diff --git a/nsprpub/configure b/nsprpub/configure
index f7036ff4b..b8ad2b4eb 100755
--- a/nsprpub/configure
+++ b/nsprpub/configure
@@ -2488,7 +2488,7 @@ test -n "$target_alias" &&
   program_prefix=${target_alias}-
 
 MOD_MAJOR_VERSION=4
-MOD_MINOR_VERSION=15
+MOD_MINOR_VERSION=16
 MOD_PATCH_VERSION=0
 NSPR_MODNAME=nspr20
 _HAVE_PTHREADS=
@@ -6560,6 +6560,11 @@ fi
 
     $as_echo "#define HAVE_POINTER_LOCALTIME_R 1" >>confdefs.h
 
+    HOST_DARWIN_MAJOR=`echo "$build_os" | sed -E -e 's/^darwin([0-9]+).*$/\1/'`
+    if test "$HOST_DARWIN_MAJOR" -ge 15 ; then
+        $as_echo "#define HAS_CONNECTX 1" >>confdefs.h
+    fi
+
     AS='$(CC) -x assembler-with-cpp'
     CFLAGS="$CFLAGS -Wall -fno-common"
     case "${target_cpu}" in
@@ -6709,6 +6714,8 @@ tools are selected during the Xcode/Developer Tools installation." "$LINENO" 5
 
     $as_echo "#define HAVE_SOCKLEN_T 1" >>confdefs.h
 
+    $as_echo "#define HAVE_POINTER_LOCALTIME_R 1" >>confdefs.h
+
     CFLAGS="$CFLAGS $(DSO_CFLAGS) -ansi -Wall"
     MOZ_OBJFORMAT=`test -x /usr/bin/objformat && /usr/bin/objformat || echo elf`
     if test "$MOZ_OBJFORMAT" = "elf"; then
@@ -7319,6 +7326,8 @@ $as_echo "$as_me: WARNING: Unknown version of the Microsoft (R) Manifest Tool."
 
     $as_echo "#define HAVE_SOCKLEN_T 1" >>confdefs.h
 
+    $as_echo "#define HAVE_POINTER_LOCALTIME_R 1" >>confdefs.h
+
     if test -z "$USE_NSPR_THREADS"; then
         USE_PTHREADS=1
     fi
@@ -7375,6 +7384,8 @@ $as_echo "$as_me: WARNING: Unknown version of the Microsoft (R) Manifest Tool."
 
     $as_echo "#define HAVE_SOCKLEN_T 1" >>confdefs.h
 
+    $as_echo "#define HAVE_POINTER_LOCALTIME_R 1" >>confdefs.h
+
     CFLAGS="$CFLAGS -ansi -Wall"
     CXXFLAGS="$CXXFLAGS -ansi -Wall"
     DLL_SUFFIX=so.1.0
diff --git a/nsprpub/configure.in b/nsprpub/configure.in
index 395fe2a88..22b4e7224 100644
--- a/nsprpub/configure.in
+++ b/nsprpub/configure.in
@@ -15,7 +15,7 @@ dnl ========================================================
 dnl = Defaults
 dnl ========================================================
 MOD_MAJOR_VERSION=4
-MOD_MINOR_VERSION=15
+MOD_MINOR_VERSION=16
 MOD_PATCH_VERSION=0
 NSPR_MODNAME=nspr20
 _HAVE_PTHREADS=
@@ -1384,6 +1384,12 @@ case "$target" in
     AC_DEFINE(HAVE_BSD_FLOCK)
     AC_DEFINE(HAVE_SOCKLEN_T)
     AC_DEFINE(HAVE_POINTER_LOCALTIME_R)
+    changequote(,)
+    HOST_DARWIN_MAJOR=`echo "$build_os" | sed -E -e 's/^darwin([0-9]+).*$/\1/'`
+    changequote([,])
+    if test "$HOST_DARWIN_MAJOR" -ge 15 ; then
+        AC_DEFINE(HAS_CONNECTX)
+    fi
     AS='$(CC) -x assembler-with-cpp'
     CFLAGS="$CFLAGS -Wall -fno-common"
     case "${target_cpu}" in
@@ -1554,6 +1560,7 @@ tools are selected during the Xcode/Developer Tools installation.])
     AC_DEFINE(FREEBSD)
     AC_DEFINE(HAVE_BSD_FLOCK)
     AC_DEFINE(HAVE_SOCKLEN_T)
+    AC_DEFINE(HAVE_POINTER_LOCALTIME_R)
     CFLAGS="$CFLAGS $(DSO_CFLAGS) -ansi -Wall"
     MOZ_OBJFORMAT=`test -x /usr/bin/objformat && /usr/bin/objformat || echo elf`
     if test "$MOZ_OBJFORMAT" = "elf"; then
@@ -2114,6 +2121,7 @@ tools are selected during the Xcode/Developer Tools installation.])
     AC_DEFINE(NETBSD)
     AC_DEFINE(HAVE_BSD_FLOCK)
     AC_DEFINE(HAVE_SOCKLEN_T)
+    AC_DEFINE(HAVE_POINTER_LOCALTIME_R)
     if test -z "$USE_NSPR_THREADS"; then
         USE_PTHREADS=1
     fi
@@ -2162,6 +2170,7 @@ tools are selected during the Xcode/Developer Tools installation.])
     AC_DEFINE(OPENBSD)
     AC_DEFINE(HAVE_BSD_FLOCK)
     AC_DEFINE(HAVE_SOCKLEN_T)
+    AC_DEFINE(HAVE_POINTER_LOCALTIME_R)
     CFLAGS="$CFLAGS -ansi -Wall"
     CXXFLAGS="$CXXFLAGS -ansi -Wall"
     DLL_SUFFIX=so.1.0
diff --git a/nsprpub/pr/include/md/_linux.cfg b/nsprpub/pr/include/md/_linux.cfg
index 8cbf0cb9b..b4c0ed427 100644
--- a/nsprpub/pr/include/md/_linux.cfg
+++ b/nsprpub/pr/include/md/_linux.cfg
@@ -498,6 +498,9 @@
 
