJ9Hzf1*r?TM}&1U
zPH3w8SA8p~+&yt#ax_Zk%6LJj+Q%H;%gE`}wB2>b7|Ht!Fs(E{G>+jIUGj0PMAYAt
z=-$wC+>zUT8n|v#(&uQ1&=1Bu#DqgdQNzi<M%<?I*e0#(d7`N5Z>c%v-F?49xT3mC
z%Cz=Qbu$abF9x?Ns7}t)9B7~?w>sxJWCjQ9Ftb+^yKZ-r<yu?uSS;asMe9G)p+|0$
zWJ4`dG<M$hyaFYT628lECn}(4jqB^Zmm?b(DsU!x`9e;Gg__WZIsSzSD;(v_(BwGA
zFavY}JXv4sW_8HWuv+Q4nWFFT>7gI&-njp_I}7j1VuzG`Gt}@!MWU^^*(czU2qmGn
zLDL$u3wv`GRZ0e~`^&OJu%4qekuIq+M;vqb^|_Qr4S(RlWvGlin*(a>=tW1;J56L(
zG~kpb%PeN04oVME*Bm5aK)aMjx+-QpY0>-H+g#La3%9H9pb{}V8wOQZdlbW4*b80`
zs|F&*?t}vcWxG<2I`TDT4)a~(MOYgZ0~qiK4^H<?^$C}+*f_&SZNizV-Uoc%Dxg-j
zl#>7%G$3l9hgnYY*BkK6yJi~NDQpLwUD?-fAcjqoG8aXT5w_k^A&d&phAWqbyBw+$
zE)KcJ!RUMSY)+MK);u_Q1DjA<Fn9B<eTlVM`a6)(PybN?%Pafr<X%+?FbX-F9q`z*
z?75ze5%>Dq)qN%V9-*)q!2X8BDAS-j*;K<xVXk+I2x(@>?oPs~68dag&Skyhv8ca~
zn6I<Tz_q)nZezj35M4zE?WXrx9g+JWfBWg!N2szsyId7~o?k~Ae}9p>UMesg)-gSk
zy!oZbwip6GE8b*MT7~4fuO;o~iwYC=kVKZki=1iT0U_D=lCj4zT>rkb|M25iX9Xpc
zL+xz9Laz7rD&v5}&9&(ve{8C`-}@mVjTG<6z|?^T7sRfw(+2kQ6zR<@A69z1{@`GS
z6{3&~q9}7)#y(uo`4}#i!R2txM`aj8%Em0{bQp_y)3OlHa6QmJogwDdLHV<pMTi~2
z_P^^0rW2wE!UD&3-e~9y9J*Q6=3=+&eqr8N>>-2@_Yq(a8Sm{|0A?~0AS{>?)#S()
fK+p<!9*uI!47T<J@c}8q1m<mmvZG}FS;_wZs?8RU

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/cert9.db b/src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..d6aa6d7f651c924dc55f8aed978ce69888b4ac68
GIT binary patch
literal 36864
zcmeI52S5}@+sAjWaYtJO6(k5JpcE;4+ySSkp%($EirDaglV0S&8bMAeHV_pR5kWx(
zK_ManDv7ArutXF~5GA%CAlSu%yt{jcATgiG2l<k`->mN5vs3;v``g)vo!PlP4>zZv
zXg+gZL{u0rn#qRbAQ*<snM??Rq_LHOtvw4BGblYf*eBe_{ykF~GBA58gLFbP$!19E
z1yUnbA{8v9i|v2~5C8-K0YCr{00aO5KmZW<3kjIhXo`wzuy;_nKYx*52rtM#Tp)0b
z@eK{~ldy8PvGBBEI!v*)na(8Qm@ZS8pW>O?JQixCGl@zlOeGXTdA|J6Pbp}hDG+h}
z71%n~6q@2UYVd3#zaYjpnC}<;NrC#Af;hIn1`B2BSdeLoBYKV_NFa#eM|~2Zd?q4_
z?61LP=_I+p5{hbSa7tJ-&o`9+Df=gbB-Zh?uynHN%OS|0>FVy_Y~k+BbhPniPMzZ5
zHq{0%!OCTdt&@Y5C)2{x#oben$wRS~g{?-|%EoOX01si|L0o*7i|=xYT|5bwgKv!S
zjS0Rn#W!4hGY;SI@Qp9F8AnK=qAj6_;u<VeR1U7fLU9=uitDgYT!@9@N-PwYVxhPe
z3&q7)s2{!+S5H(wLfJ@U6Us(}vJs(dL?{~(%0`5;5ut2ED6@&YY$7k4$jc`3vWdJV
zM63xBYeK}D5V0nrSVGx^P&Oq}5|mg3CL`i_jZi$V5pldmM4j10IGYG(6X6^pghPaI
z#36Vo9275wLy+MRWH^LAhtTH`=fRlBYfR)dCh{5+R548yHDcj~i%q=tTs#yd68rIu
z*&Mbpo<MBk3B)E|y4b|4AU5%%6`S}Wi%p!U*u=4lOoETt?9E1y5{LF?GwG8JKP93B
zroDAA?Wu!FZ+$Vdr@olklNK}kr0ppf3+<^dX7&_}nLPz#W>3MGi8nR84w#9zH?fH~
zI<e{BYw~-|d7n(8(TLLe_EyIiua3Vl5B2v&Q5_bErf8!ELn7BQKNRcH`|x6-BZz&U
zPuH~%>yt^wTrC}Uw|J)>M&9ElL-c{0U;zXG0YCr{00aO5KmZT`1ONd*01yBK0D=D=
z0(7b*b}$U21VTEI4&)Kih+IQzkrPNI76cYR01yBK00BS%5C8-K0YCr{00aO5KmZW<
zn+VX!6j)Ox*@r<G(qmT9#YVCOVMsQY(!|C=Dq%2cexZnsCNg2rv(Awu$P|VqJ?kvd
z|CgzNWGax+vW>Fovd*$pnJT0l3HzH45EKgt00MvjAOHve0)PM@00;mAfB+!y8376z
zf*E#{csUp~XH7yU(8yCMWNBkhz95<z6%i55w6egz)Xj8_5JU$=@jcv}m>wQZ%qTv#
zBM<~dgfpY@q=Fc1t~h;=bR-5zhc-w$)Irjr43ZAnff7FyMlD(9=p@nkG9}K}A3Rn3
zs0I8erXN2lT0pYLlo*4dMD+h<??FgCl8B6xZ9#rUCdqanYp@`&00MvjAOHve0)PM@
z00;mAfB+x>2mk{AA_5X*d3ZN8gMp8j&<E55_X`c;hewNg;1amppbb>uVw3^ZP0(j_
zfQ-wLMw49`D3hg%s^DV{Qqsfv3<dR${fOrO$3aLcQh-z=4aik&?*C3C35oj`onlZ`
zKmZT`1ONd*01yBK00BS%5C8-K0YKoNO`vCRLi|Y|LLLK)h8cYPcm{q^(Gubq8bVfw
z@rfPcaH=?*g69x*{>3q5aSTb5JcS_;gc^!s^}}L9qk|$t`TD%jX#H?r7+-+vi~9eO
z5ON=>LG~i6kRl`nX+|QE^Z#scpmu-&AOHve0)PM@00;mAfB+x>2mk_rz(1LQ5}5-Z
zykyfFexY@d+|eC0$vKTKshtN7i>4>wv7QmE`{x#4m=bjQ$>{<r$?dlL4+})I4e(f6
zk&}y+h3>F68`8-ZdVbgZwSEFBF?|4!J-V?g;`vV=KE|^Yhen=d=I(7?28m_^D3Uph
zFO@5U!J<N!A*pqeiL{ASE@u9lm*jcW?<hlMW!0gzuF%kUIc}eWiI?N_+4~(+_IJYn
zSg@vK^Fb^n_7jSIhH6kDSrrwMXgOpOOd<`Hqbq84W}eKecb=@h%{6qwnffUns0@vv
zn`oc-Mh1qZsL;T_(u1lh%3!}7!ZI>tv9aI$;LK2z;h3Nt7Dv202qg$%^}f}HsSsHR
zBM>TtB}qbzz~S$%KVMDBm@k}QU?M!ymO@v!eb@f*%S8*C0%-GPW;Jg0%7vBBqz9RH
zo;Ye;_}==^syB_wnaf^8WRsj0n(-3&v@EmE4^lo83JQWo@!n}(d!&@AeWJ*<?Vu?`
zW04zUqxI!BrILvKF$t^QQC!R)W+&OInFZIxN7B)XgqB&GFLur0UQSuJx~8kGw7OJz
zi~}v?sgZxto9eBph4xn~h4ouwrN@@S<7?C=hrkEpnv*mwt=N-x%{H{0Irhl(4@b@i
zW+|LZy4BS5bn!UtAsyG%GiU*@CR<Bs)3M{^qFrwdca<2*^DiFRYG?a)YsGikD%F<$
zJ8#opFZDGGnDa|aE{P07aIPFGi%Me?a7HRns3;kRyZbW3PBq31h8$5d(&l#ExY6qk
zUbavi?;b9{t9dKn{QZEWfMa8Wn;(azFF*HmRpYL@Ouc3DuI8)*Z<L1%^xLRiyA@xT
z%$*#T$`&Z6#@4==+C2A6ymI|;&624VNq6q2PAju6%yTMS$+b}5eJnC}a&1j#N6g;W
zYsPP1nJJ}wy*V<`=Ss<k1tzCnv)61?Z40cLkZ(wlEbltfpt|(lImsHO(3?tUh58Bx
z2d6Dg_^`b6O^klF7v1JvMzOck&BVic-E(Bd?W$Cp_x=St?Low`wC3$UU(sAVODHv6
zWqGl$?x;7N$MqD)RA=vWwo9E>RI#!tUhB?V#-h909*fXCD5hzlT>BjAa&jYnaSgmh
z{?4T};IGGh$>qXA5@iYQXyoy_$IB5PxcLW{KksISVhb)V%h7{0v3I&$^04xNA#7sX
zAb^8m7?X4FyFxXA!ubt*H{5(8d&{s@ZNtKcJLk079@k7;UUML_$uVxNMk3{KvMrhL
zwqu~R2DrEFOCf&fU+--hHBA^1>;n31037qTGME>7CGxj0-0zATIIpid*FpG(A9eu$
zvwOWadBKSAfQdh>->>^5RL6(ky8j&G%z<zP^l6}Ri%oRGd}`dwCM5&*hA}cKcRqfT
zG94)mt~0kRTxeGwiZCv1f4)gu<G{$+ZT0zY4KF2?O;`3dZuNH?XHwTSVeO5ykg`Ub
zLvF1SWu^7DAGbYzy3}MFuVu*dc8yyR&J)R(A39|`vwvFty5s!ElPxJ_-hm{W_fT8D
zo+aN{AGU~??tP`pbc=qF&4q6Y9KHOOr(E8A{ak_0JNvxj%ddN!-sBM8VIQ?)Rd*J}
zkn-`p!%H2$7iY;y<LBc>?D@e_Za3*<+Y<d;y?t}-@~BeZY27`&tg!ArJX6>?b!Sdv
zctTSC0WFHppK!0<vvf>0b=jL**@xWj^0eAJ?d$>NX>lQ?$sJRl@vrP3l2sCTV%K4*
zwx6cjY;``{tQ~DV&Gg74NsY&|u1FMUci&oWm3!;kvsWsWd?Z62RcU^k5is{#PTKeO
z%h+^E<_(i$*ITNKejVbX!po@5Ta@;)-M!=8=9!8+*R7eqG3}eCEY9QP(Y$BBCLXdG
z^P*vOfe-T+^{O3Bqr5r-A2b+@Tlcf&rEF9FiS*N{Ds!6}s^$&5l<@BH7Gp!3xBIGQ
zl9OW^+|)<<+)v<dD{K`?ev=g9BCMb_mK@o*@?7kQ;Wdi0?<NV0O&x;L?@QlJKR-{|
z^2F$@6LPi3y5^3nguG&?+LzpLw=wWmPr|OGL1@@tx<!SB6jC2=I<&7J!7Kl@Wq{rk
zdmmP>HywmSB*B#5`qRp$v>2cKovwFt>NA&R>#J8aUud|b`O7<{4{h;z`77r=upb|l
z90@PQ|ENrX)~R6r^fL~wf4w`!UI&Je#@*@Ho*H5<)*8E|)f2l|N`DtS2oS&OWWPGK
z`KvDUhW+~8uYB%B?n|+rr7!5>UejHmfUs_!2|lrJTeZiTi*^17H(kh;jo6XfSTW&F
zZLqR%WYY=O;ewMoc{w*8>n)bClhju^`pk4w)T#BInOkl|c?Nn-6P%=8Em&+VCHdlF
zd{OzwM-}XeGI58hqM#}`^G7*b4fA;RcTZI0$a6ds_Q!9zaQ8`WT}H<J9Ez{oh%pW;
zTwES)Uu??bzR}pXKC!B^I<qC}n0Dn#=La`arV1T*|By3LS9x<pDo?O_?Z-*Wf?qvd
z=xuPUEo7~WO|e(h@r&o)+@JAMAvV*kJETVYE;Y96hI^6cnLWjxdTBbvEZF+TycpYT
zmaAWjuJ;hF29XO5K>4U2eup}QG7Fs{9EtrfCd;7b8L>fRfIik5@cH5f_=bo!`u%8S
zU4w-|q5ginDF6Oh`?V3`#@E2BU4a8tf1vN(z!_G{ev<KUh4%(42~BsUwWl{9*1tUd
z+{J7DyGA%3eC>OMGCXW``5x;)_k~Kcm&A>ES@Cpc%sQoGPm~>PHLjdmUnPIw{rXdt
zt~tr2mp0ce-D(x$ybW$>XVj`peqDZ(I%J_#wYiqf3x}~gR!^I|`(s!4J-cDjm5$9n
z78qU}JKZ<&2R-N71t;m*H<dDvaN?5Mu8z+4VqUF0<!#Z#W+^CzZg)QUywPBf-^T81
zlVecLjg>W$Ir92TLl*CCxbXNWRb5w3ng-E^Z{KQgIAFW;%rnJX>%%DQT074(-v<V}
zPiWNOK9-ewrDL8h_r|z##;u3V?Qi!HH*|yHR56e9^{M_}>i)xc|DPi95Rz?{%w}xE
z46pzKfB+x>2mk_rz<&pU6-JES?p5DI8Y<6$WU+tPuo5<uCBIS{>fiMu;`(O!(>DIL
zVk{Gh7_7o`V`EldycNMlq3}5D|Nr+Jb8O%k!bTYBy(jJSv9&*P4hGmK#@;O5+b16I
z5GwZI<F`HHF2&i1?i}-d-LF!}dff3J?x)61R5vQgA9*2or2odeL|^`rWy!V@f9nXN
z^q6D}Hr6mdo0Qvcgpt&*Ycue%mVTXI<If-87|;0M_8IzqgZZo7<D<W-KChICU0$qF
zpL+xeI(<Iu`<uT6tTE$ft0L+A&8we}^_>;fDmN;&Y<4RB_9H)iu5P`qcWAWXhHG{$
zj7{w~nyFW`Y#&y)Yx#$*Sgl@iD4`)N;$sNH{Ykn0YNq6{A}z*_7iBYsAN(j0x@-5V
zvWZSkuMTwY^|7>8BwO9PIP(#;5E>#e>U7~Owct8I-erZ^9b4q1eP-5e`F26&q`W0d
zp1GQFZ^PZ|DOsZ+yV<VX*>lY^OWg`dTiWCz!>bo$Mvv;eK9Sn(v^}jhDkh+M3x8%t
zV_R&sld9>Qx9Yq?m3^&B8w|7kvQ<auh6KFwOyPaMhoWT>BRpzjsx?}w>rad@s+J}_
zk9^ly-Y}cvViwXt3e=7x8%__H9CoLDRaUCaZk_iT)#F!GT&TVsD>Y81j_j<sR|8Ta
zS+;8WIi3%DxAo?O%q6=X?29XsDRfAv<0i{A8*hBJPM(`{<_Ueuo>S?Ti<>2Mauj%G
zkRMmmCP^56Fzr@;Oq1(%1$iw}dRc7xc5PHBS>K+(8*Y_f>-avFR<@p`9$ai|^)`6M
z`V|!pt``NN#y&sq&GbuBo7^tD%<RZ`+0{iql8)|au?yILrTA+2O*_Adu1Y3Dc6!!*
zyJmAvgj4<IHuCF>3IY3~4r#otTSW4u7oQ&eJostuGw;crs(R;K{mNvHmyye*t1K;X
zhcxh3k9mo~XxLwRfDQ|X(fWGRzR!jK54<V%R{p{CreA!9{96a>s68*}&WiGgEZau+
eh2?2K8np(E2++#k6Wq>9JH3Cot(UQ))qeokoP;$1

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/key4.db b/src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..e740fd73e936386e125ee24cca039e79dcc932be
GIT binary patch
literal 45056
zcmeI5c|4R||Ho&{7~3pDwy}(%vewL)VF)D@We-up43q4#tEiD|l|+=R71~rP%biN3
zw4jYrDJ}M05-RkY8Qkvf?q_CRuix{>?|FXLFxPyq^Eu~xea`#LoVk`4*G3z2uMiq$
zTR@N>B?O}h5(a_6pw$=*2n2#No<fZ0`~$`apz|w?SMXore-*+(%U6ydP?I2jK|PSr
z5UN(_oDfAwUa(bAPw@P|Y6O%61ONg60e}EN03ZMm00{iwB;d=(Cm|~frmKZesJ=8m
zS_s9M5<;1O<u|f5F|;$m*cq-dH^I!8VwAl+FxIwa7KXM?m<=XQ7<)@I8+#Lsl_kc=
z%5tr_nUNjF*2LP}(8xp`!`L(R!_U4DR95iAB#dOiATNIpT14;;Uxw&P2@MHgt-H?W
zcg4>~0&8F}2?+)87FGp!ABvZUe{isMkXINbgvK{#&dk!-#1X?1nHCl*V3a9%96@C@
zFDu6;Rt{eZmFBxp1@=o0miSu^O_jA!m;_n@>^f^Zl<G}$4_U~;`%8}CS^2jtcpP5E
z2m+Ikn(vKQaBwIsXdw;smo&5LZ&}EAm3Uh)pM-(}I5~hdWD5xvBA&Tav%|Jf&dtCX
zuCcPUQ^!znj3;B<C<Mk+lNqxLm?d~-5t+G4X0DQ1tIR57B6C4vF0_~nZRUc^T<9<t
z6y}1;Sm>});bxbtj5uZvJZ^S7%q(~uGYuZc%!9`<6X9{pOn4kK6&}aTg~u_I;c@QF
z<($1)f2_=e*_f4?z{*TuWhSsP6IhuEtjq*fW&$g-CabL`tF0!httP9jCabL$OVwhj
zS}awIrE1Nptjt=h%-XD)EJ}D5CIYL!1RS$1fz@9E%d;k{T$5F<$towZN{Fly;#>)H
zD?}V~D?}C<B8v=>m7mDUPh^b)iPe_GYD;3ZC9$Y7a^i3VJagl7A=5pXS&Cy-cBhdv
ziJBy4g}IPfVJ>8DeJ*5Lm<yS`oeP;=o(q{o=Rzjd*^tF&E?j8FA~jdK&`j$u&6q<n
zTS0rlgZ8`!tp&e~aNaK?oUh9W|5A5;!;I2-zl?Bx!;El#!;El#!;FymR%3c#gv|Hb
zT*!RW&4nHdA#EYt_Gid?)6CYTF4&<m?RbzVI1efgr=rONlUS$luO`NYPp~U~A%-x%
zQTUnPDhS3C4BHA~`~nYv06+jB01yBO{CfzbVZd}As2CDy`S*Nc)<h(T@q<KyKu8gh
zSU5-|PC8a{{%5{ALuXd|Up!*rN{9p(Mgj;J931SsBA6BwMhnvL3-t~03iPFEP<%r)
z{29kA!OPu)LYUjZVeoP|85qPKDg<9_9S|Ji8ARJ?V~z=-1&3gQLm5XMS09`7`#1DQ
z2;azs3A((qIy`x)9L#)x3PGD0zb&RIg<oAi1)fhfcGd`<CO4~wiK6hY?t9-kf1+mN
z{l@1WSC2NFMh4`be)or7TfMh*jO>Ry`0{hLDh2s1z3P#Ob%Gi)H$H104Z52$nRTos
z$Zq>4hu~V?rgM?TLV{l!>BSW@U4LlmBleWu3Ig2%XWbTFtGJr3xqDDX7~*2L|04ZZ
z!~4P0&oeXI^PyB5sikK7tgO1SBef~y3B~g%aknOGvigE<DqoMa=y;WEAG4vbDqmk!
zIwRmPB{=Eej6sz5*O73i<u?a>4qBO9-V{{b_;8|q^O$IKmd#I}d&=*5qo-SJi|y_g
zUA9v{qH-AzHojdDx;77Q?cS&Av}jo?7zD<}fcN42U;?Ufrg0MpFfRh<hBI7Ph2w}&
zOk$}8sA)jlU>^ZmuPX=ERa-yNzHJ809~yJ#p+$5-AP*SK1IFM4Vf?dMcm!~0n1EZH
zDVPR<f>ohNR~jTk_A2E_?crO?9iyQ!VBwVbvZdw<VNs8i9!09YD^PuIGL%HN-nP^9
zbM^-k-$-2iA(z`<m()+WZi`y7$ou<*k2<tSYCv<x%*qs_lLO)H37(~92Oby7I)D?M
zf^W$}SA8uz(ttj=*KT4%+r1>4OD(UT3Ix1xf0VbS^F({(mPwUkIW3<GLut4{=>XM;
zBM(8(dl%W4z47<UYvZX}YS5&nul5+DR_W~BiMgJbDBDqvw$6KEd#xonbEXijqDh9m
zx_G;&t{i_Uq3G!`#2x<w@t0!mM2DznO%x*Yn(^1}n?@>Zhi}%e6s?dM#n+c)mM+`(
z`M8c=(5XiU!*+L$2|n3eeW;4hEV&%DJJ#P?B17`W#N*Z5r`#{pAbQ2kt}upyhtn{;
zS@eG6(*knmP73*Rl4ISah-O3apv4v=G8;;-iuj;PI1a-R+A8qZ{HuXgPd8igtcB83
z9y>xSyVc!SOv|YEiNr|mP&BdfdR9N0eRuDrJ-t=q%5M>_Xs;o!(3g<-k)s~X&|;z2
zX$|XK;P&<#`a_@TD4tTU6CQe%B`fHy>^0CyA6&HRo6*J{hn2<GG(Y>!BPhIU2MGGA
z<-V)q1#Q^TUe%++n_9J&`PGN1P5bK=CP|;nY1-c*I(jN4dudq<Ro;D+8wwI}$)j7g
z^=Tg){nD(m%Ole(Xn$L15&E&IRsZpHjg!|nQb=mM*q<%1k@s1(y}+Ju28HUUR#EN2
zk(RY7R{f3qKK=I>f7doL<-2Kf2kQLVEZ}0$CCclMxo-}BEG+jNJ61BI-UW*i>NI{>
zUHN+3p)~$8Xivu#yGh#{yw$TdwY^JmradF+N93s1$e-MDOt`}{4Si_YE4{uDPbI6H
z_1VqClDYc^wRF@!sE#`o%U-N`jDMM%RYlvi7d`o234hWd{WCWd`W$hlDx~$_%i;WM
ztj4~rbI(!tOM8C!)zp#?CPP=jyE#&5-xKpG>vNS;#(D3v*~1J90%fV8(FI*Chl~Qx
z|9myBtsB>voVPIxW9A!(Y=2YT&^Q?AuxjhBAE{nb>h0+z-zksFOPl@Hoi5`QMwk~a
zSK5$R8kF1d!2EV!W&FA7(BAr&#jPnd7CcuUU#yY!eLyqxRGyL}hLs&nNZ9*xQ|^ts
z9`RvuF(Gwd+A=P@vuW^qZ@yLH>c<%y>5=q3)f;0^aYMnqL}4nWoKm$aRi*2y^U~E(
zIguGB-+Xa1TM~^PnY{j%BL%6a?$w%^Xkwel=Bszy85A0yooui1E-_XDFRf8i`cf4;
zE-n{At4$cl@pITHLAIA(IUS|nX6)Ve%*bz|eU-3T!`a==F_T^;AG%+g$f&A^^YHMR
zZkE10uzkd1S%Ka3kEl-tJ-dfe__l|;x_v4SU!Bv}kov8wb-c|iY>3*>CNyv~Tu9YC
zA%2bJmwJ3*6zOMbVY-yFtohDXWS;j^5;qhcx`;o!On|Slc!hqw&pOkOZ->k39ZD-=
zW-P^ml}$eSbEMF7N}H;m6{U}mjTy+f$)NC|eZpQjPOxBAo^YGt?c!5)JH4RArPSN4
zq8iCn<5B5Lq&ob)9bR{rN!a!qsoq@a-<*8HIbq24V(rO`ibksZ_D#;$l7rzW`mp)g
zW}T)zJNetnS{xMhdmg#B<ZLBN$Q~wrdqMvEg_iAMq=P7^j=fQNP3?UV0XIEV+^j;V
z^-Xs#T>Wk>zAb?Ef{<pB%)EXL{{Q}EEy#qxxIWML1s(tafB--MAOH{m2mk~C0ssMk
z06+jB01yBO{Ff2ngFpqCS4L)!|EEBxssFML0^I=!00aO600DpiKmZ^B5C8}O1ONg6
z0e}ENfJFcT0SU|=|GxpD-T+Vl0ssMk06+jB01yBO00aO600DpiKmZ^B5ctm{umoZ)
z!1<3EXOI6|L8#XMydDCM0RjL4fB--MAOH{m2mk~C0ssMk06+jB01yBvK`aG0{>!7;
z<NqEIss|tj5C8}O1ONg60e}EN03ZMm00;mC00IC3fWUt`0SO3E;Gh0+F)yQIVAKz0
z_k?C&{?mI3_y-681ONg60e}EN03ZMm00;mC00IC3fB-<?R|0~P%<KQlgs33Y7)lp~
zMwO!?P%lu&P)<k+at-nwG7mY0tU~TZBp|$yP(&S45z&b_1HTMUL8!q85$h3f_+ufu
z5LKv3C?Bo`mlXOg^cEfjxBGP~z#2dRAOH{m2mk~C0ssMk06^gX4*@xdAvoB})7708
z6yi!C;ylP?(l*!Go2L^9Dr{w(vMgj3tF;d;a=tO`&&EsGsW>Hes+J-<m4s!d5*65~
znizH}S)QG$E%$dE?gTBe4uc)*9_l)>Y-O?xJDEyCvy(|wX?8M|D8)`DQ6$;PS~!Wn
z%M==!s`+Qf#M#Q^#q4A%NsOILqKdMUsYDTWGKsQ?oveiu{=2N>PNL!e>==rzOh&Sk
zsU!qDnM8%Nlc_`@b~1?~$WGS63H)6q>v*^?ycPM`%49xvGL-~lCzGhW>|`nt%1$Ox
zAnar<9FGu0Rv?fP92_1H<bhyJ#FC)>Ae1BW8WM@{g5QP93+)tqA&3(=z~9Ah$d?V9
zfZ6h1<mHFDL#iNBJR#sGU{ywgf9HdamE<*y5dr;mn*8O1Pr=dm;+z+5AdJLW{dPa$
z=XWF`b{%^5ps8lXxAB6-uEbQ!(q{XzeCLS)Q1ghG+dtf}@-O!mhGOzzy_>bw+K`)6
zDU^uLrhV!9>V+9A3~i2}M%S!f+Gat=O0YGlh2z3x-q{wBP4@(4-j*8|^DQ}y3~%ZR
zv2ZLLT)xzz=b+IyS579K(a65%cvYR{h!bZfgO*dQ@2eGMo~~bA*X@QbDtG{+W5s_n
z`Rh!>g-I3ZwM$-!Q^ZUIcdK?5RyoS_k0-^Xc^=@a%Q)#gG~~z0<jegP5^HWYAbc@u
zJYZ6O$G#2~{cqz<zVF;BMYJ4M6Y1E+>`junFxhpBY_VUl3TF8v_<@Xsr%m>WsMvMy
zN#pe&H?AysA-RK-$)yiOlHF}-k`DdD>%_ZT-C8Sl4Mp@Sew9<F3@Mz;x<ki`u{B90
zabeOZA6<F%T2}7NlMHFYDXH#Mhs#ddcc)|cu1E8lLR#){GHE#eu-guwZ+!%Ql!_U;
zma$xE+$_EGV(Rc=(Y-<!G|K2$QMM*YR4z=WZOyT&T&4DLF!IqCL!#{-Lu(-crNg)E
z6-BQ!yyhK};bgMp^|)!$y1P?SSxA@K_W1Tw_XPjAu&4xQHE`>Vp;`VI9V^1tB$dd8
zNe`zIqWeST-fv1T*Voopy9xT<-K6~{<FeAke#-k3rHosJ|8}?VUq0QRVjw?noNI_4
zK1((k$1D9b9m{eiIGHIJEU5`djsB=j$1Y-PlElpvWEX2!^&wSj@=aC?`~WojO7VSz
zXunSo*n!fnFOSSSpKvm%QOmc!w)p0kBK+!@4<X&_MDa=45V!Mf6_RxFxi`z7(6Pd7
zO>#8_*};DXr3+j74|JT^yejVA<jG65DF>h5%)huzC#e2*#{egj7OgSV1KXF;{h?&Y
zS{L+7iPn%Kw;sK2mGwCqCZB@Lq+?OPnf!I1fQ#XlYfpC~DIGl5`nIX4BcmI(^BMK)
z)7lkjk9I2>$ei6k;bd~ZL!L|h^?P+kBcA8pTVL6ry}a4sLm$!kj$_V?wNhGd=~yIt
zliW-}&u(`@dnTfYiZy4wMYo09>5ZXZ?TVpH4P6OOJoeJfl#|Kcc8dhPp+`y~hmC#4
z)zR(5@14hmobaYdn7G-p8y_KbEP|~`uBM<x{UU3<4MkmteZ92AcN09%6Ea_jJ?*k^
zZ?wJiR$N(%lS!=X$^pw%^ns%-Rbp;W5GN=N>Ny_j*Q{IfB26Xyy^82qI9rokO+j_&
zu=5}KAH;+eTFP}r_YLhiz5jj=grwX0V7u|vuLiuFO!lr&J7lt}^7~BZm~H&@={k|?
z9yHOe;U_d<XNm}AFo2E~Vr!DCDd@p|0{>lumsg<&BIK#sHAYLWJl}cHN9nYXpqoml
zhnyWJlRECJDvT-v%YCSOB?Gfc-R~b*ueI*>h9N@DBQJWonh6~%$krrRQxG_3cbOv0
z1y^_ZV_<tTNX|d-gcP4B{ZXI2{M~C>*Bd#Rgg#x|L`9$O?mv=O$S>FD)Vg@)TF&Dh
zbh7KJfm?cmujyC;wkElng3dnlR@-Q>@6{ctuSL)FTaF`&-)H!bE7~VqEght!hC(=*
zy!$HPZItRKck@Fo+ec$Mq#N%d;GUE4)Rf!dgxpY1Svr>gH<Q2ay>l@I?b~Oa0~&lL
zRv#iIoY@Bzu(&J?U-x}Pd1KX?id#mxTR53~qn{etBjKSdy4VNnoTk{d4g1+3o-&bp
zvCHt=9|Af8bSxixliW-}dNo&MV}-Ybd3ax#<k|O5LDA#{@w$ZN;N76-EBv?LvF2oQ
zdO|j^i`VAiW25hoCpSjIw~>vr^Aawcv)xcOxF`r*O~=C6n&fH<veh1wksY{jX}a=b
zuc6+~PqY-B&+nK0sDl~H8b-g@*v-jgVCLHpjiv(SQ{Dxi2c*~CG&j77K<(4m?1X-0
zef(K1g^uNAYm%!eXsA<6nA$C_@c`jEe1BwH{&*YgqFh3(B2SWQTTIC+jyt^-Kh)QV
zK_8qbJTi96D&qXg2Nh3G+P#Tv{@FUDS(4~rOUFXln&fH<8hCr1w06p38X96DP%FJ=
zze3QJ=+>c{$nqv#qi@uGo}5TN$uM0x;_s-m_vzQjnX<fzz3MBMppC_^2t1*s#@>WQ
z(6JD<Cb^n|4h;ut*bUKIPInXXytBX>(@$Det(Uj1Fzb-MU4x$N<zzCtF~-1cO_JQl
z;K$mZp{_&bp^u)I$i#1v&Pq&<jT+rV$MUc>$<-88Odq)h(_7xc13Rd>KEm!t=I9M_
z^a)MfJu$l5yMMNG+@Bm?-`+kt*yaZ+l-{MLxm;Rr6Q<z(3gk<elD&1g%J3oj5-_hU
zF-C0uIJ?{3_=Y;tQSs0#{sUFMH&e6qKhkk@I?iw5pca91`|Y6Cz`UtaF1oZSdh#r}
z@W=h4J@S@bXiOm}Q`yu*=CwlIKd?l@1l;0G!88aItO`X|Y@f6*voIpYS66&Xd<7N0
zw`xn{l}Eb1X<{Acs=aM`naBSq*j5l~3$h%!2;mFA4_6f0BiJgaEs(}P%)f!}3?C0e
z1|9$bfB--MAOH~Ho&X)I^4mA{ub02L*blFMRPSwdCV9f+z9dnjDP-FQWapjZS>fM$
zd?cPUD@}C#!&l%hXMW<#({)fJi9>;#jceizoZ_!b=DH+`?Kz%sefzXfiVtI-N144z
zZqDm!mOoOt``ljKY(-gr+EY(u$U3)M^mOlrqCV`o=tb&_IGMz^_CP+4@DUVSLR<Wk
zVTHcDAN<1LPma~*`JOsgBuAzzEa6=>cZU2QF9mV|@~w85rM1hl!~J|BN*$s%%4|?=
z;f9i)PLkOgc@@nkIiC38l}p65l~yXdTsCTi*spI-f7!XnW!gj2`?I)u!S(P6x`Gm0
zkKAyyUzxYJu{U5$z^(j6RhqtDd*qdpd(}}}LvrbuugYmboH!1BDYsqTV>3vq+@ikx
zFtW$LIRA|H;<!i!=RkSBLH>BUf+AawT3m1xQFtlf8LoB*FEiS9;0<Y0ao0%lnj+z(
zh@JF=dqr`MoIJ)Kkb;z#eOM#uP<zzGG5fXpjF11con2m8Otx!cPjeAn0n64SHz%GO
zH^%1ex{y!NOB}M*&lTi-shcp7-1GFTR`|fWku7|?IC&g9yVUa<$@b{XL*uxYi5^xX
z@9*_iC!gIvRkD6$`jAo*T|t4ZM{Z8(9?LWs6OM7vjm9>ZHg#)ejvTonQCD(c(ABY3
zg}k}kij&7oqQ}grF0DA^q11sZ$A4_i$aV-YAZ~r)f0yW-D=c!5u7F|dQIm_YE<gP2
zREdfeWOUK6o&11;9jYe@(J8I_*(X$Ucwgr!Iwy~gi_c*MVvoJ-_qd=cze4GHQAPUb
zR7W@CV^pd%iPq_&E6B6;$jvzb7wx>6EYp0y)FC7Ir3-awd(0XUiOY~bKVOo0(V=~Y
z<CPG3{k`zOVv0t>Ci!b-wIJ&tJH?ZhCxRx_Mm;_g!lDG|3UX{cYIDKy;4V+1anI^=
znmj4WeIw}xUo=SNX*;B7e5Yzw#$Gu;#);#}B*#<Ut93j!K0m(8L9&kjT4u-n)ISty
zUsvc_$1X0;pkrl!o5X*)f~doVN%5o}ouG?WvNB^fmU>;MBy~@m|9Stz3^jKn_-D<o
zD{DBJ+>TXMAni3U3zId|_t3RovNbzdT<x%dw?kdM7<JQ*<8-VHdz0LZ_VX=O7FKW9
zK2ANap{P&EEkp>~dN<XJ?+$cz*K;)1=Xjo?ajWE>@(WAdhHI6tS?|D9^Lf?C>E+XW
z`D=Cz3Hv|Hreo1;O>%X{=lKbcT1&XkGuOua;>8Awss~6B$zmaic~VGs)ZkY%$4g3*
z2z@u3xGJyA8;@JmM6|8Ck9$HckNH)AbJEKvDlZArvC?c!a&^W>-m+ub>swv;_`&Rm
zih@v4e#Ldi>rHx>U6>J+!rioy;56I?3G%y5TW+k@CLfR)KS}5~ic%XH1=rxlQM)S~
zXm>Zzu~KYJa&^WhNYyab@w`RWNRo>Exu-hgNyPA=Dw*~Kx^70J`sK?@IGLQex#RrH
h6O$gdW{OTuUD2)D3a+&9ZVIX2@>1CD3_tDM{{Wb;!ao22