 #elif defined(__mips__)
 
+/* For _ABI64 */
+#include <sgidefs.h>
+
 #ifdef __MIPSEB__
 #define IS_BIG_ENDIAN 1
 #undef  IS_LITTLE_ENDIAN
diff --git a/nsprpub/pr/include/md/_win95.h b/nsprpub/pr/include/md/_win95.h
index d65e26437..04f811d37 100644
--- a/nsprpub/pr/include/md/_win95.h
+++ b/nsprpub/pr/include/md/_win95.h
@@ -290,6 +290,9 @@ extern void _MD_MakeNonblock(PRFileDesc *f);
 extern PRInt32 _MD_CloseSocket(PROsfd osfd);
 #define _MD_CLOSE_SOCKET              _MD_CloseSocket
 #define _MD_SENDTO                    _PR_MD_SENDTO
+#ifdef _WIN64
+#define _MD_TCPSENDTO                 _PR_MD_TCPSENDTO
+#endif
 #define _MD_RECVFROM                  _PR_MD_RECVFROM
 #define _MD_SOCKETPAIR(s, type, proto, sv) -1
 #define _MD_GETSOCKNAME               _PR_MD_GETSOCKNAME
diff --git a/nsprpub/pr/include/prinit.h b/nsprpub/pr/include/prinit.h
index d3f2b7b2c..fd935ec30 100644
--- a/nsprpub/pr/include/prinit.h
+++ b/nsprpub/pr/include/prinit.h
@@ -31,9 +31,9 @@ PR_BEGIN_EXTERN_C
 ** The format of the version string is
 **     "<major version>.<minor version>[.<patch level>] [<Beta>]"
 */
-#define PR_VERSION  "4.15"
+#define PR_VERSION  "4.16"
 #define PR_VMAJOR   4
-#define PR_VMINOR   15
+#define PR_VMINOR   16
 #define PR_VPATCH   0
 #define PR_BETA     PR_FALSE
 
diff --git a/nsprpub/pr/include/private/primpl.h b/nsprpub/pr/include/private/primpl.h
index 63ba3ee46..dc24a2572 100644
--- a/nsprpub/pr/include/private/primpl.h
+++ b/nsprpub/pr/include/private/primpl.h
@@ -1225,6 +1225,13 @@ extern PRInt32 _PR_MD_SENDTO(
     const PRNetAddr *addr, PRUint32 addrlen, PRIntervalTime timeout);
 #define    _PR_MD_SENDTO _MD_SENDTO
 
+#if defined(_WIN64) && defined(WIN95)
+extern PRInt32 _PR_MD_TCPSENDTO(
+    PRFileDesc *fd, const void *buf, PRInt32 amount, PRIntn flags,
+    const PRNetAddr *addr, PRUint32 addrlen, PRIntervalTime timeout);
+#define    _PR_MD_TCPSENDTO _MD_TCPSENDTO
+#endif
+
 extern PRInt32 _PR_MD_SOCKETPAIR(int af, int type, int flags, PROsfd *osfd);
 #define    _PR_MD_SOCKETPAIR _MD_SOCKETPAIR
 
@@ -1747,6 +1754,18 @@ struct PRFilePrivate {
                          * requires knowing the address family of the 
 			 * socket, we save the address family here. */
 #endif
+
+#if defined(_WIN64)
+    /* This is necessary for TCP Fast Open. TCP Fast Open in windows must
+     * use ConnectEx function which uses OVERLAPPED. TCPSendTo will call
+     * ConnectEx to send fast open data. If ConnectEx returns
+     * ERROR_IO_PENDING we need to save OVERLAPPED structure and we will
+     * use it in ConnectContinue to get the final result of ConnectEx.
+     */
+    PRBool alreadyConnected;
+    PRBool overlappedActive;
+    OVERLAPPED ol;
+#endif
 };
 
 #ifdef _WIN64
diff --git a/nsprpub/pr/include/prtypes.h b/nsprpub/pr/include/prtypes.h
index ca140c702..94bca3cfc 100644
--- a/nsprpub/pr/include/prtypes.h
+++ b/nsprpub/pr/include/prtypes.h
@@ -245,16 +245,24 @@ PR_BEGIN_EXTERN_C
 #if PR_BYTES_PER_BYTE == 1
 typedef unsigned char PRUint8;
 /*
+** There are two scenarios that require us to define PRInt8 as type 'char'.
+** (1)
 ** Some cfront-based C++ compilers do not like 'signed char' and
 ** issue the warning message:
 **     warning: "signed" not implemented (ignored)
 ** For these compilers, we have to define PRInt8 as plain 'char'.
 ** Make sure that plain 'char' is indeed signed under these compilers.
+** (2)
+** Mozilla C++ code expects the PRInt{N} and int{N}_t types to match (see bug
+** 634793). If a platform defines int8_t as 'char', but NSPR defines it as
+** 'signed char', it results in a type mismatch.
+** On such platforms we define PRInt8 as 'char' to avoid the mismatch. 
 */
-#if (defined(HPUX) && defined(__cplusplus) \
+#if (defined(HPUX) && defined(__cplusplus) /* reason 1*/ \
         && !defined(__GNUC__) && __cplusplus < 199707L) \
-    || (defined(SCO) && defined(__cplusplus) \
-        && !defined(__GNUC__) && __cplusplus == 1L)
+    || (defined(SCO) && defined(__cplusplus) /* reason 1 */ \
+        && !defined(__GNUC__) && __cplusplus == 1L) \
+    || (defined(__sun) && defined(__cplusplus)) /* reason 2 */
 typedef char PRInt8;
 #else
 typedef signed char PRInt8;
diff --git a/nsprpub/pr/src/io/prio.c b/nsprpub/pr/src/io/prio.c
index 78cbdf564..bf9763a2c 100644
--- a/nsprpub/pr/src/io/prio.c
+++ b/nsprpub/pr/src/io/prio.c
@@ -119,6 +119,10 @@ PR_IMPLEMENT(PRFileDesc*) PR_AllocFileDesc(
         fd->methods = methods;
         fd->secret->state = _PR_FILEDESC_OPEN;
 	fd->secret->md.osfd = osfd;
+#if defined(_WIN64)
+        fd->secret->alreadyConnected = PR_FALSE;
+        fd->secret->overlappedActive = PR_FALSE;
+#endif
         _PR_MD_INIT_FILEDESC(fd);
     } else {
 	    PR_SetError(PR_OUT_OF_MEMORY_ERROR, 0);
diff --git a/nsprpub/pr/src/io/prlayer.c b/nsprpub/pr/src/io/prlayer.c
index c01a24524..00da0287a 100644
--- a/nsprpub/pr/src/io/prlayer.c
+++ b/nsprpub/pr/src/io/prlayer.c
@@ -47,7 +47,8 @@ static PRStatus PR_CALLBACK pl_TopClose (PRFileDesc *fd)
 		rv = fd->lower->methods->close(fd->lower);
 		_PR_DestroyIOLayer(fd);
 		return rv;
-	} else if ((fd->higher) && (PR_IO_LAYER_HEAD == fd->higher->identity)) {
+	}
+	if ((fd->higher) && (PR_IO_LAYER_HEAD == fd->higher->identity)) {
 		/*
 		 * lower layers of new style stack
 		 */
@@ -201,16 +202,16 @@ static PRFileDesc* PR_CALLBACK pl_TopAccept (
         return NULL;
     }
 