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/pkcs11.txt
new file mode 100644
index 0000000000..1d08f78285
--- /dev/null
+++ b/src/test/ssl/ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/server-multiple-alt-names.crt__server-multiple-alt-names.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/server-multiple-alt-names.pfx b/src/test/ssl/ssl/nss/server-multiple-alt-names.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..8ed37c04dafbbb1e34561794ae0f876e0688c115
GIT binary patch
literal 3325
zcmV<Z3<C2of(-cr0Ru3C48H~mDuzgg_YDCD0ic2mumpk(tT2KMs4#*DUj_*(hDe6@
z4FLxRpn?ZbFoFk60s#Opf(Jzg2`Yw2hW8Bt2LUh~1_~;MNQU<f0So~KFb)I=uJSWw
zh5uHz0s;sCfPx1YTLQ3S>|!+`gOdox$-FiJ>&_3SIb|ex@_neI6u(9Uky~D(`5|`+
z1MA?X@~~jo6*sn)H<F}_q^2^IsjZB4t6kJyP_`1sU<0)NxlH;*0YcH(MTs#u_`DYu
z^AkONxjVtoYY%i8?ZRKfS>r!7b$Y__-jUSiGE}tb8I{sHhH<5x7a&+N7%<+e;}=+E
zgMD}LV9ndu4SyDqjepbs)wBB&%8tw|F|LcVKO(hv7{$grjoyXL#io}-oB(y9DPv@y
zh#iKn-B=;qx87qVJVUa6TnGW=P3M+9P;bg>hLO!b!yn|3DWAi%GwgxW!3%SaQ}`!a
zwI)gTy8@^GNi@EQNV)EGp{H?t_Lv16e5?LsPYqjxyTpc4B-x`XP7+BoOz_Mym~aYV
z+eFV`l^Q98iU9%N$`Tk^opw|Hr+)6CV>!#c^@hLCX_a+bF)N}QlT{{%zz52A0Y3nT
z*aEQzH~@(L+?qtha5M=AV+v?<LU3agx*`(@$12cr=KU9uTokCEUi&OwHbpe1MU0*V
zijBA=S!hNZsWaC2#oJIC(Os|w^9ccW2M7<xE&(LUCrzsoY=d?3rR!#A+9S;CE=Cu5
zyBewy0<D4lBsNuB^*W=DleHG!ybRnOA4MbH)V=0?D<+y+x*XHs07N@TOu05Ljbetg
zG!7#nC@4d8JZSoDkf&{8SrOJ1K=Y~Z8NB{GpP%=C_c+C_)|b^Rn^l`&wpBeMc)c-g
znEg`%gv5rg4RQXIB$N`9>gB~;=o<p;mJP+Wey~ibnS><Mp+q>n#$tLE*5`!$`tE&z
zWM(2df->h`@QS~2f?VKhEIusg%ZEPtQk6VhhO<yB5GBPqX)ObU0Vy{`raFa;ZW3(p
z@NT&)<-U{JkERwZ`ad1=lCy0&Badufi7Vwd70I<g!1G%u0CXXop2Un!?ar@FK5O%z
zXQIh5NZvNPS5hppT<0J2)TpKwj2pWE!uOGuYj~WdZ62Y4I!}aI11N)J{F!MpkEiuU
z|7+Nmo&zl9Vav4v@+U4lt>rpVnnBSQ&Q6{R2mx8E0=QMj5o-57^HP#ii#P5vyRK!x
zDRmH%BtkcwnfyxG1)j##*te}!#qq9`+t$Kx>-#XJu=&4J)4PdVR^(&$?ye@-Yq@iW
z#c=foM#6Q`wZ~I@n+-QhJiqsPa#Pr%@y~L2%&KP<u?&bhzanwkS~?h~R2}4xSOvZ<
z@aIE?t_0_9!S#IXJ>d^8n;>ldXdEl9^2}w^GzW}U`*7JhpLF-#y+D^jJXfb>o)?}Y
zp@!*>0pDkqp1f=bPD~&#j_I_gOgTT|gnc1_4cNE!9RB=7qN^39^D6G+PGQGSxt=8Z
zsMaQ&IC_rPIXpZu1(~hVBV+F3Gir+adQVVq2(<~Yztx^F4pi<Wmy&!*rgY|`(#5V)
zv-G=uN4YLqe7+At-5NPj$Q2k~a7m<@xh+F`Xtco#x~n8v-dFggneu5DF2731u$I)y
zPZb0KxY=Onj?$U#(v9JutGN-g3a0+g;@`E%SgFewJDeFq-(%?EA_Nf9QxTF*>rv*G
z86EN`GP1?^lrnaz%V#zQR%`aMxB`%{PeLTjuc-$Mdu~H~@11yv5$%SLhscua`(mV@
zAou%OT`Ckq&Hd-u=)c`wF#}8N4&BtvpML;%tuhqOF4;U(R6LOo;A@+VbMVY=Lj=jN
z9{8(ri>;a>n>WhUoD6GF&dBs;rOv`MGkM={p}{>2RUqeiD>M`Nv*y>@Y&v>&X@kMj
z64-i4e3!R?j*!x-fZM%O#qyW|+fYFZ>53x9tZ-+h<a53yFw@bGv{ZQlao@d})xBb*
zy2>yL&+7k+tjyb`g`|3rF~0Gh?M*HVY|s?@dJ;O<Jq<8o2!<YVvehp>AZ_zD$;v%Z
z18Xm;hGdz6IryuOAy*>l-sIli8xRbd{!Eyj71=odHQ>37=gDxNIrVqj$igzBjSe#4
zqTQyL-c@R*Zwwi`<#nQIa9Yyj_*dFrP#&-yeq8OJq&vZC-WI5&PHU+pP^tWW2SYC|
zNoY9{y0b)`{d?3&%U+E<xtsrx*=A(!=P;!cZ;Ya2%kN%kBGD@$&1}meTwM9nTW_ea
zQ*Dpi!=gX`pt<CH6;?rgOw515PHY0XuqnqO>$*zil5bvo7R6H6zdYyOF~gbf8>1{C
zSdoreP@AeKY>6U94?1aI;mC_=9<|f_FxK<Gg_;v8(Akq6sAUC?Rm5c@py{LxJN+8W
z`BT3+_D!{b*WIJ%>}rms;L&gDuL4a0){YS5R)6JMH<|mL;YWYET@)L%NiG+(a{Uhz
z_GSIJBa_(^6d|7px<!ik)q>oeFq1c^T|`eAu=9{2eu)`?_{(VsSVlFfe3uoR)fR|E
z8#Wgw(nv+HFoFd^1_>&LNQU<f0S5t~f(0@Jf(0%xf(0rtf(0f93o3?4hW8Bt3<?1P
zpn?SMFoFc?FdPO7Duzgg_YDCI0Ru1&1PFF^?2g0s?bZSU2ml0v1ju=VDc?4^pH%5S
z?bFy6>k=@s=4{7hH6(aywpvds)Ak-R%DwfYc?os$_TPHM?b4!Fk#{xYX<|=@98xFv
zSV4{^(6f$G$Dtr|+oDJb&x$7ghBQ-yC}RVsNct)rvfT2E;<lLL&!m|^P2}2}oefC}
zTidV>nT#IiJH2itvQM`FzTjiFP4~^N(=dh>&rijr2C0=AM0QC&ZkDlHT5_}2<YBpM
zfEi$KW=Q<r)e>=xw<*Mmeqt}*-ulHwFHM<1b=JUyYkuO|(xxdlaGLpOYa6H~<$peQ
z54A|2xa*}8bd&q+kDed@&-AlMDzYmq*FRW>`R~t#NsFp02m;gFdy)WpcO_*Bf3)tx
z+`}4Bod&_l46?O+YNkfglGDFzD5rRNk~=zEH?Rd*AE_g-b}p-nD8s1f)w|)(wkw8h
zI_p;4Fu9Y7O1<A(GqG4!ZKm-~7`2KzZs#{~WsV4^W(+D|J0uo6N$WKauxr(lMCvyQ
zF5ld9@tdSCE&l?)d}&}JF8^)K(UC{ViYBZ6@o}79cQDNx40L5qI|K|W*#T$;m5(%C
zjito-ItKoidQEz<e#Q}E6d~)1QI*&c*+;@LGOF-Qu!uIJDvntliXiIpM&%O-OxL;Z
z;;ZJIE+c42mT#kebTnh4KIvvrX&Ze{2l<;TsP*}&BScO{;fHX8n3PJ$*9~*5wDB@g
zZ_;L(B%h#h(C~Cc$RxLo_R*he8pe2GIz1}6D1)_W|38PMv{k*Xz3xDWC0%1@Qwf(|
zY0<ZfYBcNfOvEKjD6+u;L<j!%^&0gNzg#1vtXH@D_D*>imV#lLlF0jM(p*uRuKw?m
z&bXMfa#8Yu9l&#6Es|tiOWTQa=kW?`U2ro*Tq>Kta?^QT9Aj-GswmJG@mlis;v@m{
zJA2vtuCOGnI6j;HIj0`8KpD*5+mcFT$IFl3(QsSGWe`o(y_}hO1PKcHf=X~;H{#Xb
zX2gS$>;wQNp;Xzndl}je&*3Pg^7(Ti#2n+lGJhL59BvZ3Ufk`eYmXwrZ4Yt>9iL4!
zBc$Rmsz=$Z_t5$FWsLXHE#bPtpd<{G!+zua-3>_i`;(QhReA0~F(ZH4>ETeoXId&w
zBRAP?N%;wmP0>zzseoj&Fr3HrjI<BBpoTJT<glO<nbhBSBz(cMpTFQ5s46srR(@pG
zW~)`_#K?UQ-lNU1b!T!L#nd83aw`*dQb4A|o-Wug*WSFLJN;n{j-w-rc#H*fPuO|I
ztsMi@dW`Zo=qDp9&%T4j)eJSjt3NK-8p>PHwQvnbWoc4rq+H24`A;{EpxwSxl?vE?
zCm=f31nIwkQZ4e#FU$KuJp04f9j7U+KbtkvZZIf(4VZxyzJrH8RzX!CxI?PUA<xWN
z`*B73CcbmmGE<?6YWtkj`n#J8@LF;L80ddRD^YWfR1r}#!?{0(7N~A=4C5E`RI311
z1AXOuhv#`U`!)h1XI8IC+o9zd$QF?ae<qu}_6!8{hJBx@lS+Gwz#G+U!WFXC41_JT
z>n!15&4IfJ9rj~(^ac41L&4gs4q@Z_zS^DUOWy@2^3mDL1kp*yS~SI^x_kqE5|@ZE
zVuubUoGyyX3<}fCQ?#7yL2EH3Fe3&DDuzgg_YDCF6)_eB6uID$bzi8VP~V`{n|+@x
zBE9I$+b}UOAutIB1uG5%0vZJX1QdF+LOhkHzX@w00qoUPrM}Z&7U~2Dqb`jBJ)YBT
H0s;sC!G=jY

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/cert9.db b/src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..bb19429e5560cb66b93edd9fbe4f4e5d93e1153d
GIT binary patch
literal 36864
zcmeI530zI-|Hsd{Tiv$PHd>gvTC_-=yS2zxX;ZW#B)7WKPPY<9az|QFLP7|MC^V9Y
z#-s@`GDQ)hu_h^diSj?^+?&dn@tc3mYyR{5KZkSf_dLtzd7k%q&i8en=RD`;;pQ9^
z#b?Zqhz#RJG1!ni1jEoI1_Od18EmIxd+$cY3`*|__6hg1|Hzbqj4hwbBApOTsu_}g
zg;YuxN(W0DVkck&1ONd*01yBK00BS%5C8=JMgo&)G!+$1*gGgZfFJ80!V3xr7YJOV
z{X&EMC2ZVntvqcRj?*UF&SVgA43}w)Pw@<W9us95OrR19UW7s@&yOGaDFtnS0ulGQ
z0^49Rg{CrG6ZRqU3!?pk`TkL#6sQ9f#Ic`iFj1y~6`7`@*4vICfgqY6`ALK_KtvSz
zxrRB@AkhVuP|?(cQ^TToexdwN**_U1v5u#ewX<!14nYA7S9iy$R_@*mCtGiZ*EB~r
zFI&6>8<%Nz&W<*o3@d9FcTXb*55;ySwzIIEjoU;39>T<f%<)rm{M4K{#gmwG@B<e=
znBoUB{9ukBEbs#lKlot>3qlGN9SKDg*I=Tea&Q$UipwxjT!)F`LQE7_VxqVd6UDWd
zC@#iC{qdu?dZPLf$}EvhD6<G<7NN`{lv#u_i%@0}$}B>eP2^=0dD%o>Hj$T2<TWK?
zO^H}jBG#0MH5J7Y%BF;}8Ih8p#3V4Wi1xBjJTHrAFN>%%n+RtU;cOzDLxgaM5RNzm
zFNK5RrEmx`9D)po(B}~P9O61~iM(7QFPF&6C8%PWD9U2ug^NwR_U3pfN+kB@bJ-j=
z7f&EI@dRQMFI{ZnRS=taYsDtsWU+}86`MF#kxB3on|;{`QsU6QY^MFP;g>{|z^tzh
zX1#SV?W-?l_SP3Od(&cOzqGvtW1+qE#mwG<F|)T|%<L@~Gx4s5*8wx}{w6l@PA4`4
z`b>VGIscPMbQ)1wzrO1D;nfM?^3VW36g6OyXezdvFeGv<i$bvxy)Q31DuOuo{d8aZ
zGC!GQ%+*Tb?iL@^!^nHwq>Daq6KsG0AOHve0)PM@00;mAfB+x>2mk_r03h(+LqL)y
zg*Aqb6hcTR(vCbr8j)+rCFCq}5(@$wAOHve0)PM@00;mAfB+x>2mk_r03ZMe{6hpJ
z$rM;ex6zYM7&=bZCB;U)1Yv0F?VyQ`?Nq|hqVA)Jja)KeFdn;;B*+xH4&$*KG5(i5
z0m+^~bmbc5GUTSpQDw`J5+v*&Y9J^U5C8-K0YCr{00aO5KmZT`1ONd*U;qIM8G`Bd
zl$G)@I*B;}9Y-U3QOGh}Pre|E5g8E?#jvr$U+QMKMhKz;Bl#X~&I}I^XGSC+I}r$i
zBElI_cv3+$wpLtnh;$@|NQX8=I@BT3p$w4@*^#nR8Ah#{lh6sG>t#k<umA8;@grmS
zkqm!+WR!s9fGN?3LWvmv%iV*JI%G9sA=iT3L?+0!BWtiAumJ*q03ZMe00MvjAOHve
z0)PM@00;mA{~`hsWJNd^nnlNFOe6<20{0IM;)h3xM&J^-+>lLF;9`_P)lJZEc7Tk_
zk#xzfbd<r=Ku6$n4bn2-^qUImoBI*1|4)XHtw<5J^8X?B20#UpkEA2X|DsC_stO1I
z0)PM@00;mAfB+x>2mk_r03ZMe{96e0PE&|KB^Ah{V9|twuRqV&KQc-}9799MS}?xE
zLmW;Ohg0wzqG<qe3|SmQQYVk43k0DiqS!Iv5o5x6VSE9uDjNSUgpm74C9)q$MhcKr
z<Ra3HEc~~C1N8(100BS%5C8-K0YCr{00aO5KmZT`1pe<4P$hHV({V=S=?(jQk`<D=
zN|lf2zBPCnDq5a^$9hIE?^iAPWm?d=XXg%3Np82@e~b~WHo#+P1<o!uR)*iS+L9_-
zB=fo#t@RgBiRA-$?5U025ifuB@a4`?QC@g~k+Z*fIV4&QphD)*zf`U)hKL54Kr&RR
z9$GQA5Vpro{&*99Lt9EwmXlM&ldP0C|KpTjjFJ0d=${2DV;deX$1#F*upc+5_OS7Q
zA#6Rz;9q+oDa%W$=yhgQ?5&$RMSq)X=(zKB(>!3T1o!?s<fK18=+5^g5j*S}-4~an
zpJ6=>QVZ0}+ZWu%Oh0!h-fjk0#U^P!^*fx47PQtCQXU9qr99`)S}2P9>ty<CVq~^s
z=h&Za>^Cul3dtI%kVM->Cc&gHHx`wp(G6EStnQG7VQDHfc&4a^iY)dQOPDM(CL8-(
zBb-?(vK&*C!{mrhhoA%@tku8TFcl&TVFW^juoOv%5jg%`{mT@})<wc`#-_s3)>KKQ
z+jkv~zmAP*3ZyNPozu8wMh>igJ|oDi^Xw^Z{`<+tk~<pJvzEV#$R;^2w&W%7X*(=C
zKS=wIJ8&RqB(F>7+9TC8{j&wGtw+u1+Ocl*jgzmmsuo5ZicU!GqPR?Yn4M^+X&GF(
za-k%8BB5o@=F8o4&99`cOR4N`Eh;ZkALU33dCm$b=qTTkmhW)&q_A#FoXqGVcx<KS
zlo0snisnQeYa8~2Jw7JZvqzWC{7`yv!49R0#D=D(=SwW~724~yw$cJ&9k!n8rqe%>
z3--J-*;8nu$iG~=#oq4SmJ{FUk0`ee*nL~_?J_^hz`4Ig=a9%S1n0=3a;OZp@aJ14
z3Kb>8@W=kluuF|GgCQr>lC-(aaE0!A<JT<|r@O~X?&>rIUc4We7<hVgaPyO}jQFbO
z$&Gtzvy7H2x=vyq?ob~l7}HAa&Q*C^IB!Z=8e5>A7I*2DSM$8{E7j|U=@fdMNW61D
zZF=$K{JqZktIVyma!)VJnR2PJvpstM+cjgiuga2EuWw$s+P9|gLyYOqZ`o@$YP2pW
z8<%H7kt*pfy`{12UX@g(YUmBs3&Jr<#z&_wN%#<7)Db-<dxoTK*VZH6&No&cH~KhN
z)?&{|&H3+NvC|(!oKA1vezQhr$sD2d%n|WN{0v8SbpB+dGO9d#_f-3|=>;cNHLcXU
z^Nt>SSKlKR-3vuGEtYSaON}Qt;<wP?d*mP7T7!Nq?@O*87Lq9a9WddC`+I_~*ni#4
z3~<2MZ^;a$1BT(>d)vwd!bP|CZ@BSHuEFG~=7z-&ch7CL`$;D~zVh(GCZ`o^wO3P)
zC)tq+Z#xQFYm9r_{uEX!|NY)pi<*mZ#%`bi)9skQmBqZ!8<D?-;m_{4!FRN;I@ck1
zvk+^*pS#z4Q)1M@1IPck{*d9bPy=87(?eDC^M}Kg(B})dEw)h!i>NDJH>n!4H;j@U
zai?c^>P)04xOS3t{$l%*P=sE+{pBWo?Ze;3ZL7<BXHuP5JX779`!vAK!nC$~+}i8u
zA;pch$K0Mu6c^Rm^=y0ce3|JsUW>xZHtmLpspH949y)J*;qbiVZTrQZik8%3?*$~=
z_fTt|ku{$?2DXZr>0Q%pmN_QK_Lt!YoM!mPr(W4yUv<Es%VF<N@%0|(HaUj3J4EhG
z{<wo;Lg{($_}YL!gR``P`_e*f-;Yl6xulBLrDJl84$iaROO^gk@9w$f`L*}q*}_h*
z-MbpY6B6?d>rs6Ff_wFzV_>?e+riAnA>?+qr_KK97Y?gWUlCH2)b90yUvo%dN8y6A
zdyY%D{_17BW$J}y{iw;)%}O6hX+N1$BXL0gV?(@6PQ%0tH78Ylr9vK+=}g=jIBy~+
z{RfBTY)MMib<@-JE#(D|6<kK}wqDvBoBq1Zy}fJmY?a;X)-2kXKD=oM=Sh+-@5STQ
z$81Nvx|MRkm+_lc+0LesGujtCxMggy?xuBhwi*9y#<{c+^O|mz&Htu4q3cN|*TnYS
z!Lr%pr0832THpHKPvCFMe=3w3o*3dHJV9$LEZw-ODo$-!rHaqpMBx!L$DoY+GIujB
z&R4fStGnZ@{H4>~^DIt6Goq>b)o!>i8ho!OVRzCHbnGvEHHL*0Qa^91+~1FU#gP)x
zgY>4@?{M{b(;;Xg38wzupK4ZhFn-`4*1M`c?ChL&Ih#zikH4&|i1a;cUH&20?`B>@
z4B0+07G8#bdmRg{nS}Y%0UTWaes_xf3>k(Kcc))|Mu~lit;hV*k68OY_o+ib?W<n(
zt81vg>NB$~dODZfWHi7JM$Niond7MN%!@zyhwOXhv5P*qWIj%sx%Ri@GT&gcIe9aW
zzH&d?b$2#dCz!3XIHsd)vR^5K>5r~>Eu+$L%riY(Dej?}J4rEVRMq@q`)Qd~iak{c
z_nZ9I>swr{KUm|kO>kyz&tX%`(dXZ+xUHR6=FkzF$g)9o-!&cgxc2yChhwc(+$xJ|
z`^brnZCP+BeJwS@*e9NLdRy@I#FKWyQ_p=L@rq>+Ugruf`rYp_JgKdr@Y+C*UbLj`
zS<%l)VU!PBh4!g2X=R%Y&ZH%!S65z@xn${mXIhqO(Cmss+R_v~*Y&#Nex$u|$<3Wk
zd(w0M=SRtk=QRnR`Pro-zJMk^&NsL4?czz@ys4J3YgCGjW8+xu*F6`09V3(Tp5Krw
zc*z;j{eDSF%)|2ZyY^_=tOa@jB{MHFGFCeJzAhNK=5iOU{&w~F+oN+v@1*F(x(cQ&
zEIK-YBlQ5P*i@}uS)=T>=3N&*=XhYaznYyIl4r5bd-0P~g<H%$SxRc;J?nI*cCGEI
z`L6n2#<UP)?~sOlmPZcoTtA%2w2eI$*~#lP9e;XD3Rl&9nZmN3YdfP^^NkRr4UaP8
zsdKNSv|NtUsax`EPOhKddP$o^yA=H!w-PJz{U)|-EIH?O$n4(pQ>ijLmml#SJ|l(G
z^}5IHI{&nfaZjYqHSV%ANiE}6oLnb^dy%1VZup(?)o%Kw;XjOz|H+cwkaUUEQS1Y3
zfB+x>2mk_r03ZMe{C5-ho<;8){`GIFvLXkP!~S8<9k6E|imPOx&xeLYT>mV8*~Wjx
z8OuZ>o@U^=v4<L8{ECLnlHqaK|Nrmf2y9{-!e&4v`!3qRxxfG98VqvGj{V|x-<W;S
zQ@q%Nnct7tyH$J;!?}|VeteTkHZmXk;eJ}&cr8|8-nYL5e;crI?`l8((&b5Z694E7
zsE$)T1{>>`1C}U%HUmofY{)nGxuDO+>fC{km$<Y3w_~aPZ+3rmG=J)`#><nkaq&mA
z>vBqwpmP_)ez@^l;2KMQwg!^H-<<MtwBMY_r}87?iha@~Z$I)MV{TYy=p7nmvf-M2
z3w=}D^=4{~p54RpHobtb?^Co2k0sm+i|7eK%zss{yP75SO@SVL=d0pb!;bbygzm|G
zQ#{_;`OV>v`+cn^tB`H(U7r1jnhz;Rj69b=M>Duqu=k3RPkW|fl<(}?%!x54C+uCi
z^o6UX`EB^)ddiNGkiCzqxzD^wSw(L7q|8?Nh2iBfSy3Z9>&H_+I&V+E6d4^@p2?rR
zwXrp>+*!kH?mI1B{)mH5RX3Pq`)6yY8HNPD@l56Yu#ci=6)ikvYo@0w-TfD4KsAaI
zUoPxwEV<>waj^_(CoRxlK{lBgI3?^(Tk?)H+gyY9Tg%6Of8v+&+i}ts2DRj=D*Lq|
zRg(2n9e<~bVO?8pJjhzQ=fS}h1+w{$3AN@)vd!F$FV-oV?>hfXa@xM1Gpv_1OBn1@
z;#ore<~p{C!tkT%4SCT`uJuZadZdivxQy-ks8Fh|ErB=8ChwBd`#4(hdXiS~5j&fA
z!L!zXf5OrAvLKY}dvkx5f1>7;Ho4`NrDNq%3eJ#D?Q5|QJXCY!YWNL%|M9M>rV6_~
zYbUPRyeq=FZgVU7?PaCFgOSIy-_^#F{3MT@(|sBIJm-b?luiw!Dp&tv*`JEZB{F5!
V*0@6&e6Pp6#87nXFD)#9{|D0SSLOf!