-    if (newstyle_stack) {
-		newstack->lower = newfd;
-		newfd->higher = newstack;
-		return newstack;
-	} else {
-		/* this PR_PushIOLayer call cannot fail */
-		rv = PR_PushIOLayer(newfd, PR_TOP_IO_LAYER, newstack);
-		PR_ASSERT(PR_SUCCESS == rv);
-    	return newfd;  /* that's it */
-	}
+    if (newstyle_stack)
+    {
+        newstack->lower = newfd;
+        newfd->higher = newstack;
+        return newstack;
+    }
+    /* this PR_PushIOLayer call cannot fail */
+    rv = PR_PushIOLayer(newfd, PR_TOP_IO_LAYER, newstack);
+    PR_ASSERT(PR_SUCCESS == rv);
+    return newfd;  /* that's it */
 }
 
 static PRStatus PR_CALLBACK pl_DefBind (PRFileDesc *fd, const PRNetAddr *addr)
@@ -326,12 +327,11 @@ static PRInt32 PR_CALLBACK pl_DefAcceptread (
 		(*nd)->higher = newstack;
 		*nd = newstack;
 		return nbytes;
-	} else {
-		/* this PR_PushIOLayer call cannot fail */
-		rv = PR_PushIOLayer(*nd, PR_TOP_IO_LAYER, newstack);
-		PR_ASSERT(PR_SUCCESS == rv);
-		return nbytes;
 	}
+    /* this PR_PushIOLayer call cannot fail */
+    rv = PR_PushIOLayer(*nd, PR_TOP_IO_LAYER, newstack);
+    PR_ASSERT(PR_SUCCESS == rv);
+    return nbytes;
 }
 
 static PRInt32 PR_CALLBACK pl_DefTransmitfile (
@@ -494,10 +494,9 @@ static PRStatus _PR_DestroyIOLayer(PRFileDesc *stack)
 {
     if (NULL == stack)
         return PR_FAILURE;
-    else {
-        PR_DELETE(stack);
-    	return PR_SUCCESS;
-    }
+
+    PR_DELETE(stack);
+    return PR_SUCCESS;
 }  /* _PR_DestroyIOLayer */
 
 PR_IMPLEMENT(PRStatus) PR_PushIOLayer(
@@ -704,8 +703,8 @@ PR_IMPLEMENT(PRDescIdentity) PR_GetLayersIdentity(PRFileDesc* fd)
     if (PR_IO_LAYER_HEAD == fd->identity) {
     	PR_ASSERT(NULL != fd->lower);
     	return fd->lower->identity;
-	} else
-    	return fd->identity;
+	}
+    return fd->identity;
 }  /* PR_GetLayersIdentity */
 
 PR_IMPLEMENT(PRFileDesc*) PR_GetIdentitiesLayer(PRFileDesc* fd, PRDescIdentity id)
@@ -713,10 +712,10 @@ PR_IMPLEMENT(PRFileDesc*) PR_GetIdentitiesLayer(PRFileDesc* fd, PRDescIdentity i
     PRFileDesc *layer = fd;
 
     if (PR_TOP_IO_LAYER == id) {
-    	if (PR_IO_LAYER_HEAD == fd->identity)
-			return fd->lower;
-		else 
-			return fd;
+      if (PR_IO_LAYER_HEAD == fd->identity) {
+          return fd->lower;
+      }
+      return fd;
 	}
 
     for (layer = fd; layer != NULL; layer = layer->lower)
diff --git a/nsprpub/pr/src/io/prmmap.c b/nsprpub/pr/src/io/prmmap.c
index 6ffc13305..64f7ed4e8 100644
--- a/nsprpub/pr/src/io/prmmap.c
+++ b/nsprpub/pr/src/io/prmmap.c
@@ -24,17 +24,16 @@ PR_IMPLEMENT(PRFileMap *) PR_CreateFileMap(
             || prot == PR_PROT_WRITECOPY);
     fmap = PR_NEWZAP(PRFileMap);
     if (NULL == fmap) {
-	PR_SetError(PR_OUT_OF_MEMORY_ERROR, 0);
-	return NULL;
+      PR_SetError(PR_OUT_OF_MEMORY_ERROR, 0);
+      return NULL;
     }
     fmap->fd = fd;
     fmap->prot = prot;
     if (_PR_MD_CREATE_FILE_MAP(fmap, size) == PR_SUCCESS) {
-	return fmap;
-    } else {
+      return fmap;
+    }
 	PR_DELETE(fmap);
 	return NULL;
-    }
 }
 