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/key4.db b/src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..e66a9a26ae087c879a16a4d666c9ac970fe3de48
GIT binary patch
literal 45056
zcmeI5c|276|Ho&{7|U#SS}-$IC_1y*D{CnG5{j6yMI;PKMI&idNhK0#kEkdvS+ayS
ziKvKH`;}6%rG7Jm>vp?$W*(2<_mAKG{?1{}ywB(L`Ml5T^Zd+wX3jYej)R@0Kf?#-
z8yp%$W8laTF$fe2F~H#<5D1F(K(Zb)3xXBEXEs>R&_Bih6rvy+dLPl)QHZdpJ_Pvz
zTZO!Wq#+eW+eGz6v;L_OSPl{Z34jDZ0w4j907w8N@PCs)ppcNPygZb-m_efl`ULqf
zXeKlUZRT0n*xuC8(G=%sXk=-Mn<>Sq_<Q4Q?JcYf?Ok!JO<i$L))sb7rZ^jGoUx7d
zN=pl4N1VN>t)-!{=@K04n`sbn>WQSfR2U&^EDweFZ}Rqu3=0Wli5|3YMlfgFV<x``
zaV8QmLLg*i@z8ag3SJv&{@$Cy!fZqRBWMgCp=om#)+VMdIF87+Fk1nqLL&ksRRcjz
z4rfk|KpNdAaJCBKryLydmmFl(m2iaYJUrB6%62$Cz{iU*n?vxY9AQ)PFIk8HQPmiR
zkexHr8~?DdaG%iGH1MC&OsT(Q(I%?yv4;xD;_=W!!JHwRO)wh?OsAR}w%Kxi2F}pP
z#@=xWjs~zEtZ}1}SPwEg<`l3?i0mS5_NF#_Q=7BNuA)t0uc+*mCVQpDUTL#eI_wpV
zy`r;LI-FF%)S8nKVCNtLQ~P0OAp-0)M1Y-#2(S|o0d^)Lz)nR3*tv)RI~fu1Vy~y|
zP5I+wCQZeh%p^``5+^f>lbOWHOyXoFaWa!QnaP~CWKLT$r!AS&mdt6Z$x$^qswPL(
z<fxicDkrlhC$ko(CWjJ{gNelHF9~3`C2{&o;&>)=%E_E^GN+uvDWPymDAOhEy-)!5
zUML(g6b=~*CqIRgpTZdjDyJ=#)0WC<OXW~y<pcl{k-hWjknLWZT?%k2d-+hw6f%`v
zVLD`2m=4){pAOj;rbBjbr$cs^r$aW;>5z?eD&+8)4riNjNKKc{Hq-o5Gxm^7RnVIC
zpf%$`bJi~_obk&FXX>)TKh>StF{^aOFDsncF)N(eF)N(eF)L)h)Yu+aA^Y_<9kO3^
z)1mil=rbGo{t<FsG*flyvv%lgJKj_p;7tbrRk8p=)(rno6XWbV*n>D5!&sjv!t75K
zH0uFH_(52|-~ti=34jDZ0w96^G=U@;C{q9~g~90lHM5j01p{IIU@#B}MnWPE1(ArK
z8z(pOGgF<Vv#b3tmN=C1f_4X10vHq;78bZP%qKL$Csch?u=*y}F-w?+S15y>9l#M4
zfcXfR6C8<>whazr_=Wm7*jeHjK4A=8SUBsbqa=DsMdFK#?)${|ju%T6T==Tm9|&bH
zkPDEttltcs@1t8=aWA0n7q0ElJ7*z2;N)X+BjasFWXLz0<nFyL2jA=~^$5^%yX=zp
z*}ii8)jF7R09koU#7L<Ly%<OI0%E?PWJhi~CT2)RcWT)SNbFsB&-a#@b@Dxl@Ar1U
zdrd#0qSMrp^~5GMtbG0VTur^jwZkzll`fZ>k3{Yv83PN(UKcn#?fx-h(P$VQr&Dhh
zx}yEVDQL0CLBU`R_nnB6)PQGuidM$n{^-#~yM@krMh&}9fA?LjNJ&Bbiz-GWf9r>V
z{OY|y@NX%xW``mUm!429KfE`w{%#ZMfu3uJ^(i_3byYb^NcbY#BMbD)5W_YXF04WH
zey^?W+9y$~2!%j_Sm-Vw2qB^tZyrB_h6<tqPrz_?69rJ<xLg|`J1D7kyyTGi9EwWB
zsTH03^38r+K>ip_%nymezY~B$1)w-U6d^p7ML-0YhY<0MH;4Mb;7~O<rd48{fk|T$
zwnYAE1F;bv3l-D<)SxWyu-&u&5$g8PNOt(m6}ppXjS6Av%2Gx^Zn5*Lg}Y6YwuuBi
zI<B+y`DpCP15Pnd&*~Sg7;V0_R_VCY<#%xf?)n!G30$s=N~R3CRqtr|YIG_5{BAEl
zaV5FkRj2%piq;U2k9z{Xiq@7t3a4cX)}5<dc1l87a$D6PY7W*2vGCsVOhV-Qg*B?J
ztI2O2Dn7pHZ?P?|J-;MUeYlgMmg?>$9kt0@`BB5EqSlr4F7fxb@+O~q&Zo>nCb%Rn
zLEKSl9yhk`7s^c!UJPhgtvVofMZPDJk`7rC_dGupX>=i1I&xb|qt#3Drkg1_Yg3~)
z)CUpYh^;HSeCc8M>3fun_49nno~|?0IWgD~UUZ!`3<A7{L29ymZ_cQ2-0S03xKROe
z4fOuR;ge^V?jp?*_)UDHWe(3_SlycTagTMGbFTKCcUP_9%p)Qm54YNBN9SMk?f1|&
z=+#bp<`{aMj@IeZd%RQj)KI~RrM~n6y}lU9ON=`CQA~H{LR7B7yPc3`xrGL0@`Ilv
z^KCasox@%nc1IrDY^Lw;{5c>LVHtu)que@^N|o2Y{$g!$Hz%m7JJv={OFElqr)VY7
zw<$l|S_0UzE#kJ63F++Fj@mM>W8bswrGN%uekja6lZ^B|?R@S|y@Vw)A@<`o$P@TQ
zSZ9N!UqRBAk_0iH6!s(>%>CMLTUmPPghO*Rivls&N>BU1A{eev4bk5DoY+u0;D29w
z@cSdLyceNjw8L9m;f2?n&IcUXXdUem(djMIwARUL$3ss9W%t~YjV>mNqP=2)amKbP
zR{Es^*FD6{nv%W%x!2&*(IYVv3nosGoYiz3&QB&KMR(%#3XDfP0x^+P|L3OJcp&4z
zXv@$(2PdbFc_oaz;dkQ8Ry)}7LqWF9+i2(aCQO3CIp#LFi(5#8(i#NGLVdlz=sDp+
zzd)W8j@2%Rd>z{mJQlJ&I%SYW!QbsO;>oyyLc6AmetGT6x4&H~549Ve({6^AlF*Mk
z*DUpcsoG9;+RtcsRmGGby^7dz*7<(w+B-@y^j0b|d8~SS6wbbv>~to!ndGiwg*5DX
z`5t%GHRa(pRqKPVb35ZJUw<4t`ltia=0GLGzc0-Y>t9ynEOGwBalfTQ!@f&YuN$~b
zX3n?3IkqR>g0)}dhr(#>tJ?yx9ve@>md4zL>|T!dR?EGRUXSmsiOrpOl&i~=LcL^k
zNvz_HqFXUa&0cF*6y%4*A6&9xYCX6wdzAF$Xw28kckUf)SQ@TX)|CAu4ERRw%S0xg
zMlZg2d!3-A!IF9JiB-DuzqRaeJBqyBIJ|P8DoN~%mHj-+;dJ#Rvy_j0sNWhj6xQL<
zXR@jpgHU4w`e$g653u6g=}(F}Z)8^4_|XRoh-<Elhssn4{{FlvF7);li##O;F4t}x
zVtm`li607GM=KWWOR(Ft>DtayF5R;7*wfi&g<lRFx{}&?t-iJJ1WyVS8KIBY_G!Jp
zbI)KYW`IQjaox21v7SIfncU5bjzw9KQj!vi-K&xFpLb2#1lh_6h&<Z=>YAQX8%|>)
zr|#?aNA(e|>-@V`6iU=rcg4$<s(e|tv$0Rotmc@=J^a}ENAdH#Hg%~i+|y+-`d~D+
zTT109roH`1l0j-gb40+s`){H;7MOmjC2xML_|(}WW7%lf3uCjorzhpA_kO9DbOd@{
zv9Di4|G$4&i?SiGuFtc6!387$5&#K+1V92H0gwPl03-ks011EuKms6v|1ttXFt`Z&
zddSrA|2GKs+kaUH!R~+rKms5EkN`*kBmfcs34jDZ0w4j907w8Nz##yGK}4pG|63v0
zRuBqE03-ks011EuKms5EkN`*kBmfcs34jDZ0{=b&3t+Y)y#JVS>iEACg6;hG^$>In
z5&#K+1V92H0gwPl03-ks011EuKms5Ekiee^%!TQS{KLOInmYdPfna<7R38jM0w4j9
z07w8N01^NRfCNASAOVm7NB|@N68KjVkcCl1{_Y<a3$l6x#ZIvMgq(W%S9T9H4H5te
zfCNASAOVm7NB|@N5&#K+1V92H0g%8y5)hSRU;kf(q(iV@u)5fJ*aB=Mwi%m@b;Zyy
zMwoU?2Id>446_rx7wwOMqiZlq=uY${)HT!*^kUQidKDUlsz)-BbYvOw3`!Fvha5+~
zM1`Up|8a+)01^NRfCNASAOVm7NB|@N68JACpa3(3hWYz>c=?1fJV+E0)!Um&@tC@K
zI*FvpRR&b#VJkSTH~MUyX-xj3@d9otpv+CxRN|&m3EWf)o|{U>aZ|Mwxv5$Tf5kze
z(7m-->^S#O*OBKcYtQE<)2Z{g$yEAWZZe%Rhnq~L$#Ii40olLGWRjMS_a7aT;VNrO
zbCc;*DQ+^AF3C-%QzW>_RGK(9SrZWZt4so@G|fLchUF@2W4Ot5Dw>;2rK7mXbPAH2
zOr?o(lQjX6zsi7*7M1iz$Ar1c+Cto9Iu*f9rqTtu$#e>wn@pv_xXGG;01_rIvY8eZ
zwk0^!8_k-1<siEuSQkt_27~rTRihM<QKHSFfXD&iE@4BVG{gwPUNA>c814ltgUu0O
zKp#WZSPlM@3zHxxXc#L2`SUdS(;J@#Fn0oOvo{dN05-qePk3%iS%>oer&ao=+fM{8
z()AplIBB)K&sVrSnR#(x-j0;Nxnbp>?kx<*xsRM2cD@np^kler)#SQGhOy46mQR&#
zED$y*eSg$3>nxKX%hjYNz=uf-Z{m*h2SKrug6Id|RnjTT4>*UbKs>(H*^9SZRk!}#
zT{V9)xw|<2>G%tc(gn58Vvc=T%n;2mQ66fc9nMI(`~Xv9QpY67{9^LwnT8LOiMfXA
zPaB7vUr0sBZ3C3wC00ZZk!6i9;Jl6e^6Q_(@*<g<E9yA!af7UMw{X9CutQ>|L=%4e
z=}_`Ewc{zf4!OKw5~R7C)aJvaJUq{4VxM`BeVqKmyCOHb6NM8fjvJN9@7;(Z)t(9u
zd6}#c@y|EKG~Up%NMp#XsHM3cTx(R<ee*`uaf6c$Zu5nh1Szg2=~O;UQt7{+l-aRg
zvn1>2!nsZqqXQCps(a6#P;mHO+=cyWR>jLCBVqN2^$gkYg2}37#<yLiYge3D4g{cu
zH;%m#*9aIeXA&g2nxxYCFqzsDt%Hh4t|a8_&=Pw)-yFDe`m@22u|4=^gKrb1j>~wN
z3{tskqH#07zH+?lVU!FphJGt&#mPuj?4>K0J2S<P7c&VGTuss`e3<;WU%$`O>5`tA
zYWBwQe5ypov7qRT-oSh3PCl-j+eq~1Wztwi&o<`Ac-Py3>&1cz41=srX@SqbyKivz
z(v4ble5i&=5a()=%Fh(^vGHiXbWnMWBwWT(_hOP!|6&WjVc!*x-n9NuqrWe5<Ym(R
zhlTFe-i^M}XMf8&>`iTPcA|B?Ni!STKd|kD&$6MbOoA9!lYC7<8md{y-ZkbC<zsJO
zcV$sM3T?xMCI*R=k?|jQH_gc!=Vh|UKC?MvxJ5zll#7vc!K7Pwm(i8tbE6sK9uE1R
zd|pH{3D{pu{`{SQkKs-`@#8@2uICvIMII$j&s!eEH$ftGmqmq`CfDxI+OeUDm&uET
z>d8)zGnXZWxSy^a(u!Aec9ew(Q&VFK=B_)ePM|Ug815$dnS#ztLXw9qd~=4{z4b)G
zBy*l@U;Sxr%NdLVhFJ6HYQGLIlUM3YT+M2L?iVRm9=dno4vD5T)jS28y0{BE^7%d4
zYnTKySCf2AK_i1$&yz1*Gx}6NLB#vdV4b3F*TIMK8Z=H<Sf4S<Bk?jhoU^@tQ{pP!
zX!C<PyDn1(;+!0Ayf1Mh7<Jn`Q~mlonn^%$HObc$w8cVwQ!i8#9w+`#PPyc=Y5kF9
z1Ce#l#2@>YyIz|F;Ji!*YahNpCMy(|EqUZf(d{5gU)Hwj^BRU!$awf2<f|+LCIQLS
zBwtfdGd;|xb6KuaYRTlSq4gfIC-?i-HdJ}_AcOOmvhGbSyi9J?7Z8ZNUU^Kt@awUl
z4#^+QNazx~?dPxsg}xUgQpO~h1W~Rg`I>^HoZ)IGcU;-~!M9fFzOrqDaH9i4CE;$l
zuU5!mdbm_0FOwpZw|C~__WF^Hbi2bkQ!gv^t-yAxe`CB7vuV4veYp{nAi~uoUsF(2
zg5{HCsq3$rXrBjy4Q#W=tG%9osgCO3`fc-iuPcj$c$w6@IyP*%yMLc?aY13a`q-H3
zWKoH&qlddcrSHjMU!4&qLHHMwKYx4YV+x80>!{Jsh$K|2b{(=rX_N)73_?+5=EKHr
zg$S5NJq37~B((J+5*P=8&lULj-Op><TGzIlM2v+REO`yTyhUtekVz2YZjzrV$aZ9>
z*VUp#+f@ad*W{00fQ3qWCLKBOYRhqzvWTNzIy~Rq9{DT3xL-CCx^tLV*7wbGNBZI0
z`Jb~NmXPwQKgpV`DQ6N8Tut&d1%1dK6a2BO6jSuAuE(N<*^(Br-E^qhG_<~R<qxGc
zq&+W^ZkuiUS8cf6`fPWT<(-ZA`5hldn)b)n*hfl6mt}PB4Q3Jqxtio_3euW9OIFKH
z-Fn1MO+J4g4BAw_rU3~x&stICb{1t4{FSFkJ4^p4@hwZDI%Ep6E8oqn>v`O*ZzqnQ
zScNh~VMg1S1UOfdd`&^vWvKSF^O*VDj1066jMt_dP4ipae=O}zT8sSrmPbNCyi5i(
zn3H`}dMftod5cwic+;!YnJk{^C?Hj5fQojJs@}yUz_^;^YYK{cAbM!g>Q~QGd*%kd
zGdGG1^vq6CwiWnnY5LIPdpcH^mr0SvuW6b0j{X=eT>Se|{BZEe`{v#&D<m$Z$c~CN
zm^^f45(K!K<ZB8Ft=SPdL3qDrTS#Qpqou-Yc8PqRU)<CV)CnJVPFQ^OIxmy26s67Q
z9Q*)zUGzp-s^S(o@y>8!Z{_2FkI@T_<>JqsXD)yW%2Q&cW{$HxJztqBCP1%kK06#K
zRA`WLWX^?5fXM`cW)Eu7fafm<wSGEH-!^0?=ejB9CDA_l=vf@hcf5LfaRu{|mRB7`
z{rKP5oQDwcj5mk+z~E3dI3~Jaxk_a~%5y5&TD?*iF6OlliP3^O>6@(*+<WM9Tp9cL
zAB%8@VAo*^FyiPyR4qyg86(;zswI*nJSe<c=#r2CO9mH^07w8N01^NR@K1nAQ2phT
z`sd4Ee0&cV3VQfG?0~c1rmo%wi*Ug^oq7z>!`J<zGu3xp-ySo9|C^7%pH7($O1GYV
zwbiCP;NqoXv34{2qgq&4Qr`y60#m7{uVDL3m;@E>Ciyw9o20q^fO*nh<XnqZ!=O3Z
z)zFiS5wQ+YRpvtfKCQ<aI(V7<yu5A6Je;`H%TbZ6kLs4cWxn*ftj;`su%qMaDoo}Q
zJ0^aC;EL%p<bQi9kROm=CVvyqZF}k&KO8t7Qi2OuBaXiPW4F|!MP<tV-*52zh8sMD
zPfs%{p@>fId*AT>Mfds9G+Mno>TGdBl3-nm_CqFKnX5;BI7Vp<cGzv84ljSIQXMd`
zw{+4ndy(I&H<}ORuEalYUMJ3r<NF&6H$V)#G$4h~GtFIID;<$hZm!YGpQ~$eZi`jN
zj}J_|5?7C!d~lT6U$7z11bw36qN<tafQ9|QfsFc^(9>~(Qqs$ncRF6+<uS|Vc%^jR
zP$3eXrsg)*{od1ATq-$w&WBCzq=}bnd<B_!0#}dxoOrI#c)N4HFex*C_uYFp<DmN+
z*IJdU?mXJQ@yUyg10-*r=PHV$JG$i;<BwQv+=pn}b67FCX3jzlRS5^#>?5nTW|1B<
z@p!Ht`8lPV9OX(jwf42sKOYvFdPwaIJ-yUbu`mH|S0*u*sEEJHi{ol}v-%gVZI0dg
z+k1<o36?soev*Cf7})^KO1iQr6UxNnxOyb>G1fYtgx$6&<Xw?_6j>O*i{yFN;eAKE
z3F$}w;P&9^1BZ_B@_02NPa(4WgxR$x2p0hjdGo#%6O3Cj*wqPx>-HlCKNvCbid;SN
za}MCUOv={}2_A8NUki;pdIo==STOgTZie&nC2f_%=N0a!^YREac|P*+ZLnXJh?G*^
zp{_H}mWEcOKig(f?iIJ)a;Jm~6R*J4qZS_=Zy+)xLV8@K(i1wq+_@$8jrz<r_KLvk
zEwF>#fXJT41YRDszdX+QI>%uwN`szWD~AZ&J?cnqz54P}PeHH6jT}=rlOX@gB>vMC
zL>)d%Rw;W`DVXW3J+(UH3NdW)4$7$;h=vW)3o8c~$BX1h&EsV<Pq2Ix>eKX_bJ|H2
z=dOKc)dqV~T_5IRDhenuACqkNGYRv#o8)J-=>h4>HmPqfHdDG^w-~|54-9d3zcFcK
z@v_ZV^EB4IkeA7|<C9u~vOa?N23Ny4nxEb3-jIw>X{W?uOTO1x+q+mZ3G=v`<m-$N
ztiDS@!7atZVR?GCeqfvEVzt0|nfB{Dn_JE(tkgq1=4J9+e}blj;B&9lp)DKxw+I$3
z582Gf^u>-%9Mp?GvCCvLlQ5U7NxshbM3>eLJYXzrtnW3cxYZ#_*`L*F;&yxe^5rp!
zis))8&(E6N!hr~+a&XR2^4nK$*VO8Mt4pbnwBFw0d4N!)?z4t<(s>S7lYE`=`D}K9
z(e2q0sQY%Q!`Usaq7yPZE>%7eTF@%%^X$Rr-KTkx9PXNvJzQ7fMP6A5!yDZcMJo}7
RBoyDtmNG0ILbp9Y{tp%$q~QPn

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/pkcs11.txt
new file mode 100644
index 0000000000..78691fd862
--- /dev/null
+++ b/src/test/ssl/ssl/nss/server-no-names.crt__server-no-names.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/server-no-names.crt__server-no-names.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/server-no-names.pfx b/src/test/ssl/ssl/nss/server-no-names.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..c35fcdabc7a2a7859bc541547a557ddb7b5cfee0
GIT binary patch
literal 3109
zcmV+=4BGQBf(#)70Ru3C3+Dz2Duzgg_YDCD0ic2l*aU(L)G&ez&@h4qhXx5MhDe6@
z4FLxRpn?W?FoFhj0s#Opf(C5{2`Yw2hW8Bt2LUh~1_~;MNQU<f0So~KFb)I=68Jt%
zJriC|0s;sCfPw}<UkwPzOXOec?$3A?fGQjp<-H^fxr}6!(xo1;=Vfunm*KJtu!Lsq
zw>?%soGr>%@FG01l|%=i$fLqMs(^~-*<D>cyNpH6UfOR;3f%=(`TNeQW%uo`ts)2u
z^M}5=IUwAU3#5h4Dqdsm%lvV|&zwe)scwul`F=fuElknkcW8)_wlK|`uVCUqioaT7
zWgkb%3&B!Mv<pNzA4K`b63LQKk2M(3zeSK=kP+zAw=i*70ni+pSO{$Xhz8x9akSvB
zb?|Hpg_u;)EKss#TlOamFN{kaTHxm`2>5?xYVVo4_)OZZn9AysXf^y0o+M*8AkE>=
z(VW8a0@qN&A_5j2h;~&R54&&{xs+c7h?}(5)QK_qdNUyS8J|O;3rM*pW|xohkk@^j
zJC9xRL9H`Ib7?{SRO?~mPuWSA!sOn=<Ca=|bONQyXCqcK%1S<Ta6;kEEOKN=tzm!{
z5eNUkhB8o`<lbfgxXynwE*tuP5`Y!a`2Y#h!ShA>%J8Znt%Q?4gB*sKDD#H1QvjVl
znqjEO7(ZSz%)6U%Y#QdMZ<O&Biw=>PaZ#qSZhQj%{Si359M5n&Cmt6G0wr14%)*9S
z;!R$sn!G#g^*Q`X0^lJw34yr$XHb@|mthjR?>;tlmgE>v>gmVsn7y<y6tuOg$`R-9
zzVl5$Zgr6k<E-3Nh4n>xf|k|gv<--N*#nwyhQvDEv<zr^vyuy742pOG-(h2c^q<m!
z7oC5_d;Qw_QOLpE-`GlrnlNHKp8xqywn!nu3+?T_9o(SY=c2j%#XKxXy5p=BJl}x*
z$BNy-Y-af_49VerF_mHyTSFMt$6{?$wJckRelU?_3#Crhq?pSkg0<C<*W@mK*`3XF
zJp72rAM?P;26Kf~4bA+eX2*nZ1b(AaUcI~_Bg(By^O@;DE;ylY?7>>(p((%^ebDbs
zL?0%hvDiT*u>>#WRN-9^@Y7ZPL@z?CRPl+wH|^wqq8Y&H<vIT3ih3_c>Gn{9=3363
z(C7#dK1x4>Hnx5CR{F=29+qJ2*2l=Ih7gA)SK{Py3vlJTmcSpY>)=(&FE9=_><#tN
zQ513yxIMmHmKY}MwFI11n4yfr+gv<RY)iwP%rya9oV;rZy<A}vX=V;-)<X%t?a^?M
z8{cm`ln)i!Dn)j3RG(*$U%|Ul5eNp%#Yid?zIyqYnHvEtdNCG?<;f_0<dE>Y#R`ZM
zkBz?Gp?*820``=&OjVXPwO)FI0vIs27F3=Kq4J<`l^ylXt+$(-G3)?>o=zhfWScxx
zn`K!0nI2`YmSgwfvaI{tNB8K}vi9I=eT@ONuwnr5%<+RtG=t#hvqbgiJBMFHX7`6e
zaFo7XOL*1+3bT~tQ}HbE<8xNcGG|||`pjUj<WL*e*lsL@X7?^_Ib=bzv`~xxYp>}o
z+BJio_pPFTrsl7r97IqPa_8@$w{VjKN6DxKI%c)<?V+MQ-IoHCb<Cwzm1~jn$NBRH
z^r)es2j@JQn9tokXqKdb`>5bDDLLs#q&?FL-X85DX0{%BPjdgFz*a}c1Wv;Ni1A8!
zTofh`A~gyWy=bvZOHYR;xZ_AqnN6fdYl0lTC3{k8OK}R)1T(<dXj)PsP5rETTuR++
zv%+}`lfZfeek|4BkA&Yu<rZ{C<f|J<@gU8Ur^6ZWy<x{Cf-tuyB$Yj?QHzGiE#DDL
zRoa~LJ$~(7%&Y+mMnNO;CdFvR@(N4E-~Q-#UjGD#vi?6i8&4#q#wNRv+7=0h(eOs`
zP3QH^C-DOOv;ZW#3R3h*5vhAS#>cO7uk?yfj(2hY*99*rOVB97Y3hcE*fv6=Xs$#{
zH_aaH)7(c8kAET4JWW5cw}BQYc62z>GSRLH(X3>OowI0F5}!400i#V%;*TO&z^Vf3
zhk_rQ)7!v%FXW)hQVpDLRgdsxzJ^&Y?>fPN&<ED}X0T@(u<HSD0dMsVjiT3Ix~;c|
zOuAL@rjr-Y*#my)vQf!>q)w1N+z_M}VlP3h|A?-B-|yB2fA>o|8+x&KV8b+#*oaCs
z!J*q}qDM?%<3(#Nq3^Wp+8&kU$7>eO?l}sfJ;mTYe<obDk-hb;Bu*>ArSft$jdL!3
zFoFd^1_>&LNQU<f0S5t~f(0@Jf(0%xf(0rtf(0f93o3?4hW8Bt3<?1Ppn?SMFoFc?
zFdPO7Duzgg_YDCI0Ru1&1PFSxU&VL;{_O$+2ml0v1ju0tWR$Cxs}!l?0;0yiy?g?{
z>rU}f;F0-@Mx9%r*U0pIekwd@%+T^#!<f{H3VwWDqKOx)+>ZfhXNN+-8Y<Y0S}1cF
zF?lx7C<FnF>Y-76z;1!3@8^Li-TR}a5Cw*`RLWLga{ET1isJDcB{PNHbXulTI`9!s
zM5EEFf?eMz%@o7x9C_RhZPEi_MJ53<RkETtDL*rt(VoXYeZc==IJ^)RJw?1WZNHgt
zG{xt8S&D9&$2)%+A(cm)>^D&0Tdn(6F|eERy5Ig&t6lY0eTl8v?U3G4h;g;}d1;&z
zTu*e%aZ|KX6V@pXyV}7xp5i-8*lb);$Dub#zWVi-UNp)(pJrDDF#_xATQPU)vRNM1
zYD77yNp$aOXr^H{K8y|&Z&_-jY2bmv);5$d%Z3`>d+~1`9oGsJK)(&e<uhuz1hBqH
z3<l*9{@I^^OX^AK3dn4ZG4mKqz5o*#R56C7+$<`GO?2aDRPMiT4ePrSMQv;8T0=G2
zOSh)g=9TP9UsaCw9Uf<ti-qGM%uHZ%IFzGg#w1B;PzS?%dPWVB#mc{gQEzHRCyR>n
zGQxSKn_K+<+CDGZgnyO)5Vl`cWyL#~6h@rrt=K0rxbqiLqsuWg+j9TX{r>aQm=m-8
zWbLnwN?zWv_C|U^#oq2<<L8>%isTVKxfZ&ummzoXc5vhC`dEV66JowS(Era<(&o;v
zU1+$g$xxY^6cZ}%4MXzI?zxY!;aMm;mYNmM_3@iad^>B~rC9jv+H9G0=S%X04{!6L
z65MaRrFPv9s$vAY$Ja6wp*C+f2v<HT1&G6@x|=jo8%NbXQRlWEl_QfYuE-LJ6vK+c
zeoP6`gVcaMHKZT`kx9JCXg(!9DS!!^VD+CfKG2kRkGq`%tB)*B9&g+I)uadmnaW)8
z*@gQ39tQBoQ03hu-N(}Dia_*!Rtw2s=%9KN#${T_$@USv6mDatjaGI#^xdZ<vMApB
zCr^f4>(RuG1cN8biq?qIG#{Ji*k-43G)s1?qy4p@b?6U0d2k`x>Q7;FuXo)Mp6-}F
zPzaza&M`vF<ykx1fzx6sh$Oi+-fRdqu<E=6m)JsE6n9fv$0SteUO5xAh_ew&b!A%2
zzjrivReBZR>f*TAA;^1}VuRp+_k^oP%{=9|8&@@S4d7)e@=s?F#%H)XZQYe*Jw|o&
z2A~c=^gml$KxRL7oe+IRluHe8*!a*z>y>FN*+COvSR{AHt7`gJd^?CYtWtZbksieF
zl*nS5c$SpQEU*Z-*MLmMEi&I7|43!qet+tYb5_t0rt8xT_aRzcM@kz@H<to5l7)=H
zG+@zOKE&&3$o|8DAx$N|aLqo{0es{;^E(PJM8==cCugpe+xbd8=GgFK?@T$9JK#R0
z>klFeE1MS=K0=ZdgmFq!%-G&L|4P2)gLjkT-K)?&>3g>edT}k-4~fgotp2UAgoD>U
zMNN^{LSx~a=5TZirukaPknk+LqEKnm*><(S+hIQ%Shj#V?+S*-Cdr+-nbJomQo`O&
zm~a^hchN%4h}dlq>w&y6Re3x!#6D!a6|&-k^}FwhV=*z7aLTD5gWr*L{6oRfAYFjp
zc4%W(>$={v=@c;~Fe3&DDuzgg_YDCF6)_eB6d%d=AhBhxC({}h!d&kTLzfx<%rG%9
zAutIB1uG5%0vZJX1QcP&BVd1XEdoIGPi|UJ;~$Lg$?gOQX;D6_#iXF}0s;sC#5V0-

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-password.pfx b/src/test/ssl/ssl/nss/server-password.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..a6ad1bb869b043715aca18b25791da12403a6be8
GIT binary patch
literal 3197
zcmV-@41)78f(&^A0Ru3C3_k`5Duzgg_YDCD0ic2mFa&}OEHHu$C@_Ks-v$XPhDe6@
z4FLxRpn?X_FoFim0s#Opf(FF~2`Yw2hW8Bt2LUh~1_~;MNQU<f0So~KFb)I=@j(qB
z@c<;~0s;sCfPw~?-=hcTo)Wk3+IMA=uH*^|Dc4<hio<lrPF~cef@8tDejty;U>U8Q
zxC?%AQ?DnuPAF`D0}#OxEu|%n%Pj%%3Q|ieC;WW<bt!g-i1qN`>5c`KmTmXacbxh(
zHJ+<r)>;)L`VDSQTPsR;p^FlbMIo?ECLe<_N|;}qpN?ccLh+QKBJ$*Ehtsif6>1N-
z!wtWg)7JU?X$W4NRz`KA{)_>@ct1iw>1KaBVjoBQvg?5W)RD`e8W6iIfQ`>nwOIpB
zB@M?VH@3BSzksw7QbI-bh!*y!Eb)l;%Z$Hgt1L0lZ6#phG7TYW2)%>BBb_r7&=TKx
zEmD(l8#PT1g~F?-G~tRZ<SvSCGZ0xacr>3JxUHUtbcbjEvYywE(^;19M~?iN^m4}W
zJ72{AA#oOesx{8OY`LGw)!;#r(kqq?BsDg#ITr)(29d*$&at>Z+gb6rYw6*R<bDsO
z@Q9&o7nu4S;AB+nKwB!(?le>)|7QP9RRrOZd~L~@Te!YXtQ?{`qt#C&9oCUbL6<x+
z-Aem8i2~qzD>e9y&0eu(QXh_VndCyugXr&rpC?iQ`nz5MXJr-3pK2430^|FFB^c${
z(Eg-lf+LvneQTNM#+b`l@(u)W_#PMJE*{2BeA%DSyGI715LE~495xNY1re(F;pk1F
z-*5-h5bq0{g;-G8S4ir#XO8PFLHIny@y{mep^yMQ*Dw6#Bx!|}MjEFpDa~^I)eDQm
zx)n;HzC-WLn@GRx*)A1g_--P;MvfKk4Trp5Z^z$diRO=dbC7lRtx3Y4U=Mr~u8=4C
z*{62)POD%GdMC(sZ<CM_2guHrURN2e{y(vhClaj@p+dz}A`Y?^;3u7qR1o^gRnOUL
zCQtZ93u|=U0%dZruj#VRYR@c8ODU-fNqew%h$@@g_j@=91OH6l@b&w{f|7@a8&5*#
zV|y)4FdVC_ug}49#W7CPt7akO=waaxe<1=_rQMg2w4loHD}_dmtJlp${gKD{Vjr-Q
zT?rv2m{XMDl)N6af0T-9x)|zDk1yg}FP{IWh2(i*B`xTrAv`%li;@4;Lses_HW`X6
zDD_G>y0yPZHV^ggN`2z0Z~Ayehp#_L&^s!+0MEoTLik6^BN7r~Qu9;pC@%~Hc$PU_
zv<YKbh*;4*@@yO1cIL}-Dh(w)xb7A~H@N;bY8DG<Sea_IfYll8;vHd>_NH8y&S)Yc
zWFXcuVYAHxC$b+l=5!W4*^uLlU)K7+jjo7~(d0d+mCN0BD?>hlD8xhYB2fqpwX@0B
z^im^j^h(TCD4bXpqn)krLI%5g>iV=#U>C4Q?AB3tO$pE^>}?b>jC2$0@Py^W<DbLm
z%~l;RnqEu2Zvy(^qQVS&Nu3VSf5ZLwUC9^JY|mjH=nxwm@nh&yRFyZnJn%ymU|^wA
z1C=^D$t!CTlOD8spjiy*zvn9?7^w|Dk5DvoSZl);3UOGrJZFBVvkvqQ*G#CkG3_QL
z&X<;12zyFgZDsJJjXK*Q0L2wB9lVq!KeOPaPy;TS$ERQsoV`%l%t#}=F=E)x3ubrm
z`eUd-eKD!O8}VcOYF&HqIsX$*Rzu%mHfMpF$sdLN3@8e$eWZs%rXq!_uIKwACk$4p
zJDa=|D6`hc$R5c2)g;a9Rwn?}3}HmSt@UF5_eEX5EuFyHY#OUXXP7+W@K^tXd6J?!
zU7JiS`~B1~9_HnNW|&53#Df@5)>>AAQq)cRlo)?eF7vffcsb=iZY%8ZA9Z3uda-cR
zPqTIBB|>Wd3{qk-StKvV*;XjJC>qHRFhT6L+u8P?lC<f%<#8ApQLsrdbV5tf*b8E4
zP8`pWUD}@5V7>#L9YJQm!7|QIpj1S{1Hnea^Bzj|(ySsgA~}yBSpH>(uOa0h+*!}P
zWkZwj<%fL85t!r8P_!RLBl`S#BUu`;LNQiuK|zT_XSYDhh#REDt{Y0Oq|IM!<zk79
z89ES(-1s+9`|0I_R8Xke?RPxt@g*b-yG;f$Xq{p^;xm(oz;GjhbPc64PSPugTodS_
zrs?P|@O;vk<M^&PVfo?XZM5ZGKr)>31-SB2c}<(fP^Lc7w@0}A7&C(513zz@@Z=P3
zqa;~P?`qZu7<BIT3;()iZt_(K9Z5d&atV*5x0VxPG>LY#H{vPY2zwEVapqQS6ABbD
zhSCPq0h%%697;q&LfXX5v2(~Sp1oy_^tM9+EN6IzH+x+|FoFd^1_>&LNQU<f0S5t~
zf(0@Jf(0%xf(0rtf(0f93o3?4hW8Bt3<?1Ppn?SMFoFc?FdPO7Duzgg_YDCI0Ru1&
z1PC;%@g%?e-7*3K2ml0v1jvGf#9Fkdn{^A~{Tha5@oBt~n?vh$mEG1YJ*N0?S#kWG
z>mp+v*iN^j<Rkgr&5T3*Yb0G*nR=kT_(qo=JqyaWv4FRNkTSLOjdi$c*r84H%Z8HC
z5Ma5vZ1Y;-f<zWHQe|euKOUA+&^P%pjm8%POfpn6l>*VpaVw1QqI(*X5#tJiYBT-`
zRC<P5!Z8hW#dp*=??3$8j%a$sEX5;<m)yXtJji+qI%WRP%Fh_Jv8zfp=*0ceTs52a
zLIf4V4v<onqPfChxQ<;45VjtBlr@A<YI-2oQB5*ZAMT@=;!8$%guyS%%0qDeP{vPx
z>Q=l*XC;e+-dtVDSOl-^7o`t$R>;O?RkFd23ib4>hJaN<Cm0mk4h6O8%_$OXsPmY#
ziT)Ah-tb`PH*opXkk=lDBQdKh(GceGoP&RPYxlkX2Fg>4vg6{wc-QNDT+K_3MR;F0
zuB<L4)LBO>6-lv>y9B$zcF5Lh_}j+()|Z_9Q2ajjF$Lq3mWSEnJEz|R*|$in3BIcA
zH!xT6BVV0<0(^b_YX8|@i@ymFHpX{L+7_8WFtSo3przQXdpK#U4qRw0%~d0n**`sz
zXPM_K$Ek{lSBIM1#H-80zr2s$Au4$zC}S_Sti{?pp(e}3r8cwfU@?!dIvn2iM`+tX
z)@Zdybr=Yi7ltq4riQ1a!{ELM2&x1sB$LC+rUni~FR%k9j^)3B*x-P>vh$p#XBq35
z+z6H+LO`XYn%e0m^$b$B<DB1bVp&o^uIU7xA++gcG3BIeH8K3Awpjtj2Bh^LMlO6c
zrG+a8bhV~#n}{@1%)Gs{@e%AVDMJK#?D!#oA<Dz4`uLF4L=Z%KCT8R1{Qume8S8wj
zXwG~sl^ru-2q?TWmM}XL3=RQhg;<%RTe`!MA>QSsN`?59yEA!zTpjMbLC7--XIo=_
zz*bybdF7;1_Hx0btC1F!7@&*@?8xTw*uH(;oUE2pWX>f;#U7uMq1(0Ggdg-HW_=&1
zATR$SNp4b`EaBc5i4p;VoKZvrF`N3vJ}a7NCt#*q-I$E_1#vO`fXl7OT;AMZ*SSs-
zt1TM%x3qMN>Nf*d8|V;(oTr7i3KQUy$>5nri;nor8%VKb_NBm?ECs<F(P+83S6YAd
z*J%^FVSsVnkMGL3gF)AuxQkRP9udP;0x|Nam>#+z-J40(Z`uujy<>Z+)Pf!kkM56V
z`-DUC{^Jtv2th()a#GYXYS3D;fyB$Z8G=EAWz|rUUY#;yk0yi%#eG(Ii$Qct%GJSa
zh^!#*q5XOjd{Xaan!hd!GSjj%x_gl+1Aa!Sg6I2U#4PeW<e0S_UiF!!wI;;77b#P1
zW40J59=t8Vl(v;yK0hKWYK9i<4sz}zdedH(9_9~Pvn8(}oVv{f#r?=Z<sVPVgGjve
z1Iwiz9!xNssrMpX;lhrwVEDjqIaB6tU?^C%EdVJir^bwn4$5bp{(J<avyI`Y<vmkE
zGo!5u+%}0k9yZfw<fkyh_~3HnVxc!)rKWP3NkQ=wg5*1VmDXAovi3B!#dt1lo#Vuk
z-D1dzqfbO;_8=TpTxGc$L`=|CG10)d_6T%!pga7a9_Zv2+hFJh!cGu_tPL?GFe3&D
zDuzgg_YDCF6)_eB6nfR~gGo)z^le_ap`z}&-kgJ6@h~wkAutIB1uG5%0vZJX1Qd?Y
jx@do-K!=5Ls8hdv<qNN_hsp#9YMYu-O$UT_0s;sCMDPG6

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/cert9.db b/src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..3431d1549ef5c2c073e938de6b106f535747b9a7
GIT binary patch
literal 36864
zcmeI52Uru?+Q(<oAe0PEgNP6jrAV2O06{DigEXb8s31a!NR2eR2vNieB4R@p#SSPe
zh@z+~xT5HaiVHSS_PV-=h=>gfaAzh#&~?Av{b29jXYU!E$vda~&pE%Dd7qqjW`dW8
zYe=k+HCGfJ5fIDbKuQn{LpCfH1VIYeO2^iog^C%Jo*nEH?qmO!sQ{T+w<#hW5KXQL
zl7ER@kS~-El{dt8zyb&W0)PM@00;mAfB+x>2>gWvY-ltlQyZQU5*Z|1BnS%#35tw~
zagPfO4-v@Nd-83)`7Ea?6Zt+YB9G-Zh4m?)r60gX%?!p<35BVILU=%+F#J;q+Gh$x
z-j@m-gNYOxbEr1#N7Rpr3k($sVm~QRKU0wAeyPDm*#@>`8god`I6`7#;)KzkL@1w$
zNHV|F;IR#o-C!A}wl<s+5gQN~F8oyelR=W|c-z{!^80cK31Yc>I!(6qoWXM8&tOfR
z;^Z-vkGEj&HpRi!$=;h~Yv<<aZNv&dv6YRjX4uNXZ6X0rVdF_We3yss@`zo$2#<?z
z%<+u{zOlqNJbYt?Zvya5Ahxk0q)^G0P(*PJHY#ZcS7D>L3>(FD*eEW<MsX!Jic7Ik
zT#Jq3Vr*1^Z>8On^p8+Blh}l^8KG=OD4P+=W`wdCp=?Gdn-R(!qArK1%OUD=h`Jo2
zt_6{6LF8HxxfVpOg(R0ywjh)(iIM~*Hi5~E7_S+M*EJ)?Yew{$L!@(vbPkcuB~rLV
z3Rjwfx57p7R=5NiE<uJ%=yM5uE^!>piMr-QU2~$YIYAZEL{T#~-ni7nd(XpDQKGOw
zXwKns%<%$J6E7e&@z$j#-UX?Nk5+2pLzbF2QK^Yzm6!w{so7hNASF%ht!B}u8h%J5
z1uT2}VA<0Li{AcXW>0@Hv!^U(_9@%bFqYcWU(D=j7&Chs#>}3EF%v)4@IGKBe!fXf
z{G^kbLA|E1*PQ#wBu*Mh*}&fJ1mfKZG7mt50#Vd}O`<XR+At(>Em7gvjNU&WE>=YB
z`+vHw{n?*PGUjS!ad(SP>S5#qZqg+mxCs_O01yBK00BS%5C8-K0YCr{00aO5KmZW<
z=Ma#k%3*_{BZUysfjmbZBMr!p$Q7glIf*5K1rPuP00BS%5C8-K0YCr{00aO5KmZT`
z1pX!hvSbRZYeH(J6NXWGv#iv3B10IXeV8<<F_=mi23^V&si8zB4E>ugNit*#U045R
zJ2C%PEQJ(Hk&%oBMh0UtgQ|E2Ie|p{O#=kY0s?>lAOHve0)PM@00;mAfB+x>2z*9>
zLWW@aBub(ZjM}irqho30sT8t;xwkMTmK7}$#j@;e@t3+;?xL93;Ao+jhbzm=%as)^
z#CBq0LPU|QSiERV9QLfZ>;UP=43G|OfOMz>q(d1X9kLT8Q4L1z*f!{R$?>uzj@KVN
zRKn;5!f2L27#$l!a>SJA1EECB{~2Wvauo4LR2b(GCgTzkgcM^*U;zXG0YCr{00aO5
zKmZT`1ONd*01yBK{u>C$kX7LQ&`dfW3X$#C)LIZ8B8-fcOs!>bxdDqn;9``1^)05)
zw4aR2kz6T>nsn5Gt%YjhQ3QE~L4ATey-^*uE~+DmG7J@nA|gbQ#*qOLLX-Ky#xXJB
zcrg=vBYFOR9fa&ejv+r_Zvfm!zDM$r&B(g{hC>Yc00;mAfB+x>2mk_r03ZMe00Mvj
zAOHyb(+Kp0Go+ug%H&b7BrxGG2rv;u$I3`^Xb4#c#-H(!rc<Tq6ugEcTp-OMOLIs=
z$UHhW>o=9;8b=Ekh{A+HxTs|QKOaIKA{UT@$Xaaf--OIZQjp94G`?UwfB+x>2mk_r
z03ZMe00MvjAOHve0)W7Oj(|Fu3#$#;ynV}Px1IMMJ@XjNd$TJ)#cs0XDF!^(Tf}}?
zwfKiAA(hW64^v4V^`2)JNFGYSb7}dmZuYi@gIf5c^Ubn{I-@oSVyMJZ26%2+dZ(!U
zx|hGXFH>#)CDz`9P0Jz4Ljz1Qm;SYO6|tdHp%0M!Nx33g2sH>Z|5uhZbE(THY7B-B
zw80%xOH|_Z8F-=+x6j^hn2g^@|6|FzqkRTrC9yxZ*e8~Qipg52m_*x6Ccz|<nvyJ2
zuOsvPzS_yo`a9jj$6l<R;)N>G=!UBuSHD$+VR<Ul|JQ#|Ev6#&S4P-omTV68_d&Qb
znTlKsl*{HycL$&aF|5<K+b|U(i(v#p#jqSnj1f4#tgd|>Wk-~FtcivAR7;AiYW)Mp
z<F6JiXbh%BDf%{SpS~B?xR?=Q*-=qup7&wmv9)g-G%}aJ6lIfK7g`4-329l@9UtZW
z#~wZ$GCbhD?vIbvQ}rwI-CK$*=_3|-(9<VgYf&#09f?a?`<~)v^C&ynLEAd?LgIW`
zv^1&Nck9*8*}Q8h8`oXvY$+};))?hP3u`kA%70tFJvGnq=1Fnw_IQQS#qgL5+RkBc
z(Tb*IT|0Zu_#8h|yIG@8`FuQed0v+4`Q$r|jctpq^p&62>Fl5d!@3+j^)08*k@Iuj
zndTIlstB*1+CItQ-S*OD`kLi-L3`?D-z*KZ4xar}++GqHhTy$QC<9f%9@!bDN}-};
z81C-N3_H{qGZ=C~tw~#34OfiZWb&$+;_~45i3hrOf-gS|P7XdjI<)CYL`FhY+uDYl
znoOhRD(*Jyqi;0^#~8OzJNGl+6wYyuNae(6q{d%)Ikjod#YBzT!McT0OOx+EOr2IT
zF>jx1-YTB0&i>Q$_c~v>(D6L(;G6YhcCE^k*QjfnzuNys;l~9Q-@oCkPuFUhcV_G%
zQ;OV)&Qtfamj0_s?t*&wZS_lHV^x!)X^WFSCKSJoGtQna%YVP4V211M)yIvxXDeFe
zoYbEC;Uy>SXVK}jrd@Y$=q~mZ%ll|16a*R$f7@}+h&ie}d(Y%asnhaHS2ZT;-G4`4
z^g!Qh5xNhGYh0+*I-8n6Zon_D{-2S*acTAYRl2XaXIM<4EWsU(3f}ibCE^1&|KRfH
z-HaNx;NlFf5u}U#{!6u&y%!8&&&mw|I2eX8InTZ;bYY%2>fXW4x1TZYm_F6syztSU
z*)0y|bkh<p9G&0jvSP!C)s*9F9LR*X9R+PL!M$x?3W;iey|*>!Qo@K}7tm)Ba?IZ<
zVqWOA#NWd37gt>WdHt?)9e}q1u>t(w?)6{J3x-4nk2|~Rh~cwv1ApPuBUSW^M<Z3y
zwt42w{Me)@>WWv5>L#4cqZBpocMVPPL5f3bZ0zzDPC5~e(5rW~Z_yudbXfe(+C%S5
ztCLH7G-jAT4f3$EsOcQL;Z|B$Ndy0w$5WY-;#!BUoln}9TI>vHR&H+{aYr<H9QoQK
z*Bvh$+fKZBe!1&>b4tmKc_jV^sO6B6ozUDEwiWrzxY233%{YYr!_dPn(*+4B*S6MG
z9X5FHxbIv-omb@+r^x4y(ci4?&Z3x7x;{9)G7wJZE;(=BZZ+h<Sr?`Kr1LFHjQ1Ml
z&Y852D!)wcLFMwinuqW#amUm>yBi{tk`Eo#qxk;`_d3JZz+y|MqouuLSbe9r{lRIM
zj%rL>5mvnB`P3J}8%LD03g=bi9G7poK9#?H@}(yI*oo6DPd%0!@x=Fr%whfRI|=rC
z?@YLK<D|O3T-f6?x)XK;&zZnY`_^$eN0yR#%i?rhb9w$R%5ItgJFe_ol=iCC^ZEO&
zvzU7}u8&Gj8`_w~eX?d`z>8m2ALEaDd2iief7VYrXTE71KK=Q;pYNGiZM<t&ooy+s
z$f!)!oYQ#k%-liMN$;O*GdJbG%RMuTye96Rht4qnhe^Vnc~8Z1LzBbY#HF-`!c*z1
zs^W(XzQFW*kSs2+bPCCMsPG`;@>~tOiji3rN>@&I&apZPO^>7MS9{=YqyJ|;3A>U8
z;Kcsg*I8IhA@%X5YJL3(-ud5K`sq!v-_GjwrUNiU5={HGKh1V?zMbVbWy6@(pRO;{
zxmB;cS$Rqz6y?vj7|p)<hPLDC;-K|wCc=b2<v|-1Fn{_PheXZ4-k)N>9fqOC{pnZl
zD`H<_KVp9AXKZ|5`qTlS_PbtnfS!*2UC)}cvbx>7_+h+3W1A24*wuC``B@8PRJK%T
zZzz!GFRIb3RPlSI+5Y5Z@Y!^YE_=7#3$JFMsa8L(<v2D+v3kjZHi6MEFUCdjEmu{P
zZt!t7x|FhL{r&oDodv@$zdUQW?{?K5qo@hvyNZKzXD0gI-4(0vsj-85CElc}tS(j5
zrjU^y?z!Mb(f9|p)!*w~ZX2_(_`I;_k!NX9Qde%~+Us{p8|7l$Do1Th>fS_sRi!Y;
z?(xw5=cX0hV%S;kE{n1`v?MLL{+nkHM%beT50Z9w=5`!)F0!%I-~1>+wP;i1Vyn9Q
zO_@B`7f(^OM)|s}`Q4Z5XdjPFvl!$RkG$UhVnTV&Fv7Ebae#@hsVc7z-2B+#v=Y+G
zOi8PLwq(oMXNqTP77z0<jf@I9U9nWTeok88v)y;r54*nQm}teGYq|T8(l^R1-EwAX
z_S&C@7i?}Sxvm#->o%`mUnVU_V4U?f&LP*csc>W2q=IMD+DFZ97Oi>jIOkj=MJ=pu
ztMBEBjFdHF+**QOkI7%=O<pRh)t`O$k>(Wg>!mGo7w5{HwD4WNapd(*A?;1u_0;P&
z3)faxblfdH?CZQ=t$S&P;nL~096_dGnakPPw9%e#Bjk-cZkpCy+EuojVL%OQUva4|
zNcZ@6?~7f>8))wGt6#q|r*oM+xr!D$*9NlAVf|8MrD|d{Q#HNluvOwZm+T*LH#86~
z5Wju~=w$xd^dH9O{}h==5Ti*ho4yk>zyb&W0)PM@00;mA{|o{v&FH;TroKZ`Q{h4k
z>>m~?!opK3s}!Iwr&B~;-ztCF#(%9Ct3)CKP<U-D4)xWqB3NVz&%^%zuYaq?g250L
zHI(f=XrIT+{>U-t=R6ntW$E5|Zok8#*v*Vz&vHANeu&|0o80c#DP$wwn2!%r<HzZk
z6&@P)L+G%e^nI%Xg-e#Nagh02qlQN5PcYcniTT-+xL-sKNncEW`X4{}Vt#A>`7Igq
zng8FJMc)^le|K(M_KQ~gNyYetf)TZQPaz?dmm|Kt{ZsIIYhkt)k|Er>u6=Z%Z}d~8
z;qfJYsj~Ht1;#wXTEiLPv8J1UoYYL;(t4|jdPC3QQF*IgP{hi0I)%rQ?nQ{Y!Vund
zjoO=;a)a{q=-<37nK`(qOC~&L|Lc-*uCA|-b|3V&o5&>F|Lf|k$J9JXS!Q@;p09Rj
zP0YS)s(#P6sl@uvs@XPS!O8LamMnSUZq2KQyEjp?hC`G5+<AU;Y%+^I@<`iSl;%g4
zFUX7?-cdJ>+U>e4?Mif9aQQajtQ`$4@#U^smb2gK1mtPvK2_grnk~rI8e$k0{MtJu
z;M)TfJ=-{O8Q)TGq<rU}h#G1YC%4ak-*DodAJ@$~>^W(k{tB|GPq1^u{noWvsr>y0
zA9j?FSy}o+d40URl|c=8GV|aFNS$Q&R9E0~IpY2H+dpS6$@w{VMZRL5Q&J6Yjbf8|
z`iqS!yxkX{$xb=&eTLoQCK-d>ssYxJfTzn(7DpDP-8mH3=w7F)qDRUoiO<-jkBa4L
zTay9?+aJ2(@*$p9vWcV<THs*+E_CLmm8DMZS7XA>{qG*k6eMdqw=$MnpBlqhm;W89
z>_GFR;3GE*ZbsgoBpBzeZlS!#yJo`rt-D38wOd=rZ?38a=SCkJ@vdeODNweca%6jG
z+uj#5oIA9Ps@w%7iswqmClt=u+2IbU|7ShsB?jWe{@M+6SUiZ<*PHge*ZUvvrr59Y
z52QE!>V4r~J6IR}xgqygo)Bd@G<YsNk@lV0(~u#-dWQ~#wzAVIk0dxuH)q=a8&MsF
AssI20