 PR_IMPLEMENT(PRInt32) PR_GetMemMapAlignment(void)
diff --git a/nsprpub/pr/src/io/prscanf.c b/nsprpub/pr/src/io/prscanf.c
index 9d75d824e..377a6e643 100644
--- a/nsprpub/pr/src/io/prscanf.c
+++ b/nsprpub/pr/src/io/prscanf.c
@@ -409,7 +409,8 @@ Convert(ScanfState *state, const char *fmt)
                 ch = GET(state);
                 if (ch == EOF) {
                     return NULL;
-                } else if (state->assign) {
+                }
+                if (state->assign) {
                     *cArg++ = ch;
                 }
             }
@@ -602,10 +603,9 @@ StringGetChar(void *stream)
 
     if (*cPtr == '\0') {
         return EOF;
-    } else {
-        *((char **) stream) = cPtr + 1;
-        return (unsigned char) *cPtr;
     }
+    *((char **) stream) = cPtr + 1;
+    return (unsigned char) *cPtr;
 }
 
 static void
diff --git a/nsprpub/pr/src/io/prsocket.c b/nsprpub/pr/src/io/prsocket.c
index bd0e1a451..a24b8e1bb 100644
--- a/nsprpub/pr/src/io/prsocket.c
+++ b/nsprpub/pr/src/io/prsocket.c
@@ -7,6 +7,12 @@
 
 #include <string.h>
 
+#if defined(_WIN64)
+#ifndef SO_UPDATE_CONNECT_CONTEXT
+#define SO_UPDATE_CONNECT_CONTEXT 0x7010
+#endif
+#endif
+
 /************************************************************************/
 
 /* These two functions are only used in assertions. */
@@ -305,6 +311,47 @@ static PRStatus PR_CALLBACK SocketConnectContinue(
 
     PR_ASSERT(out_flags & PR_POLL_WRITE);
 
+#if defined(_WIN64)
+    if (fd->secret->alreadyConnected) {
+        fd->secret->alreadyConnected = PR_FALSE;
+    }
+    /* TCP Fast Open on Windows must use ConnectEx, which uses overlapped
+     * input/output.
+     * To get result we need to use GetOverlappedResult. */
+    if (fd->secret->overlappedActive) {
+        PR_ASSERT(fd->secret->nonblocking);
+        PRInt32 rvSent;
+        if (GetOverlappedResult(osfd, &fd->secret->ol, &rvSent, FALSE) == TRUE) {
+            fd->secret->overlappedActive = PR_FALSE;
+            PR_LOG(_pr_io_lm, PR_LOG_MIN,
+               ("SocketConnectContinue GetOverlappedResult succeeded\n"));
+            /* When ConnectEx is used, all previously set socket options and
+             * property are not enabled and to enable them
+             * SO_UPDATE_CONNECT_CONTEXT option need to be set. */
+            if (setsockopt((SOCKET)osfd, SOL_SOCKET, SO_UPDATE_CONNECT_CONTEXT, NULL, 0) != 0) {
+                err = WSAGetLastError();
+                PR_LOG(_pr_io_lm, PR_LOG_MIN,
+                       ("SocketConnectContinue setting SO_UPDATE_CONNECT_CONTEXT failed %d\n", err));
+                _PR_MD_MAP_SETSOCKOPT_ERROR(err);
+                return PR_FAILURE;
+            }
+            return PR_SUCCESS;
+        } else {
+            err = WSAGetLastError();
+            PR_LOG(_pr_io_lm, PR_LOG_MIN,
+               ("SocketConnectContinue GetOverlappedResult failed %d\n", err));
+            if (err != ERROR_IO_INCOMPLETE) {
+                _PR_MD_MAP_CONNECT_ERROR(err);
+                fd->secret->overlappedActive = PR_FALSE;
+                return PR_FAILURE;
+            } else {
+                PR_SetError(PR_IN_PROGRESS_ERROR, 0);
+                return PR_FAILURE;
+            }
+        }
+    }
+#endif
+
     return PR_SUCCESS;
 
 #elif defined(XP_OS2)
@@ -769,6 +816,56 @@ static PRInt32 PR_CALLBACK SocketSendTo(
 	return count;
 }
 