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/key4.db b/src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..2118ea3a456ae43f7537af0d83c3cfe04959e6dc
GIT binary patch
literal 45056
zcmeI5c|25Y|Ho&{*v6PavV@FDS<~!Bi!3RMWJ}pHV@t+1_PvRa%3eg$q9md$r4p4A
zxrtUqg+j}%B&4$ZW(K#ryZf1$*YiAo+`r%NoS8ZEJ=f>DzUOn^*UWY1ob%#XS(thT
zx}n^C>E4t;6doi70)s(%C=>_;f-_$t%-7r`zzm>s3(R-$pW=TN!a-WAhD4F$AR*Xl
zkjO`5y-1M=MMM$S30n<2_pcfO<p2SI06+jB01yBO00aO6|4afjK|yH+1u#P+kV2)o
zdAkKt)=>f}bMHcimPY#4Mks5215+c^Tq#P`(-pPF(!@;Payx31(RP&0W)lk=Bb51O
zl%e_N^`<6<)+kG(EvEX0Mw%$*FH>*q%o|Q^g^+->p#m7>>Er4a8sJZ3iaRJlfxhhJ
z9dr42VCN!X0|5bPX(g~dyMl`s#naU%AYcpKGnf+SCOB)(Wb-<sZ78<LvM^r(rAonK
zaB6z|>>Rf295f2mjW%CJ;HMmH@s}KUwe?T|X*nhEjv3oQ)Lm{af%7@|f65UsBma^G
zi@~ZHLIk8`=eEW(ARx$%KA#5qQ<@p|mn>wgT7o55P+Ca|ob1c)viSt_5#Ma8nQoge
z=cVKH4a_aAHBl4{^Tq5p3Xb{0vto7us|3p`BC{6BtVJ?=kyV9EV9kiE8HqL1X3fZ~
znGS14Va=$_nGQP@W@gULh+*ZxVrJIE%7VqP(qJ*HJXj1X5f;PBgvGE@VKJ;+SPUx}
z7URO2&)S>u$IgtKiP@QP?94cJW*j>+j-46D&WvMc#<4Tw*=_Ocws>}1Ji9HP-Il~w
zNo<wGR!MA?G^4UJlh~QH*)`deuxv~?_V(g1thPAz_Tt!{@$7OuyByChC$LKh>=MFk
z32Q9`3~Ma}HW>n&41t}Wz|K!#_XCmLmdI{PWVa=<sWNk7FgPr0<+CBnJ(*RCVOMr>
zBjO2oBCEn|$f__KverHuvMkJotgW35S(`i?vWU)xEUYsjo6l@G-;7OawsgK3=}*mA
zT{2Tad)|ZgoCngpUuHPxml@90WrlyMJGWwH>6~9?IJaVEIJaVEIJaVE$oi<UJTODn
z=WRA*eduOG*ZI(GK6L*hWPfO8>Qd+JP+4|di4=@06@yX3^9e|AQ2JK`<NP;x2X;P&
zF!v}zti6gT^92^r2Qi<(1P}lS00aO600G_!WUK}=AW%sJg8bJuk_>qQ0>peE5Fijj
zLLv?hl89dvCo}h$tIyO~)&7Gi4z8@lH^@u?0fPeqXe$ET=)rFE<#e}TUoSUTEf;zq
zD>-I8b}>d?0Ad3bfiK+R8xZJ0ceAoEMFqMA1fl|hn8y=XWel37L*Q~QzTV!xKFfWW
zhcjA!9?O|oS=F>yGfCO>>`V>woX);M3k~wv(UN2XGcaocod(%4pC@Bmhpj7KN2_%Y
zZR4+O8P*Z84-u5eyrp=cOvEVkfqa96<B0t5yDuKK8H=V2&5wt)<X>-<xwP1L^-0mz
z@ZcdA&4JHr{Ef8ZZdD)Hwo$V&IduQauKSZ^O836hsuy%LozV1Ot2<TUan6q6@cd|?
zs^y|1gyv|irfW}9e23tNGH8~;?d7_!^jmMM+#6aMQc>?#-e*}|zIW<e?!LBX)!ncF
z^M+*y_fDtsk2JxZ4f^Fy-`HCA6k(u!{F=Ys+3>W4u499*mKb8nUhO?Td2YOPW4WHT
zYI@)91?8zeVLDG<zRe|@e*S=w>=t=)xMaHViNHkVR?<SNXyoYW&ued<WFDe{F?+zV
z7;gb#^?2j>ucBanQH(Q2e|`~;AwW?OxkmUY5t+Wk;%ZT){E$VykEIS{cfw-ovzG;%
zXXd`;1B3a%C=5(MXeJAvFh)*5*g4)9>;{2?)u9NDb1faO<(q=*!2CIugU~%-vBt9{
zO?6+E>0fTf-WymGtnyo)BKUhI{_fg_IEBR1*54jwz%ndgj#gAt`0>m;WicTix}=`z
z$t{2NAT1{fr~m#*iA;3Fv+4{L-}Y{ISFutPt3zYi6Ox+JBMaL`qRo1mGU`wpo0Y}S
zf8N{j{ml4^f?}LYeF(|X%Sru7({tMm-bn)bWw6uR&x`rFniQF7E7^`$>X=?H_`Z<7
zv(2uD|6??2BJljtI}-7J#4<}khkAI9vB^do<??odc`rEN_ayk1ur#3q-REux-@(92
z+f1~6+kfnHqZReSMpP@jVACjM_|<wz>bjl14eO3Y?vhTZu=7j|{Lw?ydXo{hR?a#6
z9pU4hFuv>X4)Iz^uyPTz8~C_&!-ar#%8!NKoP9Ilp?@L&&c(NR7U<&cH3RL1S*k=;
z$8@gU@Z)Kp`R&F94^0^5J|I6RBX#=wYr@Ap2I~)Q&R)?vMJo-Wv=(12H*xU}!I&G5
zIX<vCb)@lC0M`8a1ER%LlZu2M)?zX=O@;sIc!oLo-LBlhA}i&yi3;M(ZyC|;;t9Re
zKe8VpUX6z(6e`=k$f2FdIq5m}0VLJdpF$|SR+rn*E?x3tBuYrH(LZa|r5$VZCaS}y
zN2A6A3!)YHFEHA3d7+Sc@x={(dd!`6drQ8(s=?7_W#%iNsydzNCs%eS$yE+;rEvdQ
zYyPSuX)naW!0SJjF)4gY?fs#HP4h5P@isYpV`qukn72!zhwPj2GJb4#U)C;=zD@tz
z>zRUYV5{_g*rvXIOYW_-dTimW6DGtEw!C`PzfkfxDM-2g-opu9+o-Ktae0)*aQnoQ
zpXB;`9EW|1)l*|etwvf`8b&Vo?lTNl>x?_NZ$x{8y6>Q${0iCu?CV&2QDsN#w=Ra$
z-eCzHS9zh}0r9NN^=tib#r^({u;vs<{VVwll;R8V0;9<4%!K1QTq!L4g7DpXw1-Ib
zbQ#;)z@$){A}Bc`wdehcv@IXK&dOsFLYMKIy!}ypenDvS>d=GFe2&O$F!U79qy+}L
z$jh78|A1bD25I>yK|X*BuO8HVtob5V<DHPSQHb}Q<jPvb<EqCT>r?!5g7#!9uS>b=
z02L#+oXqnR|GIYVTl2yc|4SMW^{0*pOcx)j4~yyLhi%)Ycq>mQ5JuO@T2H!uiguP4
z3OOxRJMWryRYlh(ruwxNz^*jIu9lW>37~mpHnz7sUc{Axxq#pPC$39s(jF$G4%#y*
z<XNA(v)%P8|CXpXp?EzFGtWu&UE2&Fmw0%*iSfV-xQ7+p7&~NcmGVYd6I?a%HZQ_n
zu1joU)ymgRTG64OIxp?utJBEJ&O2#%-pa-LbYe%}H-=2%s~_*jvZjY`o!DT1tEk`1
zL@ruSNBnGOhNP_WrPq`FXI%`m3;I+H0%cZW;P+#fRvJt7O!zr&zItKXdR{1Kht^IF
zwjIjXRRgz=#|~*{=ml=8yk!^jy-V|ho%EC;R|?G=8*A?pkDR#sc6|^elS#oLKs>Tw
zY}2~HvBzq^o9#6=$}<-Zl&`f`>Ph%rrQbYKY-^%>TlB@&Fk8M;Eg>uG{Zp^nUUsF1
zs?##!-e}aHQgXERynH!4IHohwdn7>N+(7R6`iUiU<oNVCvzsSckBB<OeZP|ee$$t9
z)8s??$>w3=c-ul}#4sfsFQI5@G0d>tb!TKz5?rgR;$5Bib$!<LYw-W~oi&UFfq8wN
z`2;3_06+jB01yBO00aO600DpiKmZ^B5C8}O1pbc^5QIR5Sr<)aj{he>$cg`B8whL;
zKmZ^B5C8}O1ONg60e}EN03ZMm00;mC00L|R5C}+k=J>w?gscFd00aO600DpiKmZ^B
z5C8}O1ONg60e}EN03h%WB47$-$P53s{+My*_`e^7?EeRCAz%d{01yBO00aO600Dpi
zKmZ^B5C8}O1ONg6fq#R5EQBol_x~7a=J@|D2>JHkNDDLp2mk~C0ssMk06+jB01yBO
z00aO600DpiK;R!mKpH|2{=0u%%+GWQM*d)V6`6VaN7)9<00aO600DpiKmZ^B5C8}O
z1ONg60e}EN03h%m6M)IEuK%luP(jEM<VvI*@)9x>`52jn+>W3i3=l66`G^TbEn>H5
zqNpbVD%yZpBHAZf2rq-DifX_IMK_AV;jJPJ5voY7$Z<FcE+g_?qzg`mTmQ$#fCK;m
zfB--MAOH{m2mk~C0sw*kr34m3^uYn19y?sz=z%+M1e_ZN=jOI!=H}@*oEk?NqpAQ|
z%Wm!E7B<(|^^e9&IjI<BPAX{$CzXiiq!N@ksdyA8m8{4~)n5Ep94<O|Hwu#-`yT2#
z3LIs!JSUk-l;b25sf#$tRDvugnMjf0B$F`Gf0e03GFJPK4U^(1lNWN5sYFRmGLgD~
zlT0N@aFU4>aZWM`BlcHW$K4H!{bR$B9Az?slT0Owa*~NuI47A(5aA>fDKJhl2_yVh
zne2*p$N#ZmLL6nXASanh6yPKisr;N|Dgnw#CQ=}rWD<r?1fn49M+pcB@uj<pGDlSz
z&|VO78=?Y%5cP!LhAWDM!ydyh!uy5#h4clF3Vao?<Uh|Z1a*PbLS*>@!S})H%m)9>
ziGh~k*WV)n`tvaP(-)tDVeG~@%-=v5fieH(e!?Y9=hqCJANuq$q*!?MDRlQ)2QnRR
z9O-FuOZ79VEgttbH>~{Ay@jEuQRL>A%1(>4O<j7In{~DvGKP%p%~<>9dwIg}Cef4S
zHyLPYjwVSM9!y3QWTrmzDpJ{-uHAXNFx{8mc~sBeK(y#pt)8QJf%b3QOn$4{@OyJt
z?r}#uMU7``8#@Yd{n=}!7?0i#-S4lAu$W+=rG7E_^GL&k$vYihS=FQA@T5=yBh$%c
zUr$D4K7mCHN@R6khxOl@Hs@yY1^z*#YSNjwXUoZDOA~{qQ=?Z6iw$30jO?4F?07uk
z$3QRSY?91_$^Aokk&K?g`~E7uEmM~HqsQxvzI;qfQLA>h5wN}uI>pW8k{j5Lx^Ih4
z95L(6+jn4J)sIitCn#nC2YgjX@AVMxjTvZ3jwY!@9!zG_6b)>aS(%d0jwcW=y6S95
zS^gk@`oN~>QoFVvle8XgCOeHqwN=c*`J%k?TX5>tMWctsB^%25b_=D(RNvN2-OoTT
z;AoOa<-uf7t=UJ(TkjlJfa>?wI3Fy)J47mWo^g`c+GsfDn_MTw&1A|&!@?i|Ez6*`
zf<EhtFYYw4QfdxjMeydcSspcm<Et5H363VI1RhKp=<1!ABIDPYI*<v!^~9f`1f_!@
z9qvtrrAtFC-dBinGug4q=)7XMvB`E1`QYU4C18)&SMN4%yA)In@~VkIti>_V;v7v9
zc^QI)Vxt_pJVtA&7U665I@iDMk|wK%Tv77EQ-)(!7f+n$W->DRLWK%$5_Dtmz1$~Q
zN@mKd``^AOi3hFde`qc%COgDHi*Yo`(-73OG~KpAYr&}`4-NMVmY_*3OKEeF6`28F
zm2(fG2b@~DnKU2l6yAJbjhZI$uDyq;&bl&+=jGH=ICgjRODh!p^Bx8o`HRV)e-rS~
z-8PT9pp#F7v$m*4KE&_SuR5%Lv&uAZ?a|uLyXq<@G;+C_EGk^u$4{m$JO5fummxq(
z^DIz#9<4+UhE0Z3w;=JQ3^anXNnVDa10}|JA+VyY_n^n(jI^BZCD@3;MbyXqHpM$d
ztPGxDa5Jg2sJ&@rOPl8TugzikNnX&c&A!$9_m4dvvhO^7xb1Kc11-wYBu_&S1etg7
z8Grvbf2xdJKt*|2$Z}=4c$m|`t)}K?+(TJ@ZYJgF`)v%6sdtqo9o$ioI>AFp@8sax
z-4)M25Nirb-4qyTI7gE_4M92wzlC<}4Hxf<ik1qcU0eJ%CxN&+^`lTr2K<9@HJ>*(
zlMxM8x}$Y^>Y;QCsa>5Os^6=qzQN>esCBSi4$1y6i43#|N0U4aLCHezibq|aK(-XV
zzmA~PSyNT7Hy3+Fed|@XI-CTKsNrVP)Fp!?KHPy?Zf$b2`IFS{NvE4zBf4c{=s$Fm
z*E}{(W1wLiP4YAZ4cl11dG3=YP!m+xRAI4y#p>fiSB}VhzMg&768nvAP{_^XnW~*(
z?+&Gu4cz#!nQ$sHY%jzARPt-t$?%fR#b2^yn7c(`jwX2;f|jVkgJWr%Bfg}{OB^=%
z&E|eQNpSpzwuZ$S{!qQGTdcX6yjq&O&GY#&Wb4c4Aqqt@E1vEOQps$Hi?n#Mz3GD{
z-!%qW=ogbe|9a<P2pa#goVL%<_6S9-<(LmCO1#(-MEqE=DynW@?h^sQGpXE6s_!7)
z6-%occ<*G?Vq$8W+<tCjan*?NcjtAKjBM(V3j;04*(5JR(A)Bkl7o%(SGSkfA4#q0
zg~X-XJu<0z+3`KBUfO8g0w_0=XLPb&+Y9#ggl>|&v`BT}oNmA9=vdFLf~d<E%K7U*
z3oy_E98K~x1ev+3>fYPaMH`ns{d*rjEy=4!s_7eD4IffG`8f9Ku10Pqop&DkgspLI
znf@gAS}C+pMwM}Fed)GmNp;9Q`8x%Veqf;aIhy2Y2zt>eiyt#Tu-o4ywm4nS$!0f{
z)ONxeYAdFm&5zR7yT#3<k5|IciqrR(`Id%lQh4$}U!m=!p=_9m$>N%4O@pxQAO;%B
z(Iihp(AeVWtcY-|{!QN&;ocY`bXi;P(H$ka`IWKBqZ#dLS=>xozjDd*{?QwJno{es
z!Y}wlQ(*Hkl{00Acb&Gb>US0$V4xu!P4YAZsedYaxhf;D%lG+k;wd|!tzPyt#HyDk
zyd5-px|@S0nz@;@aonL>+vu<*Ej{yI%)v_m7@Eb@xw2!agzS)DJz0+j3^X4{lROPU
zQqPA~Pd>Jr2-?5gd;|5Fvi``r@5J_osjx^Xa0Pz9BR7-pA0*StN#dr7LqjS=!F-GO
z$@Yqqm1AR&51{J%<9;@brC@#q!XC-F<7~tAPXq0bxWzTDKDgNBTd(Pt7XJtggMsm$
zKd2SOIRA1`TX+9zuy3l%At7?aiNe8)uph?4U-L&scdgzTY<Xj2HtcU~$_WTN#~Xv)
zAW*P66me)NWWgr;M~4ojE2QO|go@=%e^pY8{i+ykkzr1EZc$|&|04w)K}dVVC4{&r
z4SpBCL?i~*3DXwN5c(vvNw83mk0}EaKmZ^B5C8}O1b8RFK&$<-r~di!7Z1O~-5Z|j
z$Vv)sQ{B>iW2)rNi=2uro6HxF@@IVXY!Sgk3H{A3@Tc>-;nJat?Lyi|F7;<x=EjIA
z$~@^y_q=UWnGznwxU_lFfq_=#Y?7Dry4w(WbS;{Tc~Dhnb-PuBPHFJ?mW?Vay}!7w
zy<%Ugu$`O96Sdt()C*oTY{G67gDxF-z8pOgQu2K|)aiB=CgH@$d4|$b{<X7b$p7|I
zAP*qlLo0rxYf&VIJ_vnMvi79B&vb7H7N7d)L+TsB>59j5^O$h&g2}F<!MP-t!!$Gf
zs3lMC>V=uSTN8V^=E9LzXg?Z5NtvTZUN~w!PHQdq%Rh{qpkIt@wUHjmAZuaGWKXZM
z@$G3ZaTej`aiGHXz$wP6k=6HJ#&=z>T^^ltU+C-}&z2iE^K?5dWMUXfOE`KY@xbxX
z?XJ%|U)VgqW-O*bPm5ZDsVOOGkd^m+V;7Ph`cj9+%_Brn$DxcgqMJH3d_Qw7cK0Be
zR7MXp?4XZPgmP{vcrujG96j=K;(7H!k+0o@sSkPrXu;MNAtKXtjfci0?j>uji%7D+
z)xVOPN4XaS)%P_oRPNQ+?31nBFp&RLCWtS^ZaHQD?THk6N;pGFiK9nePU%`<W%Qpk
z#-5Ijn_OXH@eTSCqLbX*>(~?Ld3M=$Yl0d#kC2wlhiu?yo=zp@8w}pIA5d5n&^c=I
zvY^snmoiGP{~<#O#nB_4hrV{&@3b-_`L%7k?xv^iJ+V{oq$C&tZ}K{IcSgvfA#HNp
zJRWZJ>`b0qtRG41EAX-XO^Od+l;fp1L7J$sj!!(1@|2;Z$k8J&=Ky>xchrx*F(6#N
zaxA;cPWy2#^3n46C!+7iJkxXPrm<DrJYF7G*rW69^!Ibt*S=yLJeJ}=x5@WQKXbWv
zF7a8?sO%nw(qfJtwRzx3N4sBJd{lW_*db9ivt=vY|0Z!)#a;eBsSR=uu3h%!%JEL4
ziT^WyxRpg0LME#?&3xtU)3B!qJ6&XfO~QVQz~>CK!Y_mPPgf9icrdx_SWa+l$B&Wi
z*6kt6&o#;)E{)iUv=(&0rqv}^Rru?31DQCPx~~WAleIy%RX?FH^x)RwD``cdf;kOK
zOj4!pZ7*b?<vE+=rMClC3r}GoHs_6sJW66SFm@t!m4}0mYB)g~E<M0DZvVi|<lSDM
z<f=8*_80d({yO2>p(B7WUSTh-5Opu(PWB4iw_*lbj-yGQ&iLHiGxR}xA))Zbf@u|$
zmE3`gD#q(KgA=YK-qMU&Q!&7GcW4z6eBu2&mH3ZVert}TVzOnbRYf(kU7{p!SNO<f
zZSQ5E7jZPn(;1(s!cWmBDdzqbTE<8X!Qznmmqlv5ds~hQ4DD2@BX?ADBRPy?9M=)*
zP<rlq8Wnldr3Cf}7j!ksQTlVOMwMt{5|)9M<!F+pGd@<6FB*4yWu+Um!~2$56ZXhN
zKr)`L+pQS3QcHO0^pYrUCi#vPJkKq?9m~)Yce)%e{xNB+P)la4ww3;S7+SH&K<s}2
D=yu?q

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/pkcs11.txt
new file mode 100644
index 0000000000..c5e90c7000
--- /dev/null
+++ b/src/test/ssl/ssl/nss/server-revoked.crt__server-revoked.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/server-revoked.crt__server-revoked.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/server-revoked.pfx b/src/test/ssl/ssl/nss/server-revoked.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..a8f9b0b15ba6a5006772309d60546ffcea721ac9
GIT binary patch
literal 3181
zcmV-z43hIOf(&T_0Ru3C3@-)=Duzgg_YDCD0ic2mAOwO8958|m7%+kc&jtx9hDe6@
z4FLxRpn?X#FoFiW0s#Opf(Eq)2`Yw2hW8Bt2LUh~1_~;MNQU<f0So~KFb)I=B3o6=
z@E&aA0s;sCfPw~y(^IJ8W%zIM_ELuZoV|wYx<Cp6AH)ULVa|xj+Lj1HCi26Cd%OvA
z_#eUNj-YW=fe<$+F_&h1=DiD=Cbp&R(KDMBe4E^n92Jc;x*6Cf(^H5F7ZG(5OULfX
zNCCk_++kW&#eFj;KFXz{94peL8f)fIO-}B9+IG6NKOW-+H}(RA7?!;G>o;O2*g_!i
zddygn6?z#r=&{^@(lHqsR-|!Kd^U6&Zrgj14+?Ey7Vi&Rtdgm4GB6aaBAuXark<cE
zp;?r4NTmCDY4?x#`K1Ex>Ja5vyxl7a<prv!|G#v$V2Y1)avT{9$3(8V*D(%I{>TZ^
z9MrlJ%<xoi9NK8B!4E0QnSjwNR88TU`#e{WRDk5HjCb^rW@RK0(Ywivk+zLcF}9>b
zm|tW5tWFdTJV2RhlR%h5Ws2F4oeaRBlAPKdXzZA;??{5hmJpXUzJttZ2+9~K&|wbj
znQ@<}drHt(Hvh<X)?3W4&$^rZuU3!97QvX9v4vG6%bXWH<*6@^d*5-Z>b~n?=)dwP
z<c7>B<wp4M%L)eL996BpI_k%OBy|(IKWUL19%!4<^0fq9N#p3(@l0)RchGWLp_Ujt
zf$Ilrv>**wl^pxkjcBay58s0bO%9$|P-2SlpGR+-0Sm!jib(6V5uigtW;9<ysgVFZ
z#<iZzf#tF5si10|@(SslK4p3YzVPIFM=!8X<ndl)l)C>mYp7!y0xt+ny$eiFwoRFJ
za@S+%0f$mGKi|SwSZ8NIH@P;m7g0Y4dv<7gczzpN^vnJYw+Y^1fR}QY7CRqzZyE|D
zyelGM3JCh{C39jgNIHE-Ls*q@140N|8*F#rJqjMAv*O9W^F2M;iZbZT3^~5`oOK5=
zgL#m9&}X)f-HOa%iZWbIT4!R!QX3O$S)J?eg@E9d=LR>3Iy6K3zU9&;eU>a`cR0oM
z#&h=iWE7I1xo0P<RYL&eWfpql67ecLWzTuNwv~71^Jgw4OTJxQTpcS~nhl7)mFZZu
z7#P3bvo_DtqeiTcSEgYX<nE*pFMrTe@oE~^#=ADwuV6R%2+2MHFv0q-klacQ8m|)t
znK-*K8z2-TnVOMuQ(1zvU^PNqPS^iJ+#25sfb&r(Hq81L01YOQ^>+5~f|^H#Pj4hE
zhwH~9M5fKSk$unhmIDWU#XuDP%S4%-qNsDpW`rfA<0_%d)8q6DBQHxc)jfeX1Ww-X
zwVaa*mqVlUr!`OStKa!^M?YH)2QFi;#Z^@=D*OJgS+R!;Ftlhdv6{pvqy%Y<L>dZW
zg{UCen-><v2W^mKl=Wc8gAF$oIy#cVgX$W5dBE$P%Hm#^1aET*l?mWCn@wro$y}+i
z=h|RjrlTMfS*;X^9zEXD2aw5z6PD2<xeIX62wH<8w7sp+nfy<kSd+%N^ftnH(c+i2
zLHF15s3!AjZO>gC7A(7%-2{9Zt3i!28)^?-4ks!2hC}TfpSXWxUjd?E+J_%NsSY?O
zjXa$r!?)wD053-!`cuJeDBLtSzK|vSW=$FV8=(=dSxZ5V@Y3V-<P99a-Vla^Y%>Xh
z&q<h6ChulcJZj*=<f{2!?PAVZ-igaKW<S8sZ$OWpp~Am9NDRw$LnGNpUMiI*!FnJf
zg;|Jm$4f5~(SWN8v6~hfr@kKvTqFn8mcRN_jQ=teXa1gZ^gKN(std{w;U^z!0JCT<
z25P_N9k$_S4H-ZaYEBAl^lHz$v?0;|_D7J!w@X7y$k=b6aq25~M6c^(isyZfIQ|}K
zxaK@0TEq8Ggl9Thr}>&f$XKAlA1lr9tb4&;P$U8;Dv2ZBubp9pV>@*2#j_g4?nnxU
zZ9BXL%77fe>jC;6)8Pwup%^naeIZBQryZq|DYb{gitVVYsH@HD9>cAdN&srdcR0Ie
z-Brpp2q8he&M)F}m=bo)8?N*`SHXlW2)-PK1!)ZKr40|6S!cM5Ti-jHB<=Oij?SM?
z%2D|B_^z`B4>+YmIlsX5-KQ#umy@S>O2e*ruY}wb>)6eMD^;FvePndab$F&FaGA%D
z0Im?d_j@7#6ITinJQ4U9*um0bry$2Mw}RS=L=ic6ejo1z@(Q~sV{m+2mCqbLJfe$o
z7HYx^d!OPNL*@a3sPuVutq3TG33$ziI9w{6e_Bd`NoW?Lg4*%0`~R~^S2mh!I)VZM
zx}9pzXKG{hsL_}y4v8=hsN5?4FoFd^1_>&LNQU<f0S5t~f(0@Jf(0%xf(0rtf(0f9
z3o3?4hW8Bt3<?1Ppn?SMFoFc?FdPO7Duzgg_YDCI0Ru1&1PHrwISX(dKV|{~2ml0v
z1jx@dr#lF~-~{f)HdBdy(q=0UrFolK5%1YmBMecD<xwH9ypDfOGl6b-jck{na~Or5
zrsrm~tN`9NJ)-VCMO^@X7wp&Dsnm1z2|R&(y~<n;k7YHhSY6Q5`}I!(D}S}FGVaf+
zFoKSy9uHk({IQ<xmHr-hiDc08E}ThJXd?G(yx%6ia)fntmIwL8wMEW;`*81K4R=qb
zit~V~&VmpbWA(wF#U9iiH3Pbbo$sPXuud)VF~P-H9s5rSow=lkzaII5rh}v=grk=E
z)%7bN&Zj8+-G4Ln5H+P^vc|J*dki2&dqv+X;9cc!B#XM?ingc|5nsL(T8xalUynjA
zd5^<JAW@x$JeJWb*Chz=mz$S2zBpi{%dt?!DvmSblVEkd!e}@s7fwb;BO~33x#bl2
zl<|9(Di{~!*NK$`G5!3q-+QiYxGL0sxMes<d{SG1pgm{8fJzI=B|1<GJ?G2_LiU=S
zes;@wK|LeD&1a_;Q+!@sted2crC8!oOoeU6;x%XgowpH(XIjoU(OyXyAwEvqBXSu_
z5=FNzb@vp4q+lmDsttKB@X*T^*JFRFH)C&dJA*?~z?q07yiXh5%l|>63oc*vMBz_b
z<UnCDP_0SuMMVxHFOYr8FmOwl#wo`F)X~cx);5G78ia@#)_zE(0Jj9O=x&^k^$%*5
zbnz-xqghRV4*n_V{fWxG*UiPj2DU?{v0OO>)wiD_JbvZ8S+u7`>s6vM^4#XJo3K;^
zC($#MzXR}T9GW3+Y>To*sihO3A*r|J=Z>FyJQPh%Uj_cRX0D5xh>cX?eYgy`BHKn4
z54d%=S+e_*uSV!BzNU8srd+1{;M;@Sho;gw%#ei<cAf8gfui7=Al;Y7zj?kEcDM3X
zFx=&#1<<RbEl!Q<fU_tktiLQ>eiBxNl5P+o%x*dWy>WeqJ^mloi<`mcc~GC9uM`$S
z3z#v4h#f?6+t41DXk|?~-W#y*Zsb+fgx)^8N)w9L8Syi4QlOgcg|s;48=KCVts=o}
zzJEbf1VDfnU5C^WD2Iz-HBK-rxPVUgXs<iPZHA?4qF>2>@k`j|0wZo$-?HvT8Z=~M
z3bmq?agqS>a}M~ZDQic8*5l)1-($zHkc|be?Jzfi_dM>4N9Zn^G1oc%X(5{{yAGhI
zIH?%v9lfnVrg7mKa=#S^i(77ptE@Z!u2E9Z`_Ktu^6Z5>haf;6xlM1UIkID2*uS;4
zG?sp~)mkA!P~>OoC$IN@$ZZhgR6;No+vdVOXe#!d&ZpbjmPD<BrmeL3h5XT9UA~##
zHsk?l;MoZ;(j44A^1?VJ$>9L%1VOrh?h}KHgBTBC8tm5@!aAI$+Lc;9=99S7G3d|E
zp79_#k5PsRtjvBMYr?)*n%X1UF`Q9W*@dJk>L3Davt4;X(s=%BaYa3a2`!GbDq&mq
zal_7tu%j&BT3g>p+W?q%KpZs0gcZ;6?|7=8#ID%=wr>yKUOA3(i2y31mM4qzLZDf|
zxVrt*AeWVW`L%R@r2i!Sn{CWXx_X+a*QWT-Y|zdrB-w=cfYQ~cy4%YLeua^zf};a4
z*63^r*kyNgh_+im<o1%Aq1cs#<vMp5JWichSotv}Fe3&DDuzgg_YDCF6)_eB6rWE@
z*qumDj5_Y&(0n4-+!2xyPB1YrAutIB1uG5%0vZJX1Qe^(QTQsIh1Pl4Q;M|Ctme>e
TbYKJshg&M|@u8^*0s;sCT(as-