+#if defined(_WIN64) && defined(WIN95)
+static PRInt32 PR_CALLBACK SocketTCPSendTo(
+    PRFileDesc *fd, const void *buf, PRInt32 amount,
+    PRIntn flags, const PRNetAddr *addr, PRIntervalTime timeout)
+{
+    PRInt32 temp, count;
+    const PRNetAddr *addrp = addr;
+#if defined(_PR_INET6)
+    PRNetAddr addrCopy;
+#endif
+    PRThread *me = _PR_MD_CURRENT_THREAD();
+
+    if (_PR_PENDING_INTERRUPT(me)) {
+        me->flags &= ~_PR_INTERRUPT;
+        PR_SetError(PR_PENDING_INTERRUPT_ERROR, 0);
+        return -1;
+    }
+    if (_PR_IO_PENDING(me)) {
+        PR_SetError(PR_IO_PENDING_ERROR, 0);
+        return -1;
+    }
+
+    PR_ASSERT(IsValidNetAddr(addr) == PR_TRUE);
+#if defined(_PR_INET6)
+    if (addr->raw.family == PR_AF_INET6) {
+        addrCopy = *addr;
+        addrCopy.raw.family = AF_INET6;
+        addrp = &addrCopy;
+    }
+#endif
+
+    count = 0;
+    while (amount > 0) {
+        temp = _PR_MD_TCPSENDTO(fd, buf, amount, flags,
+                                addrp, PR_NETADDR_SIZE(addr), timeout);
+        if (temp < 0) {
+            count = -1;
+            break;
+        }
+        count += temp;
+        if (fd->secret->nonblocking) {
+            break;
+        }
+        buf = (const void*) ((const char*)buf + temp);
+        amount -= temp;
+    }
+    return count;
+}
+#endif
+
 static PRInt32 PR_CALLBACK SocketRecvFrom(PRFileDesc *fd, void *buf, PRInt32 amount,
 PRIntn flags, PRNetAddr *addr, PRIntervalTime timeout)
 {
@@ -1067,6 +1164,15 @@ static PRInt16 PR_CALLBACK SocketPoll(
     PRFileDesc *fd, PRInt16 in_flags, PRInt16 *out_flags)
 {
     *out_flags = 0;
+
+#if defined(_WIN64)
+    if (in_flags & PR_POLL_WRITE) {
+        if (fd->secret->alreadyConnected) {
+            out_flags = PR_POLL_WRITE;
+            return PR_POLL_WRITE;
+        }
+    }
+#endif
     return in_flags;
 }  /* SocketPoll */
 
@@ -1091,7 +1197,11 @@ static PRIOMethods tcpMethods = {
 	SocketRecv,
 	SocketSend,
 	(PRRecvfromFN)_PR_InvalidInt,
+#if defined(_WIN64) && defined(WIN95)
+	SocketTCPSendTo, /* This is for fast open. We imitate Linux interface. */
+#else
 	(PRSendtoFN)_PR_InvalidInt,
+#endif
 	SocketPoll,
 	SocketAcceptRead,
 	SocketTransmitFile,
diff --git a/nsprpub/pr/src/md/unix/unix.c b/nsprpub/pr/src/md/unix/unix.c
index fdae1199c..662f561b6 100644
--- a/nsprpub/pr/src/md/unix/unix.c
+++ b/nsprpub/pr/src/md/unix/unix.c
@@ -3316,11 +3316,11 @@ int _MD_unix_get_nonblocking_connect_error(int osfd)
                 return errno;
             } else {
                 return err;
-            }		
+            }
         }
     } else {
         return ECONNREFUSED;
-    }	
+    }
 #elif defined(UNIXWARE)
     /*
      * getsockopt() fails with EPIPE, so use getmsg() instead.
@@ -3331,17 +3331,17 @@ int _MD_unix_get_nonblocking_connect_error(int osfd)
     rv = getmsg(osfd, NULL, NULL, &flags);
     PR_ASSERT(-1 == rv || 0 == rv);
     if (-1 == rv && errno != EAGAIN && errno != EWOULDBLOCK) {
-        return errno;
+      return errno;
     }
-    return 0;  /* no error */
+    return 0; /* no error */
 #else
-    int err;
-    _PRSockLen_t optlen = sizeof(err);
-    if (getsockopt(osfd, SOL_SOCKET, SO_ERROR, (char *) &err, &optlen) == -1) {
-        return errno;
-    } else {
-        return err;
-    }
+  int err;
+  _PRSockLen_t optlen = sizeof(err);
+  if (getsockopt(osfd, SOL_SOCKET, SO_ERROR, (char*)&err, &optlen) == -1) {
+    return errno;
+  }
+  return err;
+
 #endif
 }
 