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/cert9.db b/src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..7f677ebc3519f47fb1af0393737e3c7751d568a2
GIT binary patch
literal 36864
zcmeI53qVY1|HtRdt)|;4#UyP_7rN+j=GH}Sm9C--QIt$IrhBPLSY6CY$d;r+2t`qn
zOC(uhL#|sZmnB-ajoM0XCGnnfW>Tzu?fz^3yYKrxhjZq4p3C=n&gY!-Yo6bEW@d)F
zOR$j7SP&T<&J!}&1VsV_5hgPj1Oh=0U1{jrw@^@n+_!_iLIdpIGvx>-Rvq$i7lA6%
zOptvJ*T|O1hR7PCJ756>00BS%5C8-K0YCr{00jO*0+Xp!I$aa;4vq-qFAfOh1qVjN
z#JI)!hXn^n*?QPn&$MGWO`l@t#lZ6zuG1MG@)`O(Cc-k9NWm36afL9RKR@h43F=1*
zc;2T9Y=bFeDt(kD<crsjiS-ZR2M9kXP(D(S<bJBbM3@HFBr1Jm-*E)T#KiKWKZuY&
z5)o&9s$s!2NO6Uv=$e{PTDXwsAIASs{ewZ2=*+aXaj_f7AvloX=HWEW+QXYM)y|vY
zIo-+K(++FF)^)nQi<9k4hP92W$4nyz4?$NZy0XxfjoEktmcqo6EU;Y*Y}W$c#fn&P
zunia6m|+`pY-53KEU^s_+xVj!OI!*OZ*fHg(_kXvb}$ttg2^xuOoxeJLQDixVj`Fn
z6T!5Y2qwlv0<f*5d*c4#$}F*sE3<HA7Ou>~m07ql3s+|0$}C)&jn`%4b=i1bHeQ#F
z*EPd)&G1|^Jl71*H52FJ%4WE-IbIT{#KbYN@Z)76SX~x=yez!WY&@Nfr?c^N4xYln
zQ#g_otQ8J|wZg&4aBwmlT%UvMbMW)P#p`nMx?H?27pID9A_$9#H7+r+-dkX)2wpgV
z&t-GiT&#e^#0p4EtaXWrbwOfcM=LS0Lzb8rQHhCR6`MF8iP>KbCnZVkuVyx&8g@#=
z1<d>VVBXgUv;O{~W?z3%v#%^_4k+8#Fq+!eU)1bt7&ZGEM$Nv4Q4_n=us)zBcD+eV
z?4pyHf&C`G-(2v)#4j3gS^xg-_+#A(<noX}e*`gL5~*}MO^6_NEepfY5xpNTRv3xz
z`+c~t{g@w266$KDF?Wj%>LIuXGil-%%mfP{00;mAfB+x>2mk_r03ZMe00MvjAOHyb
z_Yjb#$e;&9gUbkT7u*g%h8y8)@J0AEd<;zj3m^ap00MvjAOHve0)PM@00;mAfB+x>
z2>eY1q)B8*cX;Jm8g8h#luApCeNwog3{R&@jA<0yP`c$!mKa_n+)zC1K$IepX}XGs
z?eX!yd<8+i0v@f<sF0;FO@ShR0zL|d|4j!7ngs*^0YCr{00aO5KmZT`1ONd*01)_y
z0GUL9Xb$A%iV!lHIT0C8C3%uba@?8x7$GA%GE&H}wZ=Zw&2Wp15elODGu&MmGiJCj
zqWS1fOiXZO1Ve}wjfq9)ic1fXj?@t8P=`o|GDJG$A<`i^k(aALhz)ZxGEscK%<=Q}
z2Tv70dJ#XG5x|cY#t<D*CE8FZ;p2aW`vkZFUI|+&JcWOPCn~hVsb~^d00BS%5C8-K
z0YCr{00aO5KmZT`1OS2mAOcdPVbCtZ92yoeksj0tJRmHXA0ZTvz@;#`Aq!MsV&p;f
zEoMM;fP~2rN0Z!W2!pACsAI7PS-If@LP7npAMyNu5dmHgm%!h{cj4=B6<h$Xfkpp8
zrx<h<5C8-K0YCr{00aO5KmZT`1ONd*01)`c6X=UiNM5CtNMj&zq`@zMXA%%Cl#=97
zVUjk4&Fzq+QzYqRtcG~}FUcWEa)??aM_Nown5j6|I3_qk5XLv=g$a!#c;S3ZTs;1d
zBES#e8n_T%jYa{|;AS`qzVMF+2RaA{00MvjAOHve0)PM@00;mAfB+x>2>fFSsFFBP
zhI-kF(4JGr)3#Px+4>ZWO`fCpSUf!e%bgj?d{DdO()8f7zn<MgA-do3_->JSwgHw)
zEpc(RwKg2yYDYZtRJy2l;o5*03O;=R%RQdi8`=583_q?9T_x%~BfqdYo*<qLKqql%
zpKDhhB}IW`39_{^r>RRQLe%_UT~;liEF-HZC}<Pbx)D^CD_RTyv0RZeVDEQKh2Kg4
zW68S8@HDg}`tyqeVmye5q=ATt)a@i9L?o&xO4Ieaa?cbrOmo)X>=riuT*LGkh&+{M
zxYBXuYk3Hgr4R=HaUev4E|31|2$N;bWTU?q!kI&t=a?ZJCP%V61TBal?Sb8fC<KxS
zf(eKSk|Byv0!Nlz?_5LPv`{qO#7tD#nkKD$=bqz{7mF7)38)L@eHu5;&WF^_Wd)me
zoj%Sj?wN9U_3K8p-1z5_c|?~uD_%06y49-dt*qbpJ$r(+cyDyCJyuQEKV9P1deEGv
zv)G-MIpu1rYFXsI*yPo3$gYzg<)zqbT7}dskCH|zlAroyU+$e}aW(DRH8s7hhpG>$
zjd7xecCZ3VURQ5SFLwO#n5bc6g520c(6|~+=TPWiVsnbFjV*iPPG3`-xnnE6-d0`+
z+Nyje<yKQu#}Z3@rS|LEo2UXvm#wF|q3RT=WM{YO&N9<s{L7Ua9qhX|RxHz3ueJ%?
zaYy>q*Zx+5c|XVI6G;#O%2z}b5IJ=6&R5E03POUQ_XC-sry6Aj5vC$m#OyZ1#L??a
zUOXjFy?5m3J>6S^3l9V-f~v70%}>I!l4?6vH}0&@HHshRHkn!aT5Uv(aVw>F7yVV)
zeCP0Vc8pqj!o}yF&GXMKS8EudTjp7ja`!>{tnw+v1un%aEUdM6RYm1HU##hBk1c$a
zI&RB~Tv@g2%~31;>dM|OGW-4&J2g|IHR#0nB2%)=(ca428eiY9m8nq;yQz9!WUOp*
zaMqIKw@HUy#~SC&mbQDdX}`D2&6P)t-p`Y_+<8oMLC<q`#>2>}jOHyr)#)zr5y^U~
zC++t))Oy`@%7{LuI&a4`hxAz`6)T#S>)q|9ExxBeV=+=dh;52fY@0_(A~j++*Wj<n
z-?_C0{n5J5xob#7BrnAr%`mL*%N6k#%>0APpLa7V=z@tWaEu7L==Z@~nPEEvBA}Dv
zh5#G{L8zR^z?D!FBwBd8aQ)3+6>gcfXs(ZYv}0bY{VCmyq?*#Grm2Z*bykv(tg<KJ
z-gXROtqJCB2U1wB^4EJ?rCVMo5%dQ7C~}VaTY1zAy%hUf2>RrX8$7QsI@clibRc>F
z|K7dccV09yLNMXGb^8o|4KwiLx9qE>ohyw{MmmDHPwj-s3n_^&np92L>&M8e-+ebK
z%?myhQa{<IIL_f{7)-merE`P6PU%+(n;VL{O|PVsd#QPITLRrJ&FXu{uf35GTHa`P
z*u6!n{7{4ayUkBJzBb#;d#cpgrgJND+62<oM=qP5Id&X<)qdgKnWt&x-a$mW9ztu8
zkqw_~3|U8ddDr!t=NJduT^hA#>g<4|w5!?IYxfwuaV$8MbbZFz4Nej5j?vpzzu!tW
zCBN%&dSSqy%~^Ve+i5v+_jgkjcM;FDE;Y_K+B@H&fFiq0@7~$?;`#^BTv3<jj_r*R
z$tgvpdSt&p;a<Ic49qt4I-1)$hTiF&X<In!e5u;3#Lz>l+C87~>-H&aEekrm^N4Kg
z51w`#r=4%s7fzXFUinx?=ZR09)E@o!w~}o0Z%sO1cTCk!CiL+M-AS7S^CxjK4mifM
zrOCNB%&M+GtuFaR$yJ@V>0-g+j2CSl?QgQ@(sz8Dx-c_iRMS?@lU1X6&wg2X*lx`8
z+iUjtF@DxQv8_pKc6-pn+a{LZ{$z6{&zyfc>ukFE{HEI{77V|V{N_mx*VL|i?}@pj
zRk63-wZHOvkj&p)+#-@0l@jVIs-QNORc5ZJO&B?%hVFYWMYP}CDLCta+`X&|3)E~*
zkKTG(@nTi)e9L2m*|8M;EAE)v82nXFMDL^_xUfI>_7)P6i37Z;%0NGYb^c4sAiXL2
zU0VI#bO;WS2$6p4PkT&HpO4$0nQeIa;kf%hsU;QEUDy!TYFXtxJNt3L1=G;=0uQ-W
z9O!H8kBTE<ts&}9KjPr_*Sk~ntHe;!m^=Nqj~h|{DvP?O=Mw))`qaM;0l_bN*e}kB
z{-Xb^S)*>uFI{Cty0ops_%b_@M%9H__eVN>i&%~nuGkXrXxy^cM0$SU&#Bj<?<H<r
zc1d%+_0lIBqPCnNht_ye0}ge+vb*FPKPO{6-7VwJTW94XJFoN<o-@^F(`O4)GhMBg
zg=YH59X)c>L^VA;BseQ5#m}tv;w8<-hNeqK#x-$o1)hd!KNON)1?qLfbAGNp$Lt>0
zQF|iSuxr-CoH(_^bD})lhQDN$$etYWw$!n^@cHiCG0r{G`jl*iZB6YS!_zwF>1;Pi
z4cnoR=wFd(V$kl+6d}3?LRQDOmBi@;sT7QfNImeb$tvD7!$<m}R?d`b_XJ_-3M+Cv
zbFXaMzkRIOf0`ghh#~g&REeyEXo)n%PnS(TJY9|w7^4>hHr3n&+kA4W@i(tCpUW&W
z$f@t_*mW*Q)oJA1dB4_PPcmtm%zKbodTdmxMV6Lzw)$GPxVRpUgSR@31}Qxm{xaU*
z+UVh1q2c{UJD+%MxT;dua(LXdg_QjBrA6B^LKNy+Bl40JUsmS4%xZbJe`3vxP<^ke
zR3bd-EmyPHThrR*;FIxlHm?Y)@7g0s<rFTj+IQII`+}F=oT<9Aed8Go6=x!>iJ8_h
zzJ-OVdCdjGMqE4DMZINmBh`2V`+`y{XUY9V)`XJzmE6^VuW!85TYsubVC1uHl5CX7
zbs;OPOhxsa_jr#uZLUXjl$U92t4dkZWzHfirIYK@%7*ux>?mqmwYGNL>0(BSS5pM$
zoQA?NqF&?6Q~f_T{D-jdKUwM#L7`bDkG2^#zyb&W0)PM@00;mA{~ZLrVbS`BNCOW^
zWf+H`fc`^6Lufc^*a|tqr^6>aZ(x-_ZDZe7j8-Dz0Vk|B8h85aTM;ypgyo_C|JUDN
zqrqPS8YPtOKWQJw$NtDU805GX{buR@aqXbPpy<Pk-;Qc~>AtYxyvcjtzf2<;S&V!8
zAU$D%Hmj`Yt4kqY1!fkk^ye>)Uu7@#w?+w7T=t=`(F^mV8M&WC35lN!Z3Z7N`D6^s
z{rC|Kch3KH%rNj1%wHVk9{)w7^O$@>(te$W{7N|Z?1k_HH-8qSTJiHV;4FUjn$EHQ
zKG7|TS_$R8>C$%|2N+uzHW+$`2~F2ub9hSI&~~GlQm1GCsJcxrF#MY}+GU56Z-+;|
z3xzFyP;2-xS7vyL9&Ow6@;M_8zLN^ux$9;51Q(Z=rSA*<Y^Kmjw)Zd3eM~7PC`oCZ
zE%wn2sgEhRs_fgIGfe0=w?1dmqGJ;amM(qfW@T{)dcTgmRg2)@>t^9Qe{$|2_hMpB
zt723{^`cy%R@e0jl=m)MGA>5P3aWGXb2l}%CRDp<n9u9h<`t{&ZBbosnir6#G14$p
z@N#Av@4#-do^`C~xShG)XxZLB5hc_(l+qdXrt#=)UyiF)Xge`TKaphWC2$VE+qQaZ
zy4@~=o=w%`zNxrWeJ4TI(x9F+jb5ljP$k;5=mt!^5dLQ4&4;;5cRt*kSR!BSlw5DI
zO1_z!`Rv<a7TeGLDm{Jo_gOYenxzc3EAy-f0T#M;DWZsj8MlgJo7}D|57Q%Nl_z9v
z(MLow4Q<K15w=Aar}iXJ%hwULL-yO-c8APa_f3V9+vS)ruHR3ExdADf&TR_uR+Zxv
z)|8wi9^d`cL9nlG|Bn$j9Ren}shTP6m{~t5HG6xcOG9=m>D6Ur!QSY@I^Fe)iT=|2
z&yMa4>BxWP?cAkdRO=Q{E`O?=bX4wyjSc3I27lF~UScRN?9V+wheX4v1HI|MXS@Fo
z-W2^-{-N}ypM4JeTL(K;e?jowZ;nQ8wQux@JDPEl)e<~XpjWgzq>Y(zc3+bHY%bmQ
EUr6s&82|tP

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/key4.db b/src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..66d43f59a56e3ac78870738b91363408252785e9
GIT binary patch
literal 45056
zcmeI5c|25Y|Ho&{G}f8PzB4l-OPCq6&}K^uvU5wsjD0VI?2Lq{R8%6Ql1P$DqND}4
zJ+j@ELQ$!-sVM0;Gq~N|-OtRtUccv$-}C&=F>~g7uFrLS&*yqy<C;0=yg0Vj=Dwkx
zD6im<KuRb|2ecFf27?SxC=duF#CQrao(l_%5kMC<7_Z>J#Q!Q30%@&!2S-kU_yksi
z1SgPp1WN=df{FqU1y&1`{;NhnIY0m)01yBO00aO600Dr&|4jk`yu6a~@?g3~D1{o}
z8R!{GSw{(_EWGj=+n5;InV{?pjm%9@3#BMkUk{X(&8E$UHd|0;CR<SU7MrZ?O;DB=
zC}T^D_2!$5?NBx*R_2DrCM!^kZ>E8`xfi^eHXlsVSRM@W4f61epzR1?h^~~d&|ucK
z>q354+(N`}1cOORqQP5P72N$Pz8*m|npKEzI3?7Rci!A4i*+WBD3-{yuvh`5O2J|A
zY6eSKIeug12%u0s0~V{me#*fTf61YvwjK(TltqJG=WK^j{XE@67jrE6DF<y%{v`_z
zi&Ha(z$B#?dgDu@g?WZ7rh)#HW={Pji!M$r#RkkPiAIC>2eXE3F~MTQGoNa1*cQvV
z88|~DOB=ftC<>PGWQ-dH&v@!EV^#sP1jj7WWp3&+H+5N?%qqGB=8DK%k(etobEV5%
z=`mLn=8DQ#>9JB_=hm!@SY{3!c5Xk+EI2GP4Gzo9gTpct;jqk1I4m<24$I7i!!ncM
zu<p$DyuCSptjzein3WmN%8X}a#<McxS()*y%y?F2JS(#ftE~>Jtq!ZL4y&yWt1XG8
zl2|H<rIJ`GX-;KjCb2S;Sv6Uda4bxCR)6tWW?MX~zj&5s9agyxt6YawPGFS~SS5t{
z66RhASms^`EHVTZ83HRmft8=Y8V4e)Es@oh$ZAVuQDx-BV(~cU&gVm>dtGKJmQ~r^
zlc+<`Au=n>hs+A|A#?BZA=AQq$n5QW$n5fb$Rs)+GO^BuEI#w$Vlx)0`O?K^q`x#{
z4#`{v@}dXwf(O!~Uq-m#mk}=1WrTmJyRc(M>4INIxUgeJxUgeJxUgeJ$b73YJupJ%
z`)xjCzUk&ekHye)G4%Q~WW8zT>QWc&P?>f-h!m^`6^m8V;eknRK>w?Waq&0U6}K2e
z7@sJ7%uf|K;|Yejffx^90SEvD00IC3fWW_vKqlk(fCnmuKy3VbN--+}0>t=1AV465
zh)9wUNF-S%NowI|p*llnR{LKpNkYrSYtk7BAYd?!7NAY@3<>uP(WLnXc?WoEQUXFX
zgBS-bTJ9mC%$;CSI0dX63}O!z6cV=zriFTkc-mT<qe4Atp(t7y<EZ1HT*VFlZ}qkN
z^J-QZJD=9r?X+|Z%v?Z4AScG7Ax%!xvpjVbq%HrQX1h*2KWrHoKO((hA68E~H0ike
z=*pO|c*#>9!|6RCPvWy<+7u5NM!n41e*6y9zrhjaerfu%Nt;Wo)4|n}RtF!=n2J`N
z?D$sPq^+tW`CDjursb*_|4e70t5pM9QW=4MzK4BMTuIHXZHj}vLv1TG8+Oik+pF)t
zR}A^=v3wfoG~C>Tn_l^@`9`k#l*6;5J7q3AZMU%!|Aa3SyeTnLzHz$v<C$C)({FsL
zOO7D&hu+$V@Bgq(>4a8#Kp`TYTAit-_SPDgh+THkZ%^z**-j-NvC}F+=@(~*R>f)`
zbmnVCA6?h;#5*7Zk#y8Pw<G_;2@Nm^j7<dZ!Un?l)sr_Se}RLSz_D&v!^KS@ECGtj
zD76RSe@txDe2P}P+Bw}WlOWlx*HT*OVs}3YtMs~r2Mp!`qp$)nzPT(s{8(8SzgzM~
zuqOlxR)-=CHXFhAd)40w#t$e{`k{&7rH^ffpjY>5B~{Bz_vhtbsSrT&UN!0}-l6AB
zQ^<}OKX+}XiSh?~*)CrBl*h(vidQ)LV7~9^=sx}YS^~VhQo!LjHsD?4i;t%zN6mUP
zF&l?kv1rZNkBuwqQl2F$#fq5hD{Ucf4BPcP?;F>f)rz1C25l4GshbO$eNw;duwHu^
zq5Ij|G+H1<b!vZ9NR<1&X=xEr1)HSorm?4EPh{K-#+M)dEhz;&buHNWV~cM2huImK
zqvdvH{_bD!uv)<l;Q>mz5A&~|fLJN|+i!IM1?{W+ajG}sQZ?KvxMtM|??xZA3aztY
zyJ@^-hNEZoCdajkm1Ht1L(cFNB)zhqdWqh4<+tuF;Rz+DAHGv`@&T`83<D3RVQ{+{
z<kg<&cYKiOTIfPwmsMBdrY7NZ@P+NPZk~=E6~=KGQYOwwjc6gnoCUW@_9sK>2L{Dk
zNZtG1kA|PM5BQ$F?ffyM@PW`q;YgE)@=YnKz7DwrHLaTKmRb*MS`veaBpbe@FIPS;
z8ybkta1>D7JiaAa*cpAbQx~H+p1fPIH)fi$u`xOC(4PGLW19(SRm-pENVI0U@A2MK
zy~(MWDE0ulS!DXF;wj~exE~YGy%L}8GW9mn78^YJdjcss^yc;s2W}|rY90^7Z%mZb
zc1G(?KFQmnQ9DV2Sg7!-q#t{fIpuSkBZc#Sge<S78K+##%T)OEj6nhC=AigC^_x=I
z1Lcr*%+ZFv(#!5Qsv3}`T~jx`m+6%a`OlngCBRN<@T@%7a=wsnaI5ud%^Z#FHLG@M
zw9ah0*E~6K<&6H<wa6W&?J373loK^}O4TQ{;!%+_&yqN`;KKKJ*En5L{i8##BppMr
zix)owSsQfEo%HIS^Apc~LO*t=zbR05e41j^BmkE(gcNZ@0dd&ng<nZ2PI5Oo+vghc
z5Og+GP9$;aSzmC(%>znWA2?FD(op|ogY>j*?7iHivQ7qtO99^@X_;2ba(Kg=w1qe5
z49Jdzt(7k5FRdZWJheUdT*ect`!+v(O($X(F)akYDx+^$@D<;&>`py>DEj<1M|ood
zQ4}<{>(HYFthFFrpO6(=VdUrLU*wv5=kl#{eMi<GNTJJsE<awY>0t6Bn{S!Vw`ANX
zg8W)JJS)xN(b-*U-ya#q#}AS{-qlz36iIPIfz)*W)w%akhj(v1aMCpSPPl|pfkqkM
zSLX@*j@;k6;$%5eP-s(k>Lof2m!WzMK5k=Bm>98Z6lwH(VUaVWJg$D?nPsux7XEhw
z-k#>x>vdMcEfZ<md5E=><ZIPe>b_U2$FHqU+jHo)!N988#F!vW`5(u31?nfYUcL&6
zeDOA^P)xYQF?q;z^<C}Jstp}6>38$Ijt(l=?!L+!cz3v=;WB-?5;N+SxOCnAtu`U*
zTV)J*hBm}X<>eJFKlmMA@TqW(GdC0>_CI;%IBH_NB<$7Krt-<Ou_u_E@fXKUNuW$W
z^0#$494T~Nycjm1kI@>jGpWlz%%DIgl~vg`-u_f#uKxQK;UoFviu`Yt*;^V-57jrj
zEs--beK<@EDb#-h@-65&up!zgbZ6!s@HVUy%Is!rN?((+PKN0za8pFF+HL)$Du+^M
zzmgZ-?(3i5m3VYDLcBz6pU+tTtmW}<Tcaq~dQ=~NxO%N|S>IEY@C~|Ug=?RGcyilX
zwUTG~y5eM?DrqI-ZLrJC>(}7_?;q9zObCqY^Na_u00aO600DpiKmZ^B5C8}O1ONg6
z0e}EN03h&RMt~Or<!4?NnLGZU0U>Ap%Q^^j2Ot0t00;mC00IC3fB--MAOH{m2mk~C
z0ssLP0SE-dKX?590EB!1KmiB<1ONg60e}EN03ZMm00;mC00IC3fB-<?KaYSi#EPHu
zA2ZG!|33yHAOGj|5O53-00;mC00IC3fB--MAOH{m2mk~C0ssMk0FwY3vXP(tzdV{d
z{(k{Nz5s{;1ONg60e}EN03ZMm00;mC00IC3fB--MAn>0~KoUaW|EGUkyoAv)F!CF-
zdxCQ>|LHvi`~w640ssMk06+jB01yBO00aO600DpiKmZ`{GXVi9=Jo&Of>aQ461fs7
zi>yLMAbXKVky{WHgb`v8QGl31)FBe!sc>He6yAtXf{((Bg)RskfNKc7ft$jGggON2
zf>gme!4pCxAt}MHf{%nkgzSFa3$O(c00;mC00IC3fB--MAOH~f|3g3lVhE=Bdb_%N
zhJ?D}2{<B^qU-KDck^^SUX87cRh5V6vs(LmMlLj_{@GZWor+z?P9-U^Q;8UMDgn(-
z)j_dSbrspEWQD)uAQ0Rso(y)Zd#LNlvz2w_*vV9)EIXM<m0>4S3DWFjB1MXwOu|b3
zUDm;R5f(cp!B*B4XD3sMV(erhRg|4fC5W(-i4<XWG6}o%?=sFqkEr+Oh#}d^x(IeM
zl?Z1i6RAS%WGX?BolK+%u#-tx{=dsuDuF=$vtxX0WnEr&GL;BpCljel*vV7^l$}hZ
zK-kG7ERP^Wo_{-qM%x)2;sIw&#8RN$AfzMW5&{AD6}l^=C>SNsD}d!s=NscQ<UJ1i
z0<&3iehDAc9a0C8<_QINg4G!f{+$aQBeldZQ3UkYY4WFEd<vGHfOTHHfiMDV`OE!;
z(PC!jy}yr11!*3SU6W9;^jWG`*+4JtN&MJQ=e>t%A^&j0%D>!O7>a5?<6q!N7Z-KC
zxyL-`Mvscvc8Jr7!g%Kht$nVkyqD7G7)iD!NmwpSB3|xWeLKNrh_Bctt{$n_l(oZI
z#D3Q7g4Yd_Qhc7U4kwd-Ee?n3^6O-W5xL4Py*{-oUmbf|@|#kSm-4P4z9NNgI!59b
zlRwWiT$p?exsVZbD%Om8&eWc7^M1SW$vZ2r=265xbhUNjgLv0+GMV+HOC<8X|4#Au
z_u(>4D$o$|?wz$ut@>+sW$T0PW^ATo#MztF<-(-V&{jx<+il;#H~IJE^HA5_#mtZ=
zAExECy0qXTKO8jVWb%{svp|34nD*f#^5iZN!h=&n3YnPTcd7j`7hE5_S2{$;h_N+E
zC30cXc1CN3)XBUwYl)6CawM8=Wck~Cc+a~7&V&5-(~Nii(+zchdQVoJY82VjY4$r`
zXG7$z17&+_FovbhYMYkduRp9j^t6yp$B42uNu+XN(rjHbx!%-m>S#@obY)N5_@})7
zicNP8zeppj&c-xUo#jLlbw>M-H!g<i!n>l>qI+Z<?Us?p1f=SkXv)rfm@uyrI!1)8
zNh*O0lS=2;)Y1m3FT0tq>!3-zKUkHpzUaot1E}f>Skh#=`g=|$A4oK2xwn{odp3D!
z%^T}G{YOJ>15UX7KndP=8<*^-rPDFOY)ulmnSxT!Ud6OnL}IR!O*Lb|{1$zBu@?pQ
z+PywGu+44_u2-FtNwPzDLDJOg@t#2A0*t?F>~o7a`WcW*Vz81$X=3?lWjbalTa#Q(
zK?5(xn~h4;YOsnzj#BsAH|uv=$~0MtDjXd7E`GhD-iMRPZ%N^;*J2u|TL*4Vobhw^
zc(TGleC9}u<q?tLtFRkx=5!457n47KC*WeZC##0^L|ck9nnz>36!{bQ-hbX^S9UIR
zsTcJ8&aoHw?Kzn&gBL}2jmzpijI-NccIiW%_Mk!Rtsu`m3Z;?bG0EmWbPR&MNp7Z~
zPa)s4-!(>DREg-I4Q)GS88sHxRV{Mjo`ey;I^)qMOHL-=YkacjO`qC0QdVcT6Psmb
z=R9<0vV@FJw@mDr+6AenW8iE}ay12IqDJKTVxF)2Ld~w(wl5(|BJ>in^7$nH@yDp@
zZtT+QoJ<y4H+dU$j7)u)Q9u0YmZ3N?%uS){^TE5Xr-yg~y`lu@7$LSMxtf9sRD^Gj
zJPwe)pgLU~*ViK*G!wt{DNo>CMKOW3D*VwLKfAZgQbO!4S{-(jP~PuOURSj?n?Q9q
zs`>Uy>fWw0Qt2`}Mv$#ZuBM=@{x>tXEyYc&>pRr?-u!Xu;<|P#e_4^<i()x3Ql<J5
zoJeLhijz+~EudX2I=>w01XE3_-THYzczZ$8>%F%IuBpK27y-5>xtf9mqf@de26y0&
zYsJ?4>TRz}|6>#HaD$(D%;pe_LgT4&PA0w1>b-Ocy{;(Nwu$(xCM?eET+x+c=WC^y
zX*IiwGs}bM7=E@UxtfCT2-or`@zK5`=<LjhO3PQLBu>A%_c2<@0(qp~xASQwCzH3w
zD?SI;JiqoTb>L15N=jumZ+%2y;@RJ!ohsd8E4nS{7`|Uj{`~Eoizz5LU90)BOV0C@
zOa+YR3WeuB;Y2ZYOnjX1DPm5}AiSHC$+-CMzgv(R^;YaW8J{b6C|sju+1I$YsM60(
zlJc<hPy`*r%ibh6Q&6wd$@4wgnZ?;_!|ik=6%1{62*pp?-hh`TxngUYE_8A-iF!H~
zT(H3p)o@u)q$yl-u(kd+QY_BRMn2}8q?%u(I2{9HYm%!e=;WS+kfT$NM-4{TJpTIl
z!Y2VOyxHJBvj*R{7Lm(G)NgPy`Bls8(6_qUsHiYEkF3X(%fp4`dyfg{k<@LvnxXM>
z(saxcwkElnf?i`cTRhN*(wlr@&;RCBP!tzZt}!*Cc_pzRB=?8F#~Ds0mwky@ottpt
zn&rz!hcYz#$nLuMZi^cD`i765DaFg9Z_+VPwkElnf_R3HrmDQ;wS^@_?s?v-u@aqr
zWO7Gx1>Ih<d^cWreIzH7?lrLSRrozVIbU9dX(+F4jVA6*TlvA*L54qBb91ZqDLMwi
z)+AR`kmK_G<gm>VW1m!;5Ldyq<y!@`MT=s_pmj28E~9N|GfpP6Jdx2#@tUtOrpM%N
zj^2wAc<MmOh<T)>TcI~D9nWJ*$MCQ<$<-88qO4(bA)_#|RT{0GUtv8SPQ2StSv4Ej
z=;~hdu`V>4lgSq%9npiQl$HIxmKwm6Q<fin8gc9quSt|gF^Kf#m{}%W8N5WEkSMlr
zoQ>=~@*HuDq$#sOk62`oQ1GVdZa<bz#|ADQ)WWfDzZ}#aP;W1{&W}74SEM7Hkz(_^
zezJaOVW@tjLtS&)))VzF|G}m#jNdJJBiIuH1*=057UyLkvfex;rs9+PEJ~qEop)TC
z8dCIeSF*udj)ZF}FpvL{Fc%PVE20V^3=a@$5>gV37kDT@=FjAN%V)-0%*(@&fdwD{
z5C8}O1ONiu6QE<%e)**S`SKSR-@~&Gt+7|E*HjhV7j>oh^}EvMi1n&P;aYCwE~i(i
z*F_=!@DcdaIkai%@W;n0VFfueR%@n$$1<b(pUR=T@B6mId8@g!iI&nas_ad2b6!_D
z^X5SA?OKP!kNS|E2UXI|p$`wPjN4Gxuv$^v&tJuYlgU_@Eyiuq8|1#8?g;MlXyn<V
zcdS3?q8arqxi9gZeL0nmR$ih%e}?=YF9mV|^8We8clQO)oz$nPBwN4Kw5`70uk7IP
z#OrgQmel&0C_hdf{kyY0K49_@4=3W=x|(d{3<Nt$!(PG_v_JUgpG>&FnvPz^)+09@
zFRqfQ|D2Oi%ERBP^EEpCtqUO=Tv<_nYsg|ad+eacD^4C2`L>XxJ3?li<oqu3$`%HE
zzMxAMGSsX~E_1YbeZ5MSj#gspk;DZ@BqHaw?d;*ghZFfyqJ1+LA3a)K*k_{j6+1S2
zL;v%HGbfMQqD!`VKbC%{L9gC88?gSwWb_u@bW@N;UzWAQw}~^C=x7XEkKCMi4(hyE
zm_zQ3?0==zezW=f>0yd+0&R@XWW&AG?dI{Qc1|9@CVpDgEYPB;EZWw7t>%u1Yj)Rm
z_|X)kyGZ)2Qz+YbIvUN^BR8jXOZt^RXWA+iYnzWbChvGYutKW9tN%0K#K3Kmk41Xc
zdQKi+tB!=~8X1U#YjX+*oppC-H`bt$*MdiR`oCC}wj8I?(I~bab+{O7w^-db=FQl2
zsb{og)Gq55?S^>cYQpx^j@MMtjkhNzIe84VwSDA1-2STZdVf;Uijlx0JKqlb22hNz
z;m*wJzi5}FqZQeD<mMcJ=7u|R675DNXFa2yZNrVszFf2Y^-!PW`fy32=$99@96c&@
z-m`gtUAz3%kM2=?fB#7L7CW_|Cu3chfZV;xR-bWnv;td?WG*;X)P6<uSdd+eBv8it
z4x7iForu_%h8w!D?Yxl7H@NLaP8`3U=n^`ft^I!BVb<n|^4`k*N;L*JKLlOpgKR&j
z_8jACjr=c@_)k|5^|&xOoY5Sl<Vy;*tuQ_AS4z8ePx-9Xi<{nUx30?Ewz#&1<0L+i
z=VYT?bN);3VA{<cdWhZF=m&}y)M6_GEefh`7;b^nF>>rpax>Z`L%}BLc%@vUbp3)s
z`@;#mxwj@C#&!KxQrRCm3#-@XL=p;78OLoFlC2d~g$;Bg>_x8hO<y2ceJX746<K-W
zGA|t?%hn`UXMEmxXvahABA+dLQFb8fhVd7rx+6#XR;(I}A;0^;Yv*u+lgaOElyXi-
zm*M)!qZN6(DqLz}qne!pHf{Kp$@6lT=obe%Mux3PuFm-E3-h<`tO-Q6mzen9C-w}U
zc9x$_FT$-FC?B=;Fx@fD$)pmcPdiP2wl){7pA$pf9VKWxbYS(3553DuBv+5dxi--;
z(ris~b;jrZaJ(y`t9WZ}%c`|5(|#-JC?0y-WY2ity79T;ImnyisnQvJRMU<lslCh5
cZF`qqclq`@aI`0md`akwmR15b@^`WS0akUV5C8xG