diff --git a/nsprpub/pr/src/md/unix/uxproces.c b/nsprpub/pr/src/md/unix/uxproces.c
index a3b35e540..5286b9e18 100644
--- a/nsprpub/pr/src/md/unix/uxproces.c
+++ b/nsprpub/pr/src/md/unix/uxproces.c
@@ -247,13 +247,14 @@ ForkAndExec(
             PR_DELETE(newEnvp);
         }
         return NULL;
-    } else if (0 == process->md.pid) {  /* the child process */
-        /*
-         * If the child process needs to exit, it must call _exit().
-         * Do not call exit(), because exit() will flush and close
-         * the standard I/O file descriptors, and hence corrupt
-         * the parent process's standard I/O data structures.
-         */
+    }
+    if (0 == process->md.pid) {  /* the child process */
+      /*
+       * If the child process needs to exit, it must call _exit().
+       * Do not call exit(), because exit() will flush and close
+       * the standard I/O file descriptors, and hence corrupt
+       * the parent process's standard I/O data structures.
+       */
 
 #if !defined(NTO) && !defined(SYMBIAN)
         if (attr) {
@@ -498,10 +499,9 @@ ExtractExitStatus(int rawExitStatus)
 #endif
     if (WIFEXITED(rawExitStatus)) {
 	return WEXITSTATUS(rawExitStatus);
-    } else {
+    }
 	PR_ASSERT(WIFSIGNALED(rawExitStatus));
 	return _PR_SIGNALED_EXITSTATUS;
-    }
 }
 
 static void
@@ -624,8 +624,8 @@ static void WaitPidDaemonThread(void *unused)
         } while (sizeof(buf) == rv || (-1 == rv && EINTR == errno));
 
 #ifdef _PR_SHARE_CLONES
-	PR_Unlock(pr_wp.ml);
 	while ((op = pr_wp.opHead) != NULL) {
+	    PR_Unlock(pr_wp.ml);
 	    op->process = ForkAndExec(op->path, op->argv,
 		    op->envp, op->attr);
 	    if (NULL == op->process) {
@@ -639,8 +639,8 @@ static void WaitPidDaemonThread(void *unused)
 	    }
 	    op->done = PR_TRUE;
 	    PR_NotifyCondVar(op->doneCV);
-	    PR_Unlock(pr_wp.ml);
 	}
+	PR_Unlock(pr_wp.ml);
 #endif
 
 	while (1) {
diff --git a/nsprpub/pr/src/md/unix/uxshm.c b/nsprpub/pr/src/md/unix/uxshm.c
index dec4e3a7a..54e68191c 100644
--- a/nsprpub/pr/src/md/unix/uxshm.c
+++ b/nsprpub/pr/src/md/unix/uxshm.c
@@ -76,8 +76,8 @@ extern PRSharedMemory * _MD_OpenSharedMemory(
 
     /* copy args to struct */
     strcpy( shm->ipcname, ipcname );
-    shm->size = size; 
-    shm->mode = mode; 
+    shm->size = size;
+    shm->mode = mode;
     shm->flags = flags;
     shm->ident = _PR_SHM_IDENT;
 
@@ -500,30 +500,32 @@ extern PRFileMap* _md_OpenAnonFileMap(
                 ("_md_OpenAnonFileMap(): PR_snprintf(): failed, generating filename"));
             goto Finished;
         }
-        
+
         /* create the file */
-        osfd = open( genName, (O_CREAT | O_EXCL | O_RDWR), mode );
-        if ( -1 == osfd ) {
-            if ( EEXIST == errno )  {
-                PR_smprintf_free( genName );
-                continue; /* name exists, try again */
-            } else {
-                _PR_MD_MAP_OPEN_ERROR( errno );
-                PR_LOG( _pr_shma_lm, PR_LOG_DEBUG,
-                    ("_md_OpenAnonFileMap(): open(): failed, filename: %s, errno: %d", 
-                        genName, PR_GetOSError()));
-                PR_smprintf_free( genName );
-                goto Finished;
-            }
+        osfd = open(genName, (O_CREAT | O_EXCL | O_RDWR), mode);
+        if (-1 == osfd) {
+          if (EEXIST == errno) {
+            PR_smprintf_free(genName);
+            continue; /* name exists, try again */
+          }
+          _PR_MD_MAP_OPEN_ERROR(errno);
+          PR_LOG(
+            _pr_shma_lm,
+            PR_LOG_DEBUG,
+            ("_md_OpenAnonFileMap(): open(): failed, filename: %s, errno: %d",
+             genName,
+             PR_GetOSError()));
+          PR_smprintf_free(genName);
+          goto Finished;
         }
         break; /* name generation and open successful, break; */
     } /* end for() */
 