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/pkcs11.txt b/src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/pkcs11.txt
new file mode 100644
index 0000000000..82255d3f4e
--- /dev/null
+++ b/src/test/ssl/ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/server-single-alt-name.crt__server-single-alt-name.key.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/ssl/nss/server-single-alt-name.pfx b/src/test/ssl/ssl/nss/server-single-alt-name.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..95616f580e4361c493962ca84bee51baacaf7dbb
GIT binary patch
literal 3213
zcmY+FS5OlQyG2PzLV$?$5{gtI)Ibm=k={W%f)o#mbfrU(V#I*--VH4ZN)ZG>P>P@s
z1cDIhMXD4rNGKkvl;1P+-+S(T_~x5gduBiGg~Y=WfB<?V9%c?<l#Vrw-9HCl01)vo
zO%NV-^$)&+#6vd!jUYrkWZ@5*0Rrg$ys>{108#+L^xp;;0D@!zLHj@KF1<%kzXO3#
zx+pxP!hp5P@J;{C>|ygd!Ax4?8wKUQ5)Ow+S?HCjEpQf~9aakVnK)o7^l@WTuGK0|
zIYXKL)i*8)rsl%j3HsmJI0TYwaIuZsPS0cMvZL!6O?3=a-z=laboc#!lV86Kv|tBt
z+|I)Y*@dE2%%4`2jeRQpZO0<(7}C7wS>%L!aZ3GaRe$a>(-AE{r3p>rhlmTK+qC>i
zthHw{<<;0pF@V|)57C{=WA!WBl+d_{^slmCd^zV*!Lhsgzq-YGoM+Fh!U6`5%9m@+
zfF-L8#2r|hr_c{o`Xn{EAEFNjHTvjgx3X?jou1SYJWJ&SSQ4b^UE+GR)aQ#4l6n^F
z3gX>kWmhMZr|*fS{Y=^~ZLcyrE6=Ba`#bQq5wY|46pn!T{2)}WI}QmMZ@r$V(CK!y
zn!9}c@bjmISP0ec=z&&8^J8%OamsmmS#9~?l7?YHkKXDyr`|7LFC74PHg8Xc#pS7C
z5Xgzqmp&hH>ZslMh`Pk|sS8aT?`Hk!<@J#wH{G%#Fq3uMbo=tfGyAQ0tW#4_%12lR
z8UOv;ByhFR{VAlcfuc!oR#l}0{!79v3hMh__{=NaiPPw*(}<+XHO(B_cy<+atA$?0
z`1SJD!jMFVSCfOLOXr@W6i?5%qPX-YzAi<nzh05&(J(qsLbxAL4okIAdOn|;yd^6Y
z%{LKwcG(x`R?ubDb~VFlW|}Qqn_ND#)8>h{ofZMnF}Z*r2TxJXnBTgiu+er7zrO4M
z)dk|kbJx??DD4B1TrRY$L)*9qP=2k8bDtA24Y#})tq`KFGc43u|D_Qymc3u6h1v0S
zp@Fmf;nNz?%LWN8E;@!&YizzsdVA>&#A$X!ei6bl?Iee~U5fH+-nW^csabdc>`!P@
z?}~=Qi$bJl%AW!Qn6#P*b3a_?Ah7mPMUbY;H_-z0BlZ;C=!}D@dm`D3r+2q9V)|hp
z3z`>>;$B8o%HL~n?dpy8uZ6#G@940%M<sO{9bK|Cu$po0B#kGrK{%jy*tC==N=o}z
z>t!PaKFRg|tPaJn47RH%#&Y(+mOQvSwK4^k^e<>^vvv*xx^&V-MXN|Ezf3x;UK#t!
z>?mu-8voUi(Wya+>@zj3uxZMC--tS<js%BCJqc?~?Gv62^YBdY<bpvhP9ps~eR~X`
zPFgYG`>sfB46BK1_l(>ci&Ht_&4zd&Yx=c;1kt9?R`qxMDzESrZ-0~$@>o$<FXuaO
zes|q>M-kgIEOsjCPkVl7({PQ^R}z4EPLguww$G-?1Usb2v?h;gWK9k{e853Q(2M*G
zz=&kHs2DomQtn|ZMut6E4{~T`?@DN4OB(TCX=h(GyEHr;z{^8=rM&9^wndC@JX{}M
zPgaOpSi8Hdo21^`k214Nw0r}$i`MJ@@MRLVx^rL_f~a{QpZVBl*LTHWe8<GnoG&k~
zzcp8SuLMq2X}Yye=U&T@r-nzAr$uyCTI^#P8<lI0b6rpDoN|#DZEjma$xYBAhE1yG
zR<5MAK|JI6pKovo=Y*9b*|!F^YP?%{a2C)FKP@1C$;ABiEr&LSF+xPj(U~$i?*;YX
zBUXT*k(nyG%zJz|oO^L+`aJ6FBIZm#$DomYZa)3{Ab;^&aq8<6;tV8nAmV`AK&2&1
zmU(G989DfXw5X8v_bhW!K7(hT@pWkh+u;OPm<qo`!M$?7Fd;9mk^Uzj5$K&NemCFb
z!Eg4$$<&(*j@D+p;VQ6X1)kn#Y$zK@0n0a^5i;v#Qzs>G{3mU_p!(+~vgPYg2Gg<V
zcRrQXSNo_Oz^N5Cvuw0Pr0@Dz-@^I&-AT5aGV+g#Z(Y*x!O@+Z{#Yj^V=4-{0h{ws
zZ1)AQcJvwlxK0`#Yl;{J5iai%!P%}K8&ZrF#hs_r`G0imKWUcD5|6`6>6K1Zu#4@v
z%&*bGi*(0FJ`UqvvnP%|XCQre)_c153>cG5<6O%StnYaIg@GU|#^@E8VI>sBJp=ba
zfe7Pwa{clTBuJtvYj_z+BkchmT;;vL*GK1;){cnNN)>RaIrHmJJ46m1PrQ1eGW8*i
zW1+{97@FEW@y)16p2?6-+rNN6A~bj|uYCF99!iU%8fyP}a2{zYQ?sa&9eTSj#3I}Q
z#b_BiFO{hOA<vt_w|88hL2EzX${esQc*W_o?qI}tzc6^FB2WH{^R1e5p$^A~13P7i
zmPgC>xLj&m?dQ#rI5_u1`RZ6<V&d4_AFDda?^C12ive8DYe@p}P0cz;JXq`hh>eH`
zD}nG}`9E0t&s~Ht|BvRF06-!hL_^|1)c<Ec`hV=_>V?ZY=fvpvkNrS+P%p%<wqQsf
zHBF|NM!i@Ry1}GwXxuAfuyN_<727nd+i$y9-9CzopuPN@Hg2<l5a^Nj+koyIBl_2(
zX)87ZI;_0KnxK%uwbe_#j6Y`w?=)HTRf;@>j#J9*x|BXH9i9puec}6&x52{8O9))Y
z{VF96d+jw8wiE_&;T72Y#;@lG?YA!z@9wj?Hf>9umG+zI<tMm|6!Avd)^3i`UNzh@
zCdP1zb@jl$Thu1sCM^Z9NJVj*aW}u{VL(>#$_N#-g#~tPzh3S86-Yux$HsdXSz)cq
zM#qvvzlC}W-;r{*jL%QK`$h9m!wrj-L=BB<1hXVa77rRu@Szu>jF}gQs06aCsq-PL
zy0e6l%gc%QnjV@>%6)0dhY#z{l{;P<Tv1(ZsJ*cRP@@7+_*}NiTj8+P4hp<Kfqxo%
zM^-vBn$#2IZ&N&%ISASH^?JK<O({a7*#-b;&wb%&k}i`K($9l2ItvLCK;KTV6y2-e
z(1xo(pIspd&+)0g!r+H+GE0IsBXw03kM%h*?SNoBc0;0b&l{vYbPTVs3oJA+PF^K)
zdJH>dmMVQt?2|kI{oS|1KfWA*0nf$lorzOOQ#>#8D-5p%g$PL}9cbQj!%<1dPIUOU
zdi@-36ac-%Zw)VgzK~}uGL#<fIf$J1%OO#=k8+Q{yNkui0x}<Bnb3}$t+4G=%K5W+
zfiE`@>uGlyi?#@8gs~H>cM<cngm6u_3<=8N3Bm<DP`@*~pXU&=7+B3E51JcP9=UJf
zto(}^b0TE*PBq-^MeDdV;jpVrZkx!$D3}AqHCCSzI79X8I?l+^C^Tmu>Q^Q!Lbsyp
zNh42YG<Dg~zN8K`{zA%W>>CSN&FyhtUxAzwHzS7aS(zgpCJU@UFQMetq8oFnD#aom
z5|h>%*Q@<RA1Rrs{&MPbt6U6uh+`n-bA6#t%Z*OiVcql#z?fNY!o(n7QT%Lic)|c~
z<CGg!xrO~HX1f`z$*|O5WLxUpCFfQoeVIZw*Cg}T6pAK~7QwI7UuO2b9~*1lY6P@q
z<I6^P-h^oz&7GwOC5Aw=Mj)=5&$z%cu^sK=_OrjA-VeVpIdK<DUwwj2cq3r5;3ib+
zZb-6D?KzmC(uM2P0eFNcJTX@htM?-N$z_GS@Uv!*9+QD>D;1;th9j{1GwH~;L2VTR
zjTU?Io>4pHv)6P}g03Tl-d(10KNG<+mnv8r%-zn=d#I>D^e^QlObI4hJ*SKA$!1p)
zBnSR+36o+(Ho8RUFt&Io&BNBK%}y}#_&6W?HPa3N>3)=+4Q#U3H|L@%vYG|9yUa1(
zyBhaWedCJ$gN?A4diQPO|DJ(-u-uttM!1*~82H)y-9@UuXU0kp%6FG(Mae8B0lrkV
zVG{c_z2C|=9m}{a->;LI?ivxcTDRm<tM8L9RdQ^}ciTD@u(Y#K`p`tYS=fBM2{T`Y
zM`@#Xnip%Gj+CkT2mMErC&y(gmC8JdF&p3oJ;_1eNG0C<U1+O#;+r7_)clD*E`uI8
z3KiZQm`SsE_T_WXr_`X}!WKF&S6dUumk`weMnAFRuVP+9c8tB<&5L_iHc&K5P6e&o
zB#F3u5*!7$))VH&gW$v=MG2(X|E?n=mm)Wa^S450Z)j~+uJph%`r9--s%(gyjZ{R6
xAQ>TG85VjV983q|oTd~S!$H5$`4T0yRg#6-T_DwY5ELI-Xk`6rt@fXl{126v`g8yQ

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server.crl b/src/test/ssl/ssl/nss/server.crl
new file mode 100644
index 0000000000000000000000000000000000000000..769196dda6dfffeb4141ec007d6e276d3afb5e84
GIT binary patch
literal 418
zcmXqLVw`8t*lxhf#;Mij(e|B}k&&B~!NAGT!N87<Ih2K&$2=spxJ1F(Q6VkANFgA<
zxFo$OH8{{mAvoAap(qu|DK5^;&r>J?sVYt_DoZU=NKP#(DHi87v@kR@GB-3fF)%fa
z66ZBBGcYkUfpQH*41|~%+0YcBIfJ>0k&z)cx-<6WM&pI2r!*dm3egYCR+DZEcFbs=
zJLCSW&CW;U#5aBOwXHll$=p%k!bPiXhut}MT~u<8-g_X&?EdN?ab}a1JABr;+ig`=
z<67*aH7|L#+SOR4x3|MWJEoZ4vY)6nxx9MOgT+t(bDezlrzuZUzqqQ}z2kL-Q>O0U
zHbE<wjSIh&+P2+I(flFf&)N8NZ@bU8AI59GGNp869L-9#II(HANW;al9|>u9KQFgj
zG1J5K+BS|et`!}!yF)I0+pZ_l{^ZHDOBr?gx7Y$1Zp_zSS614#>}BGLu8NhBoGu3M
o9tXbUKYKSkd*T+M_r-Y*A{D<U7Q|28yuIn;%#d&L*G&^z0V1ELsQ>@~

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server_ca.crt.db/cert9.db b/src/test/ssl/ssl/nss/server_ca.crt.db/cert9.db
new file mode 100644
index 0000000000000000000000000000000000000000..93d58e2651fdf3614ff265dba5629dbb27e6887a
GIT binary patch
literal 28672
zcmeI43vd%f7{~8&NlIJV6sbli*pn(W43xd(lC+~hAEdNWD18CtVMx=1hL*-ADL4oM
z8KJ09El)u~5EKxp2qL1uAPmUEslp5(R-{^a7A+tu;uPH7T+)`&Q3jkr{BGtp|9$=U
z+uz=0x=DIDSs4zG#E)^h#@jr+fr(&PmPzD!hG95-2I13xsIXA_Gx(Klq5n#9Ox$A^
z!!%bJb;wyJ^e4@p&<&yELc8M(96$gF00AHX1b_e#00KbZUnG#IR%^A<Y`&wkP<q;4
zY;zQry4{1z3rZaJpp<M&Qm%zhAJoq>jHh*c<{&;$&&S#Xq}TOPQHMP0P+}{PN&+p^
ztsH3G%?<`#Kc!k570r&K{oUmS<0QK$;Gk;dAlKgPAs|7Q#HqC%{PS?Q-Q|)iV4`eg
z;;X#bBVN!|WU@ip=xDZbyvJ5hA_ck!ghKYoO-jzNwB+C@<OgS`4@}C==LcBw`Mg2t
zS$P&RLQ3YK)Qt3$Ts|o|Gds5jZ$tPL@TteAfoNJlN(53APqOhO8&9*ONxVoBBS}mo
zF_R>oBnc$3k)!}83DgStQtF6^hk$(J5ElUv8vzj?0TCks5hno=D*+KN0TD9+*-0vg
z=ZlXz>wTI!>#4JzI_s&ko;vHPvz|KZsk4FhHPF5W+Sfq)8fae=tu@hF6RkDTT9dDq
zI-97onYN^q1d2&d=c`Agub$3VPh&RFasw?l&~lNMh_pnMOUNi9BBO|uj7Z6d)L*3j
zB3%a~?Q5icjkK?kQpKJK=>;;lEJ^h7q!iJ{cFAZE4Mx&HmZX6!$>_2qA;^-<R+ePS
zvLr-hNwE4P<s-}HZj_W<+T6|5q8nKfUjuV<3}$}}rsjCD^v8>(zb%$6+WH5^rT%!a
z^bd@se_$;A17k@pH4+1s<a(1Ox#(nB*es=HIVK?KMdNE*&>T(y38&C#Lxlwh=>&yZ
zYl&tV-&;#r3Et6LZRH*(&07QawN(g6vbS$T-fqM2sR-G~gl@qJ96$gF00AHX1b_e#
z00KbZt|Q=8C?+W*!^7_*kxh@FFSih6_${>cHI2jvQQ=|_Cg#*|O-)Wp4$HjB3`dDV
zAN07I%Tsb~jk%KB!@HbL51*1mzE0x@JKdhKE-5D~gU`vy;9U~VxZMtCDeoao-R1bN
zbOp<@*e<)}$?PfemesDF`{fVe$9pwI&z*Q`#gi9OcRo@zZBO-6bpxi(j+v?aU{)$S
znLy~u%#LFsTT_@GDgON&ZyiHRPmF;W;I9hZl52wGvf6ENc9#cvxiI8qe_qZhSOuON
z3R4GnpP4rE*D#h1RWY~E3q7O_!y95jZx#%AD=QAyhKVL53Zk4v$wDIP<699kU6Fsd
z7<3lAU2=KccmiEo2F|J&&dX{TTpptE;wgXk#Dor|V|(v-d42aEN_1AKVg3H#PpeDY
zql-nx^A^vHGS$>8bq~fF=5`J1^v(6C%3+#K;|?b#ubbF^ONl19=C#Z7V`Hj2KfC0}
zn%{cWRBRsBG2hrwn3Z5U-1PYDV^zhQPgvg1Y6#lA=}7AJCFd?aV_IT6-|q5{F~^+)
zdvl+k%2<3U?c$bS8V_9GeZF#Yev!iRJ9A-8k7UW%lTC6C%Rkg)UewcJ`7CPffT8wj
zm7gy>x__<iTH30e(~josou6LXnC4pc{Eel`Udrpgr(e-YL&ZtEjh7QTytQLM#G8uU
z7bf*w+2ife{a2|%CwDu!cgniM_3Q}m)w~tUPn6E6SX13iX;pA6!>)`#;ixSp-MPI|
zg*cYI(UKWnY|M;h@<-}S^PAGlDQU%DH|3_R9<r~x<B+Mvn`SlUU6Ky1Z?|+q(XKZ>
z2)*z{p5>K+`_9IC`VBFEbUGyF+{i;gYh!O5pO&)nc;9`8wmxVLDL%dZk-m$^j_xZ~
zy_Yt{&_?;{G1IoA=RbMpOuNiZw#5fmJzaI>$Lz*y3rA>I%z3eFUR6}xQt{lZM{SqR
z%zWR{^{3hw)>`>*yKG-p_wdlhqVH?t66SoBT=TkF+O=TsOPxm7)oveif6a_*=N1`z
zS$=za`v`7Ud2Lpg&er-F(vo!z-jJw@;!N*{>JuA2n)lrPXFEKwM?30dh4)=^x?@3o
z+mj0pjOm!X>(QmVA`WhA8lA9}8CtH2t;r(y%<W(G<W9N+7xu^Vnw*!v$gvtnY9pW8
z$FE#{b_&CW;0P6(Mn-cLCvX4(AOHk_01yBIKmZ5;0U!VbfB+Bx0`~%eHk^_rpJ6J3
zIAt*T6wkN+FJm-YHD&k01Yr(900;m9AOHk_01yBIKmZ5;0U!Vb?g|3^mD3~GJMf!;
zRO}Oc`#!$?|3*f$QM2W)-~&Mb0U!VbfB+Bx0zd!=00AHX1b_e#00NkRl4Dp!nsRz%
z@SXUl0N?)q45Mk(oB_N*00;m9AOHk_01yBIKmZ5;0U!VbfWUv6KoEByi=SAch~T;g
zw|ZoUZ~tG<XzDfaO#c7$5<~Dn00;m9AOHk_01yBIKmZ5;0U+={CqRENpykBiKYIY+
EA6+1O;Q#;t

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server_ca.crt.db/key4.db b/src/test/ssl/ssl/nss/server_ca.crt.db/key4.db
new file mode 100644
index 0000000000000000000000000000000000000000..7493954711430fd0967475631b9380d8399e9ce2
GIT binary patch
literal 36864
zcmeI5dr(wW9LM*<vMjr>7b)EdX7xf@fLoq>_ra2uF1RR!ihu!1u6Nl*m$&SKN@Xll
zSd_1PFrz(ndf5~`%qG&()G19(Whh?|2KgLPXUtcY-E(%gt79(A^iMLso!PU$`}>{q
zJ>T;=cQ4#!hRvCh>2y1o;>zlB-p%MFkrIlMjAa;!L=r4K!-S{*Ark_r|3G-9ZisIe
z21_0qbuNOwERiclOO(IS+m!DqdF3$05yfc5`r8eHJP-f^KmZ5;0U!VbfWZHgKv`(0
zTBD&nBiy{L%u()e^W%6o?|+r2W?Rg;7ADu6l4)W5Stj0TXR@->Cz`Vhn8z#y%+yKg
zQ>I#&$&;AW$&=DD(^GSqY)e+AIn|<Ngx^fdS?>#%Fj6j4r)nsPv%>C}=bBR{6s>%X
zyOJDR{rXncABCmJWNLLRHJx-QD&?K_3YROZ+F8rH9icvR>66A;@)=UZ7Q_xrJkKI7
zVQdJ|$RiqMyv<Q2c9GqrL5jC%=n~STGIdNWW%b&wv6VQA+@eOvO&Tt5`4$xxu?eZc
zGW9+F)i_<Q8b`G#BfUw+TfIfa#3n4vrb5-RvDD&9vSp%x7zO#HyxS(``?GQ8l*!q-
zT82l$Q`k426P`L8lLXGNIAy|zCVXfjhq#MLj~fGSjJQd{jR`l&xZ!bQ6Pjcqg}g0M
zL|B7G-g&SJi?9rfunvo`5R0%9i?9@nuojE37>kN<>$B(eN0d2lOq4mI%n@adD04)a
zBg!06=7_S6jMb5`Ix<#A#_GseBdHom)kvyFQZ;(3MA=A`lSofOi6xjgvR)41u^d@1
zM?C9DUPtmelGl@ro@DgC44y@g@GN>lMo-A-iN2ob>&ZSC$XEjzYan9{gsPy45Xa)l
zeIa&l!dXN*7dZ?%z0QC;_(I&l7vkA{A-3QP@oIe`Ua~L5M13K~>J14WUnmYEq<mR%
znDK^TcuTw;l0*+leh)^`uMqnE3ZcKR5Z=(&Ke3SY`xQd}#6swwSP1<S3n4z$um>T;
z=bJCYC!H^}i=jgdi~kA9N#pHn6Ybcr9lL=?b{j$ox*(Z)eC+KmjN&`k%8D_*x0mCe
zDiOGe#0@-v01yBIKmZ5;0U!VbfB+Bx0zd!=0D*x@K!Fzq_x}TRdtqHb00;m9AOHk_
z01yBIKmZ5;0U!Vb2m!eNhZ6w^00AHX1b_e#00KY&2mk>f00e-*z$XCr{{w%IVTC{d
z2mk>f00e*l5C8%|00;m9AOHm5{vXZ(AOHk_01yBIKmZ5;0U!VbfB+Bx0t24_-2V^!
zJ%$wm0U!VbfB+Bx0zd!=00AHX1b_e#!2kbWu4tFg`KnJ<st9NJ_V8iKIw1iMAOHk_
z01yBIKmZ5;0U&Uv5b(swL(C0P5|?w9wa8KJwsJa$LHN3?V&RB<8CNp$)T2UKSYqRZ
z#!C@Yhzd<cX7Ml_>7~qz7YoP4AA2NgGkxa3iMraJs(Y6^UpX-RwV~blLsmDBTp2`B
zK@@`&GPzeJDD1{q%6zvb@wMLz*Cp4Ne{-s3+u;#U{Iu9cpFD1H=C^9(=(B^KxX{2R
zP5m(0@>j1$yW;)GjoZg-FJ5P}*6siE`S}-|%AZ#ER4md=OY6(z&b+ffr(b@5Lwn}*
zYrCo{Hbnf|wPj1igU6<H?s#DPnyyAqoGhS8o1q^jzwC_NPS1>=K6vEejvV7kiRwsC
z^Q9E+?u>Vzd!y&o<n+EwYR8l%CQjJ=@u29>_hrzI%E}+-cV2F6Ymt>o&P@9}<Ekev
zB%n!ytsf@yl3JF$eDqjCk!sG{HTIH(Na}cQ>wQh9x_ZWcZz#7E^<^?Vy0=T?u`3MM
z(hlSr-#E2tE_>ziyR>HQ@D~aXW}mp*6DJL5(x&f+$#$-`pv$!TlQ*B4+KuEBTN4+W
z_B!KAw9^l6YCF2Ddw*Xh8@BG8T0D4G%HGbd(@Po_tjHblQciE_noV`x%25k8&VI)e
z7aY)}@E+>>jk9a*p)n&$-&|I^@17Lf@~A)Bhkj7mG-}aDf6kqzIlp$?qkWmoDM_qp
zzSiSe{lN9wuJ{s^)MJgR8``=wFXz%n7oPrMttT!hph+X@hsguIdn#Jfzi98BalU!k
z)sgQ;EAlSSJe2fh=jm;#XnOzaeVJT$Qq^)gR6g%qxBkKPkE*{OQZ=Wk^{;Pd7er^I
zZde~y?-@>oX!H$tSMe^_+{$YE6sjb@>dLc{dfBS^9X-jZUu_+0M;;F<7q2=IXyz>!
zp~xp2IyNakRCOdi_4=wEO^<o5oqsF5Lw9yd;nFkbOW&*i7n?D%u$he$C`YiAN|dT*
z)Az40ub()h;1|ugmEF?F#cb4O=YnVVoO}EJwzfgm`S|buaymvrU!WhRW9W_aJi483
zrVH+rOFj4m0zd!=00AHX1b_e#00KY&2mk>f@E-{b4K`D^{{&GUuxttqRJIvpfyxG3
aNT9M!FAY>S@WFw~MiitB)`a;#m-rj=KB=Yv

literal 0
HcmV?d00001

diff --git a/src/test/ssl/ssl/nss/server_ca.crt.db/pkcs11.txt b/src/test/ssl/ssl/nss/server_ca.crt.db/pkcs11.txt
new file mode 100644
index 0000000000..b81ced09e6
--- /dev/null
+++ b/src/test/ssl/ssl/nss/server_ca.crt.db/pkcs11.txt
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:ssl/nss/server_ca.crt.db' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
diff --git a/src/test/ssl/t/001_ssltests.pl b/src/test/ssl/t/001_ssltests.pl
index fd2727b568..00530d98af 100644
--- a/src/test/ssl/t/001_ssltests.pl
+++ b/src/test/ssl/t/001_ssltests.pl
@@ -4,15 +4,22 @@ use PostgresNode;
 use TestLib;
 use Test::More;
 
-use File::Copy;
-
 use FindBin;
 use lib $FindBin::RealBin;
 
-use SSLServer;
+use SSL::Server;
+
+my $openssl;
+my $nss;
 
 if ($ENV{with_openssl} eq 'yes')
 {
+	$openssl = 1;
+	plan tests => 93;
+}
+elsif ($ENV{with_nss} eq 'yes')
+{
+	$nss = 1;
 	plan tests => 93;
 }
 else
@@ -32,32 +39,6 @@ my $SERVERHOSTCIDR = '127.0.0.1/32';
 # Allocation of base connection string shared among multiple tests.
 my $common_connstr;
 
-# The client's private key must not be world-readable, so take a copy
-# of the key stored in the code tree and update its permissions.
-#
-# This changes ssl/client.key to ssl/client_tmp.key etc for the rest
-# of the tests.
-my @keys = (
-	"client",     "client-revoked",
-	"client-der", "client-encrypted-pem",
-	"client-encrypted-der");
-foreach my $key (@keys)
-{
-	copy("ssl/${key}.key", "ssl/${key}_tmp.key")
-	  or die
-	  "couldn't copy ssl/${key}.key to ssl/${key}_tmp.key for permissions change: $!";
-	chmod 0600, "ssl/${key}_tmp.key"
-	  or die "failed to change permissions on ssl/${key}_tmp.key: $!";
-}
-
-# Also make a copy of that explicitly world-readable.  We can't
-# necessarily rely on the file in the source tree having those
-# permissions.  Add it to @keys to include it in the final clean
-# up phase.
-copy("ssl/client.key", "ssl/client_wrongperms_tmp.key");
-chmod 0644, "ssl/client_wrongperms_tmp.key";
-push @keys, 'client_wrongperms';
-
 #### Set up the server.
 
 note "setting up data directory";
@@ -72,32 +53,28 @@ $node->start;
 
 # Run this before we lock down access below.
 my $result = $node->safe_psql('postgres', "SHOW ssl_library");
-is($result, 'OpenSSL', 'ssl_library parameter');
+is($result, SSL::Server::ssl_library(), 'ssl_library parameter');
 
 configure_test_server_for_ssl($node, $SERVERHOSTADDR, $SERVERHOSTCIDR,
 	'trust');
 
 note "testing password-protected keys";
 
-open my $sslconf, '>', $node->data_dir . "/sslconfig.conf";
-print $sslconf "ssl=on\n";
-print $sslconf "ssl_cert_file='server-cn-only.crt'\n";
-print $sslconf "ssl_key_file='server-password.key'\n";
-print $sslconf "ssl_passphrase_command='echo wrongpassword'\n";
-close $sslconf;
-
-command_fails(
-	[ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
-	'restart fails with password-protected key file with wrong password');
-$node->_update_pid(0);
-
-open $sslconf, '>', $node->data_dir . "/sslconfig.conf";
-print $sslconf "ssl=on\n";
-print $sslconf "ssl_cert_file='server-cn-only.crt'\n";
-print $sslconf "ssl_key_file='server-password.key'\n";
-print $sslconf "ssl_passphrase_command='echo secret1'\n";
-close $sslconf;
+SKIP:
+{
+	skip "Certificate passphrases aren't checked on server restart in NSS", 1
+	  if ($nss);
+
+	set_server_cert($node, 'server-cn-only', 'root+client_ca',
+					   'server-password', 'echo wrongpassword');
+	command_fails(
+		[ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
+		'restart fails with password-protected key file with wrong password');
+	$node->_update_pid(0);
+}
 
+set_server_cert($node, 'server-cn-only', 'root+client_ca',
+				'server-password', 'echo secret1');
 command_ok(
 	[ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
 	'restart succeeds with password-protected key file');
@@ -149,82 +126,105 @@ test_connect_ok(
 test_connect_fails(
 	$common_connstr,
 	"sslrootcert=invalid sslmode=verify-ca",
-	qr/root certificate file "invalid" does not exist/,
+	qr/root certificate file "invalid" does not exist|could not connect to server/,
 	"connect without server root cert sslmode=verify-ca");
 test_connect_fails(
 	$common_connstr,
 	"sslrootcert=invalid sslmode=verify-full",
-	qr/root certificate file "invalid" does not exist/,
+	qr/root certificate file "invalid" does not exist|could not connect to server/,
 	"connect without server root cert sslmode=verify-full");
 
 # Try with wrong root cert, should fail. (We're using the client CA as the
 # root, but the server's key is signed by the server CA.)
-test_connect_fails($common_connstr,
-	"sslrootcert=ssl/client_ca.crt sslmode=require",
-	qr/SSL error/, "connect with wrong server root cert sslmode=require");
-test_connect_fails($common_connstr,
-	"sslrootcert=ssl/client_ca.crt sslmode=verify-ca",
-	qr/SSL error/, "connect with wrong server root cert sslmode=verify-ca");
-test_connect_fails($common_connstr,
-	"sslrootcert=ssl/client_ca.crt sslmode=verify-full",
-	qr/SSL error/, "connect with wrong server root cert sslmode=verify-full");
-
-# Try with just the server CA's cert. This fails because the root file
-# must contain the whole chain up to the root CA.
-test_connect_fails($common_connstr,
-	"sslrootcert=ssl/server_ca.crt sslmode=verify-ca",
-	qr/SSL error/, "connect with server CA cert, without root CA");
+test_connect_fails(
+	$common_connstr,
+	"sslrootcert=ssl/client_ca.crt sslmode=require cert_database=ssl/nss/client_ca.crt.db",
+	qr/SSL error/,
+	"connect with wrong server root cert sslmode=require");
+test_connect_fails(
+	$common_connstr,
+	"sslrootcert=ssl/client_ca.crt sslmode=verify-ca cert_database=ssl/nss/client_ca.crt.db",
+	qr/SSL error/,
+	"connect with wrong server root cert sslmode=verify-ca");
+test_connect_fails(
+	$common_connstr,
+	"sslrootcert=ssl/client_ca.crt sslmode=verify-full cert_database=ssl/nss/client_ca.crt.db",
+	qr/SSL error/,
+	"connect with wrong server root cert sslmode=verify-full");
+
+SKIP:
+{
+	# NSS supports partial chain validation, so this test doesnt work there.
+	# This is similar to the OpenSSL option X509_V_FLAG_PARTIAL_CHAIN which
+	# we don't allow.
+	skip "NSS support partial chain validation", 2 if ($nss);
+	# Try with just the server CA's cert. This fails because the root file
+	# must contain the whole chain up to the root CA.
+	test_connect_fails($common_connstr,
+		"sslrootcert=ssl/server_ca.crt sslmode=verify-ca",
+		qr/SSL error/, "connect with server CA cert, without root CA");
+}
 
 # And finally, with the correct root cert.
 test_connect_ok(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=require",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=require cert_database=ssl/nss/root+server_ca.crt.db",
 	"connect with correct server CA cert file sslmode=require");
 test_connect_ok(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca cert_database=ssl/nss/root+server_ca.crt.db",
 	"connect with correct server CA cert file sslmode=verify-ca");
 test_connect_ok(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-full",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-full cert_database=ssl/nss/root+server_ca.crt.db",
 	"connect with correct server CA cert file sslmode=verify-full");
 
-# Test with cert root file that contains two certificates. The client should
-# be able to pick the right one, regardless of the order in the file.
-test_connect_ok(
-	$common_connstr,
-	"sslrootcert=ssl/both-cas-1.crt sslmode=verify-ca",
-	"cert root file that contains two certificates, order 1");
-test_connect_ok(
-	$common_connstr,
-	"sslrootcert=ssl/both-cas-2.crt sslmode=verify-ca",
-	"cert root file that contains two certificates, order 2");
+SKIP:
+{
+	skip "CA ordering is irrelevant in NSS databases", 2 if ($nss);
 
+	# Test with cert root file that contains two certificates. The client should
+	# be able to pick the right one, regardless of the order in the file.
+	test_connect_ok(
+		$common_connstr,
+		"sslrootcert=ssl/both-cas-1.crt sslmode=verify-ca",
+		"cert root file that contains two certificates, order 1");
+
+	# How about import the both-file into a database?
+	test_connect_ok(
+		$common_connstr,
+		"sslrootcert=ssl/both-cas-2.crt sslmode=verify-ca",
+		"cert root file that contains two certificates, order 2");
+}
 # CRL tests
 
 # Invalid CRL filename is the same as no CRL, succeeds
 test_connect_ok(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=invalid",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=invalid cert_database=ssl/nss/root+server_ca.crt.db",
 	"sslcrl option with invalid file name");
 
-# A CRL belonging to a different CA is not accepted, fails
-test_connect_fails(
-	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/client.crl",
-	qr/SSL error/,
-	"CRL belonging to a different CA");
+SKIP:
+{
+	skip "CRL's are verified when adding to NSS database", 2 if ($nss);
+	# A CRL belonging to a different CA is not accepted, fails
+	test_connect_fails(
+		$common_connstr,
+		"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/client.crl",
+		qr/SSL error/,
+		"CRL belonging to a different CA");
+}
 
 # With the correct CRL, succeeds (this cert is not revoked)
 test_connect_ok(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl cert_database=ssl/nss/root+server_ca.crt__root+server.crl.db",
 	"CRL with a non-revoked cert");
 
 # Check that connecting with verify-full fails, when the hostname doesn't
 # match the hostname in the server's certificate.
 $common_connstr =
-  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
+  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR cert_database=ssl/nss/root+server_ca.crt.db";
 
 test_connect_ok(
 	$common_connstr,
@@ -237,14 +237,14 @@ test_connect_ok(
 test_connect_fails(
 	$common_connstr,
 	"sslmode=verify-full host=wronghost.test",
-	qr/\Qserver certificate for "common-name.pg-ssltest.test" does not match host name "wronghost.test"\E/,
+	qr/\Qserver certificate for "common-name.pg-ssltest.test" does not match host name "wronghost.test"\E|SSL_ERROR_BAD_CERT_DOMAIN/,
 	"mismatch between host name and server certificate sslmode=verify-full");
 
 # Test Subject Alternative Names.
 switch_server_cert($node, 'server-multiple-alt-names');
 
 $common_connstr =
-  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
+  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full cert_database=ssl/nss/root+server_ca.crt.db";
 
 test_connect_ok(
 	$common_connstr,
@@ -262,12 +262,12 @@ test_connect_ok(
 test_connect_fails(
 	$common_connstr,
 	"host=wronghost.alt-name.pg-ssltest.test",
-	qr/\Qserver certificate for "dns1.alt-name.pg-ssltest.test" (and 2 other names) does not match host name "wronghost.alt-name.pg-ssltest.test"\E/,
+	qr/\Qserver certificate for "dns1.alt-name.pg-ssltest.test" (and 2 other names) does not match host name "wronghost.alt-name.pg-ssltest.test"\E|SSL_ERROR_BAD_CERT_DOMAIN/,
 	"host name not matching with X.509 Subject Alternative Names");
 test_connect_fails(
 	$common_connstr,
 	"host=deep.subdomain.wildcard.pg-ssltest.test",
-	qr/\Qserver certificate for "dns1.alt-name.pg-ssltest.test" (and 2 other names) does not match host name "deep.subdomain.wildcard.pg-ssltest.test"\E/,
+	qr/\Qserver certificate for "dns1.alt-name.pg-ssltest.test" (and 2 other names) does not match host name "deep.subdomain.wildcard.pg-ssltest.test"\E|SSL_ERROR_BAD_CERT_DOMAIN/,
 	"host name not matching with X.509 Subject Alternative Names wildcard");
 
 # Test certificate with a single Subject Alternative Name. (this gives a
@@ -275,7 +275,7 @@ test_connect_fails(
 switch_server_cert($node, 'server-single-alt-name');
 
 $common_connstr =
-  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
+  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full cert_database=ssl/nss/root+server_ca.crt.db";
 
 test_connect_ok(
 	$common_connstr,
@@ -285,12 +285,12 @@ test_connect_ok(
 test_connect_fails(
 	$common_connstr,
 	"host=wronghost.alt-name.pg-ssltest.test",
-	qr/\Qserver certificate for "single.alt-name.pg-ssltest.test" does not match host name "wronghost.alt-name.pg-ssltest.test"\E/,
+	qr/\Qserver certificate for "single.alt-name.pg-ssltest.test" does not match host name "wronghost.alt-name.pg-ssltest.test"\E|SSL_ERROR_BAD_CERT_DOMAIN/,
 	"host name not matching with a single X.509 Subject Alternative Name");
 test_connect_fails(
 	$common_connstr,
 	"host=deep.subdomain.wildcard.pg-ssltest.test",
-	qr/\Qserver certificate for "single.alt-name.pg-ssltest.test" does not match host name "deep.subdomain.wildcard.pg-ssltest.test"\E/,
+	qr/\Qserver certificate for "single.alt-name.pg-ssltest.test" does not match host name "deep.subdomain.wildcard.pg-ssltest.test"\E|SSL_ERROR_BAD_CERT_DOMAIN/,
 	"host name not matching with a single X.509 Subject Alternative Name wildcard"
 );
 
@@ -299,7 +299,7 @@ test_connect_fails(
 switch_server_cert($node, 'server-cn-and-alt-names');
 
 $common_connstr =
-  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full";
+  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR sslmode=verify-full cert_database=ssl/nss/root+server_ca.crt.db";
 
 test_connect_ok(
 	$common_connstr,
@@ -312,14 +312,14 @@ test_connect_ok(
 test_connect_fails(
 	$common_connstr,
 	"host=common-name.pg-ssltest.test",
-	qr/\Qserver certificate for "dns1.alt-name.pg-ssltest.test" (and 1 other name) does not match host name "common-name.pg-ssltest.test"\E/,
+	qr/\Qserver certificate for "dns1.alt-name.pg-ssltest.test" (and 1 other name) does not match host name "common-name.pg-ssltest.test"\E|SSL_ERROR_BAD_CERT_DOMAIN/,
 	"certificate with both a CN and SANs ignores CN");
 
 # Finally, test a server certificate that has no CN or SANs. Of course, that's
 # not a very sensible certificate, but libpq should handle it gracefully.
 switch_server_cert($node, 'server-no-names');
 $common_connstr =
-  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
+  "user=ssltestuser dbname=trustdb sslcert=invalid sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR cert_database=ssl/nss/root+server_ca.crt.db";
 
 test_connect_ok(
 	$common_connstr,
@@ -328,7 +328,7 @@ test_connect_ok(
 test_connect_fails(
 	$common_connstr,
 	"sslmode=verify-full host=common-name.pg-ssltest.test",
-	qr/could not get server's host name from server certificate/,
+	qr/could not get server's host name from server certificate|SSL_ERROR_BAD_CERT_DOMAIN/,
 	"server certificate without CN or SANs sslmode=verify-full");
 
 # Test that the CRL works
@@ -340,11 +340,11 @@ $common_connstr =
 # Without the CRL, succeeds. With it, fails.
 test_connect_ok(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca cert_database=ssl/nss/root+server_ca.crt.db",
 	"connects without client-side CRL");
 test_connect_fails(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/root+server.crl",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=verify-ca sslcrl=ssl/server.crl cert_database=ssl/nss/root+server_ca.crt__server.crl.db",
 	qr/SSL error/,
 	"does not connect with client-side CRL");
 
@@ -365,21 +365,21 @@ command_like(
 # Test min/max SSL protocol versions.
 test_connect_ok(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=require ssl_min_protocol_version=TLSv1.2 ssl_max_protocol_version=TLSv1.2",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=require ssl_min_protocol_version=TLSv1.2 ssl_max_protocol_version=TLSv1.2 cert_database=ssl/nss/root+server_ca.crt.db",
 	"connection success with correct range of TLS protocol versions");
 test_connect_fails(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=require ssl_min_protocol_version=TLSv1.2 ssl_max_protocol_version=TLSv1.1",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=require ssl_min_protocol_version=TLSv1.2 ssl_max_protocol_version=TLSv1.1 cert_database=ssl/nss/root+server_ca.crt.db",
 	qr/invalid SSL protocol version range/,
 	"connection failure with incorrect range of TLS protocol versions");
 test_connect_fails(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=require ssl_min_protocol_version=incorrect_tls",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=require ssl_min_protocol_version=incorrect_tls cert_database=ssl/nss/root+server_ca.crt.db",
 	qr/invalid ssl_min_protocol_version value/,
 	"connection failure with an incorrect SSL protocol minimum bound");
 test_connect_fails(
 	$common_connstr,
-	"sslrootcert=ssl/root+server_ca.crt sslmode=require ssl_max_protocol_version=incorrect_tls",
+	"sslrootcert=ssl/root+server_ca.crt sslmode=require ssl_max_protocol_version=incorrect_tls cert_database=ssl/nss/root+server_ca.crt.db",
 	qr/invalid ssl_max_protocol_version value/,
 	"connection failure with an incorrect SSL protocol maximum bound");
 
@@ -390,7 +390,7 @@ test_connect_fails(
 note "running server tests";
 
 $common_connstr =
-  "sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR";
+  "sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR cert_database=ssl/nss/client.crt__client.key.db";
 
 # no client cert
 test_connect_fails(
@@ -406,32 +406,43 @@ test_connect_ok(
 	"certificate authorization succeeds with correct client cert in PEM format"
 );
 
-# correct client cert in unencrypted DER
-test_connect_ok(
-	$common_connstr,
-	"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-der_tmp.key",
-	"certificate authorization succeeds with correct client cert in DER format"
-);
+$common_connstr =
+  "sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR";
+
+SKIP:
+{
+	skip "NSS database not implemented in the Makefile", 1 if ($nss);
+	# correct client cert in unencrypted DER
+	test_connect_ok(
+		$common_connstr,
+		"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-der_tmp.key",
+		"certificate authorization succeeds with correct client cert in DER format"
+	);
+}
 
 # correct client cert in encrypted PEM
 test_connect_ok(
 	$common_connstr,
-	"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-pem_tmp.key sslpassword='dUmmyP^#+'",
+	"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-pem_tmp.key sslpassword='dUmmyP^#+' cert_database=ssl/nss/client.crt__client-encrypted-pem.key.db",
 	"certificate authorization succeeds with correct client cert in encrypted PEM format"
 );
 
-# correct client cert in encrypted DER
-test_connect_ok(
-	$common_connstr,
-	"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-der_tmp.key sslpassword='dUmmyP^#+'",
-	"certificate authorization succeeds with correct client cert in encrypted DER format"
-);
+SKIP:
+{
+	skip "NSS database not implemented in the Makefile", 1 if ($nss);
+	# correct client cert in encrypted DER
+	test_connect_ok(
+		$common_connstr,
+		"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-der_tmp.key sslpassword='dUmmyP^#+'",
+		"certificate authorization succeeds with correct client cert in encrypted DER format"
+	);
+}
 
 # correct client cert in encrypted PEM with wrong password
 test_connect_fails(
 	$common_connstr,
-	"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-pem_tmp.key sslpassword='wrong'",
-	qr!\Qprivate key file "ssl/client-encrypted-pem_tmp.key": bad decrypt\E!,
+	"user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client-encrypted-pem_tmp.key sslpassword='wrong' cert_database=ssl/nss/client.crt__client-encrypted-pem.key.db",
+	qr!connection requires a valid client certificate|\Qprivate key file "ssl/client-encrypted-pem_tmp.key": bad decrypt\E!,
 	"certificate authorization fails with correct client cert and wrong password in encrypted PEM format"
 );
 
@@ -471,18 +482,19 @@ command_like(
 		'-P',
 		'null=_null_',
 		'-d',
-		"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
+		"$common_connstr user=ssltestuser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key cert_database=ssl/nss/client.crt__client.key.db",
 		'-c',
 		"SELECT * FROM pg_stat_ssl WHERE pid = pg_backend_pid()"
 	],
 	qr{^pid,ssl,version,cipher,bits,compression,client_dn,client_serial,issuer_dn\r?\n
-				^\d+,t,TLSv[\d.]+,[\w-]+,\d+,f,/CN=ssltestuser,1,\Q/CN=Test CA for PostgreSQL SSL regression test client certs\E\r?$}mx,
+				^\d+,t,TLSv[\d.]+,[\w-]+,\d+,f,/?CN=ssltestuser,1,/?\QCN=Test CA for PostgreSQL SSL regression test client certs\E\r?$}mx,
 	'pg_stat_ssl with client certificate');
 
 # client key with wrong permissions
 SKIP:
 {
 	skip "Permissions check not enforced on Windows", 2 if ($windows_os);
+	skip "Key not on filesystem with NSS",            2 if ($nss);
 
 	test_connect_fails(
 		$common_connstr,
@@ -495,10 +507,13 @@ SKIP:
 test_connect_fails(
 	$common_connstr,
 	"user=anotheruser sslcert=ssl/client.crt sslkey=ssl/client_tmp.key",
-	qr/certificate authentication failed for user "anotheruser"/,
+	qr/unable to verify certificate|certificate authentication failed for user "anotheruser"/,
 	"certificate authorization fails with client cert belonging to another user"
 );
 
+$common_connstr =
+  "sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=certdb hostaddr=$SERVERHOSTADDR cert_database=ssl/nss/client-revoked.crt__client-revoked.key.db";
+
 # revoked client cert
 test_connect_fails(
 	$common_connstr,
@@ -510,7 +525,7 @@ test_connect_fails(
 # works, iff username matches Common Name
 # fails, iff username doesn't match Common Name.
 $common_connstr =
-  "sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR";
+  "sslrootcert=ssl/root+server_ca.crt sslmode=require dbname=verifydb hostaddr=$SERVERHOSTADDR cert_database=ssl/nss/client.crt__client.key.db";
 
 test_connect_ok(
 	$common_connstr,
@@ -536,17 +551,23 @@ test_connect_ok(
 # intermediate client_ca.crt is provided by client, and isn't in server's ssl_ca_file
 switch_server_cert($node, 'server-cn-only', 'root_ca');
 $common_connstr =
-  "user=ssltestuser dbname=certdb sslkey=ssl/client_tmp.key sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR";
+  "user=ssltestuser dbname=certdb sslkey=ssl/client_tmp.key sslrootcert=ssl/root+server_ca.crt hostaddr=$SERVERHOSTADDR cert_database=ssl/nss/client+client_ca.crt__client.key.db";
 
-test_connect_ok(
+TODO:
+{
+	local $TODO = "WIP failure cause currently unknown";
+	test_connect_ok(
+		$common_connstr,
+		"sslmode=require sslcert=ssl/client+client_ca.crt",
+		"intermediate client certificate is provided by client");
+}
+
+test_connect_fails(
 	$common_connstr,
-	"sslmode=require sslcert=ssl/client+client_ca.crt",
-	"intermediate client certificate is provided by client");
-test_connect_fails($common_connstr, "sslmode=require sslcert=ssl/client.crt",
-	qr/SSL error/, "intermediate client certificate is missing");
+	"sslmode=require sslcert=ssl/client.crt",
+	qr/connection requires a valid client certificate|SSL error/,
+	"intermediate client certificate is missing");
 
 # clean up
-foreach my $key (@keys)
-{
-	unlink("ssl/${key}_tmp.key");
-}
+
+SSL::Server::cleanup();
diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl
index 01231f8ba0..4ea81fdbcf 100644
--- a/src/test/ssl/t/002_scram.pl
+++ b/src/test/ssl/t/002_scram.pl
@@ -11,11 +11,11 @@ use File::Copy;
 use FindBin;
 use lib $FindBin::RealBin;
 
-use SSLServer;
+use SSL::Server;
 
 if ($ENV{with_openssl} ne 'yes')
 {
-	plan skip_all => 'SSL not supported by this build';
+	plan skip_all => 'OpenSSL not supported by this build';
 }
 
 # This is the hostname used to connect to the server.
diff --git a/src/test/ssl/t/SSL/Backend/NSS.pm b/src/test/ssl/t/SSL/Backend/NSS.pm
new file mode 100644
index 0000000000..837f0d9891
--- /dev/null
+++ b/src/test/ssl/t/SSL/Backend/NSS.pm
@@ -0,0 +1,64 @@
+package SSL::Backend::NSS;
+
+use strict;
+use warnings;
+use Exporter;
+
+our @ISA       = qw(Exporter);
+our @EXPORT_OK = qw(get_new_nss_backend);
+
+sub new
+{
+	my ($class) = @_;
+
+	my $self = { _library => 'NSS' };
+
+	bless $self, $class;
+
+	return $self;
+}
+
+sub get_new_nss_backend
+{
+	my $class = 'SSL::Backend::NSS';
+
+	return $class->new();
+}
+
+sub init
+{
+	# Make sure the certificate databases are in place?
+}
+
+sub get_library
+{
+	my ($self) = @_;
+
+	return $self->{_library};
+}
+
+sub set_server_cert
+{
+	my $self     = $_[0];
+	my $certfile = $_[1];
+	my $cafile   = $_[2];
+	my $keyfile  = $_[3];
+
+	my $cert_nickname = $certfile . '.crt__' . $keyfile . '.key';
+	my $cert_database = $cert_nickname . '.db';
+
+	my $sslconf =
+	    "ssl_ca_file='$cafile.crt'\n"
+	  . "ssl_cert_file='ssl/$certfile.crt'\n"
+	  . "ssl_crl_file=''\n"
+	  . "ssl_database='nss/$cert_database'\n";
+
+	return $sslconf;
+}
+
+sub cleanup
+{
+	# Something?
+}
+
+1;
diff --git a/src/test/ssl/t/SSL/Backend/OpenSSL.pm b/src/test/ssl/t/SSL/Backend/OpenSSL.pm
new file mode 100644
index 0000000000..62b11b7632
--- /dev/null
+++ b/src/test/ssl/t/SSL/Backend/OpenSSL.pm
@@ -0,0 +1,103 @@
+package SSL::Backend::OpenSSL;
+
+use strict;
+use warnings;
+use Exporter;
+use File::Copy;
+
+our @ISA       = qw(Exporter);
+our @EXPORT_OK = qw(get_new_openssl_backend);
+
+our (@keys);
+
+INIT
+{
+	@keys = (
+		"client",     "client-revoked",
+		"client-der", "client-encrypted-pem",
+		"client-encrypted-der");
+}
+
+sub new
+{
+	my ($class) = @_;
+
+	my $self = { _library => 'OpenSSL' };
+
+	bless $self, $class;
+
+	return $self;
+}
+
+sub get_new_openssl_backend
+{
+	my $class = 'SSL::Backend::OpenSSL';
+
+	my $backend = $class->new();
+
+	return $backend;
+}
+
+sub init
+{
+	# The client's private key must not be world-readable, so take a copy
+	# of the key stored in the code tree and update its permissions.
+	#
+	# This changes ssl/client.key to ssl/client_tmp.key etc for the rest
+	# of the tests.
+	foreach my $key (@keys)
+	{
+		copy("ssl/${key}.key", "ssl/${key}_tmp.key")
+		  or die
+		  "couldn't copy ssl/${key}.key to ssl/${key}_tmp.key for permissions change: $!";
+		chmod 0600, "ssl/${key}_tmp.key"
+		  or die "failed to change permissions on ssl/${key}_tmp.key: $!";
+	}
+
+	# Also make a copy of that explicitly world-readable.  We can't
+	# necessarily rely on the file in the source tree having those
+	# permissions. Add it to @keys to include it in the final clean
+	# up phase.
+	copy("ssl/client.key", "ssl/client_wrongperms_tmp.key")
+	  or die
+	  "couldn't copy ssl/client.key to ssl/client_wrongperms_tmp.key: $!";
+	chmod 0644, "ssl/client_wrongperms_tmp.key"
+	  or die
+	  "failed to change permissions on ssl/client_wrongperms_tmp.key: $!";
+	push @keys, 'client_wrongperms';
+}
+
+# Change the configuration to use given server cert file, and reload
+# the server so that the configuration takes effect.
+sub set_server_cert
+{
+	my $self     = $_[0];
+	my $certfile = $_[1];
+	my $cafile   = $_[2] || "root+client_ca";
+	my $keyfile  = $_[3] || $certfile;
+
+	my $sslconf =
+	    "ssl_ca_file='$cafile.crt'\n"
+	  . "ssl_cert_file='$certfile.crt'\n"
+	  . "ssl_key_file='$keyfile.key'\n"
+	  . "ssl_crl_file='root+client.crl'\n";
+
+	return $sslconf;
+}
+
+sub get_library
+{
+	my ($self) = @_;
+
+	return $self->{_library};
+}
+
+sub cleanup
+{
+	foreach my $key (@keys)
+	{
+		unlink("ssl/${key}_tmp.key");
+	}
+}
+
+1;
diff --git a/src/test/ssl/t/SSLServer.pm b/src/test/ssl/t/SSL/Server.pm
similarity index 78%
rename from src/test/ssl/t/SSLServer.pm
rename to src/test/ssl/t/SSL/Server.pm
index 1e392b8fbf..679969902e 100644
--- a/src/test/ssl/t/SSLServer.pm
+++ b/src/test/ssl/t/SSL/Server.pm
@@ -24,19 +24,39 @@
 # explicitly because an invalid sslcert or sslrootcert, respectively,
 # causes those to be ignored.)
 
-package SSLServer;
+package SSL::Server;
 
 use strict;
 use warnings;
 use PostgresNode;
+use RecursiveCopy;
 use TestLib;
 use File::Basename;
 use File::Copy;
 use Test::More;
+use SSL::Backend::OpenSSL qw(get_new_openssl_backend);
+use SSL::Backend::NSS qw(get_new_nss_backend);
+
+our ($openssl, $nss, $backend);
+
+# The TLS backend which the server is using should be mostly transparent for
+# the user, apart from individual configuration settings, so keep the backend
+# specific things abstracted behind SSL::Server.
+if ($ENV{with_openssl} eq 'yes')
+{
+	$backend = get_new_openssl_backend();
+	$openssl = 1;
+}
+elsif ($ENV{with_nss} eq 'yes')
+{
+	$backend = get_new_nss_backend();
+	$nss     = 1;
+}
 
 use Exporter 'import';
 our @EXPORT = qw(
   configure_test_server_for_ssl
+  set_server_cert
   switch_server_cert
   test_connect_fails
   test_connect_ok
@@ -145,12 +165,19 @@ sub configure_test_server_for_ssl
 	close $sslconf;
 
 	# Copy all server certificates and keys, and client root cert, to the data dir
-	copy_files("ssl/server-*.crt", $pgdata);
-	copy_files("ssl/server-*.key", $pgdata);
-	chmod(0600, glob "$pgdata/server-*.key") or die $!;
-	copy_files("ssl/root+client_ca.crt", $pgdata);
-	copy_files("ssl/root_ca.crt",        $pgdata);
-	copy_files("ssl/root+client.crl",    $pgdata);
+	if (defined($openssl))
+	{
+		copy_files("ssl/server-*.crt", $pgdata);
+		copy_files("ssl/server-*.key", $pgdata);
+		chmod(0600, glob "$pgdata/server-*.key") or die $!;
+		copy_files("ssl/root+client_ca.crt", $pgdata);
+		copy_files("ssl/root_ca.crt",        $pgdata);
+		copy_files("ssl/root+client.crl",    $pgdata);
+	}
+	elsif (defined($nss))
+	{
+		RecursiveCopy::copypath("ssl/nss", $pgdata . "/nss") if -e "ssl/nss";
+	}
 
 	# Stop and restart server to load new listen_addresses.
 	$node->restart;
@@ -158,26 +185,51 @@ sub configure_test_server_for_ssl
 	# Change pg_hba after restart because hostssl requires ssl=on
 	configure_hba_for_ssl($node, $servercidr, $authmethod);
 
+	# Finally, perform backend specific configuration
+	$backend->init();
+
 	return;
 }
 
-# Change the configuration to use given server cert file, and reload
-# the server so that the configuration takes effect.
-sub switch_server_cert
+sub ssl_library
+{
+	return $backend->get_library();
+}
+
+sub cleanup
+{
+	$backend->cleanup();
+}
+
+# Change the configuration to use given server cert file,
+sub set_server_cert
 {
 	my $node     = $_[0];
 	my $certfile = $_[1];
 	my $cafile   = $_[2] || "root+client_ca";
+	my $keyfile  = $_[3] || '';
+	my $pwcmd    = $_[4] || '';
 	my $pgdata   = $node->data_dir;
 
+	$keyfile = $certfile if $keyfile eq '';
+
 	open my $sslconf, '>', "$pgdata/sslconfig.conf";
 	print $sslconf "ssl=on\n";
-	print $sslconf "ssl_ca_file='$cafile.crt'\n";
-	print $sslconf "ssl_cert_file='$certfile.crt'\n";
-	print $sslconf "ssl_key_file='$certfile.key'\n";
-	print $sslconf "ssl_crl_file='root+client.crl'\n";
+	print $sslconf $backend->set_server_cert($certfile, $cafile, $keyfile);
+	print $sslconf "ssl_passphrase_command='$pwcmd'\n"
+	  unless $pwcmd eq '';
 	close $sslconf;
+	return;
+}
 
+# Change the configuration to use given server cert file, and reload
+# the server so that the configuration takes effect.
+# Takes the same arguments as set_server_cert, which it calls to do that
+# piece of the work.
+sub switch_server_cert
+{
+	my $node = $_[0];
+	set_server_cert(@_);
 	$node->restart;
 	return;
 }
diff --git a/src/tools/msvc/Install.pm b/src/tools/msvc/Install.pm
index b6d0cfd39b..c53c59229e 100644
--- a/src/tools/msvc/Install.pm
+++ b/src/tools/msvc/Install.pm
@@ -438,7 +438,8 @@ sub CopyContribFiles
 		{
 			# These configuration-based exclusions must match vcregress.pl
 			next if ($d eq "uuid-ossp"  && !defined($config->{uuid}));
-			next if ($d eq "sslinfo"    && !defined($config->{openssl}));
+			next if ($d eq "sslinfo"    && !defined($config->{openssl})
+			  && !defined($config->{nss}));
 			next if ($d eq "xml2"       && !defined($config->{xml}));
 			next if ($d =~ /_plperl$/   && !defined($config->{perl}));
 			next if ($d =~ /_plpython$/ && !defined($config->{python}));
diff --git a/src/tools/msvc/Mkvcbuild.pm b/src/tools/msvc/Mkvcbuild.pm
index 20da7985c1..818a1922f3 100644
--- a/src/tools/msvc/Mkvcbuild.pm
+++ b/src/tools/msvc/Mkvcbuild.pm
@@ -192,12 +192,19 @@ sub mkvcbuild
 	$postgres->FullExportDLL('postgres.lib');
 
 	# The OBJS scraper doesn't know about ifdefs, so remove appropriate files
-	# if building without OpenSSL.
-	if (!$solution->{options}->{openssl})
+	# if building without various options.
+	if (!$solution->{options}->{openssl} && !$solution->{options}->{nss})
 	{
 		$postgres->RemoveFile('src/backend/libpq/be-secure-common.c');
+	}
+	if (!$solution->{options}->{openssl})
+	{
 		$postgres->RemoveFile('src/backend/libpq/be-secure-openssl.c');
 	}
+	if (!$solution->{options}->{nss})
+	{
+		$postgres->RemoveFile('src/backend/libpq/be-secure-nss.c');
+	}
 	if (!$solution->{options}->{gss})
 	{
 		$postgres->RemoveFile('src/backend/libpq/be-gssapi-common.c');
@@ -255,12 +262,19 @@ sub mkvcbuild
 	$libpq->AddReference($libpgcommon, $libpgport);
 
 	# The OBJS scraper doesn't know about ifdefs, so remove appropriate files
-	# if building without OpenSSL.
-	if (!$solution->{options}->{openssl})
+	# if building without various options
+	if (!$solution->{options}->{openssl} && !$solution->{options}->{nss})
 	{
 		$libpq->RemoveFile('src/interfaces/libpq/fe-secure-common.c');
+	}
+	if (!$solution->{options}->{openssl})
+	{
 		$libpq->RemoveFile('src/interfaces/libpq/fe-secure-openssl.c');
 	}
+	if (!$solution->{options}->{nss})
+	{
+		$libpq->RemoveFile('src/interfaces/libpq/fe-secure-nss.c');
+	}
 	if (!$solution->{options}->{gss})
 	{
 		$libpq->RemoveFile('src/interfaces/libpq/fe-gssapi-common.c');
@@ -428,9 +442,14 @@ sub mkvcbuild
 		push @contrib_excludes, 'xml2';
 	}
 
+	if (!$solution->{options}->{openssl} && !$solution->{options}->{nss})
+	{
+		push @contrib_excludes, 'sslinfo';
+	}
+
 	if (!$solution->{options}->{openssl})
 	{
-		push @contrib_excludes, 'sslinfo', 'ssl_passphrase_callback';
+		push @contrib_excludes, 'ssl_passphrase_callback';
 	}
 
 	if (!$solution->{options}->{uuid})
diff --git a/src/tools/msvc/Solution.pm b/src/tools/msvc/Solution.pm
index bc8904732f..ac11d9ab26 100644
--- a/src/tools/msvc/Solution.pm
+++ b/src/tools/msvc/Solution.pm
@@ -484,6 +484,7 @@ sub GenerateFiles
 		USE_NAMED_POSIX_SEMAPHORES => undef,
 		USE_OPENSSL                => undef,
 		USE_OPENSSL_RANDOM         => undef,
+		USE_NSS                    => undef,
 		USE_PAM                    => undef,
 		USE_SLICING_BY_8_CRC32C    => undef,
 		USE_SSE42_CRC32C           => undef,
@@ -537,6 +538,10 @@ sub GenerateFiles
 			$define{HAVE_OPENSSL_INIT_SSL}      = 1;
 		}
 	}
+	if ($self->{options}->{nss})
+	{
+		$define{USE_NSS} = 1;
+	}
 
 	$self->GenerateConfigHeader('src/include/pg_config.h',     \%define, 1);
 	$self->GenerateConfigHeader('src/include/pg_config_ext.h', \%define, 0);
@@ -1004,6 +1009,21 @@ sub AddProject
 			}
 		}
 	}
+	if ($self->{options}->{nss})
+	{
+		$proj->AddIncludeDir($self->{options}->{nss} . '\..\public\nss');
+		$proj->AddIncludeDir($self->{options}->{nss} . '\include\nspr');
+		foreach my $lib (qw(plds4 plc4 nspr4))
+		{
+			$proj->AddLibrary($self->{options}->{nss} .
+							  '\lib\lib' . "$lib.lib", 0);
+		}
+		foreach my $lib (qw(ssl3 smime3 nss3))
+		{
+			$proj->AddLibrary($self->{options}->{nss} .
+							  '\lib' . "\\$lib.dll.lib", 0);
+		}
+	}
 	if ($self->{options}->{nls})
 	{
 		$proj->AddIncludeDir($self->{options}->{nls} . '\include');
diff --git a/src/tools/msvc/config_default.pl b/src/tools/msvc/config_default.pl
index 2ef2cfc4e9..49dc4d5864 100644
--- a/src/tools/msvc/config_default.pl
+++ b/src/tools/msvc/config_default.pl
@@ -17,6 +17,7 @@ our $config = {
 	perl      => undef,    # --with-perl=<path>
 	python    => undef,    # --with-python=<path>
 	openssl   => undef,    # --with-openssl=<path>
+	nss       => undef,    # --with-nss=<path>
 	uuid      => undef,    # --with-uuid=<path>
 	xml       => undef,    # --with-libxml=<path>
 	xslt      => undef,    # --with-libxslt=<path>
-- 
2.25.4

--------------C29A190231AE8074F549FB7F--