-    if ( incr == maxTries ) {
-        PR_ASSERT( -1 == osfd );
-        PR_ASSERT( EEXIST == errno );
-        _PR_MD_MAP_OPEN_ERROR( errno );
-        goto Finished;
+    if (incr == maxTries) {
+      PR_ASSERT(-1 == osfd);
+      PR_ASSERT(EEXIST == errno);
+      _PR_MD_MAP_OPEN_ERROR(errno);
+      goto Finished;
     }
 
     urc = unlink( genName );
diff --git a/nsprpub/pr/src/md/windows/w95sock.c b/nsprpub/pr/src/md/windows/w95sock.c
index 670e35da4..c3c4634bb 100644
--- a/nsprpub/pr/src/md/windows/w95sock.c
+++ b/nsprpub/pr/src/md/windows/w95sock.c
@@ -9,6 +9,12 @@
 
 #include "primpl.h"
 
+#if defined(_WIN64)
+#if defined(_MSC_VER)
+#pragma comment(lib, "ws2_32.lib")
+#endif
+#endif
+
 #define READ_FD     1
 #define WRITE_FD    2
 #define CONNECT_FD  3
@@ -330,6 +336,173 @@ _PR_MD_SENDTO(PRFileDesc *fd, const void *buf, PRInt32 amount, PRIntn flags,
     return bytesSent;
 }
 
+#if defined(_WIN64)
+
+static PRCallOnceType _pr_has_connectex_once;
+typedef BOOL (PASCAL FAR * _pr_win_connectex_ptr)(_In_ SOCKET s, _In_reads_bytes_(namelen) const struct sockaddr FAR *name, _In_ int namelen, _In_reads_bytes_opt_(dwSendDataLength) PVOID lpSendBuffer, _In_ DWORD dwSendDataLength, _Out_ LPDWORD lpdwBytesSent, _Inout_ LPOVERLAPPED lpOverlapped);
+
+#ifndef WSAID_CONNECTEX
+#define WSAID_CONNECTEX \
+  {0x25a207b9,0xddf3,0x4660,{0x8e,0xe9,0x76,0xe5,0x8c,0x74,0x06,0x3e}}
+#endif
+#ifndef SIO_GET_EXTENSION_FUNCTION_POINTER
+#define SIO_GET_EXTENSION_FUNCTION_POINTER 0xC8000006
+#endif
+#ifndef TCP_FASTOPEN
+#define TCP_FASTOPEN 15
+#endif
+
+#ifndef SO_UPDATE_CONNECT_CONTEXT
+#define SO_UPDATE_CONNECT_CONTEXT 0x7010
+#endif
+
+static _pr_win_connectex_ptr _pr_win_connectex = NULL;
+
+static PRStatus PR_CALLBACK _pr_set_connectex(void)
+{
+    _pr_win_connectex = NULL;
+    SOCKET sock;
+    PRInt32 dwBytes;
+    int rc;
+
+    /* Dummy socket needed for WSAIoctl */
+    sock = socket(AF_INET, SOCK_STREAM, 0);
+    if (sock == INVALID_SOCKET)
+        return PR_SUCCESS;
+
+    GUID guid = WSAID_CONNECTEX;
+    rc = WSAIoctl(sock, SIO_GET_EXTENSION_FUNCTION_POINTER,
+                  &guid, sizeof(guid),
+                  &_pr_win_connectex, sizeof(_pr_win_connectex),
+                  &dwBytes, NULL, NULL);
+    if (rc != 0) {
+        _pr_win_connectex = NULL;
+        return PR_SUCCESS;
+    }
+
+    rc = closesocket(sock);
+    return PR_SUCCESS;
+}
+
+PRInt32
+_PR_MD_TCPSENDTO(PRFileDesc *fd, const void *buf, PRInt32 amount, PRIntn flags,
+                 const PRNetAddr *addr, PRUint32 addrlen, PRIntervalTime timeout)
+{
+    if (PR_CallOnce(&_pr_has_connectex_once, _pr_set_connectex) != PR_SUCCESS) {
+        PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0);
+        return PR_FAILURE;
+    }
+
+    if (_pr_win_connectex == NULL) {
+        PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0);
+        return PR_FAILURE;
+    }
+
+    PROsfd osfd = fd->secret->md.osfd;
+    PRInt32 rv, err;
+    PRInt32 bytesSent = 0;
+    DWORD rvSent;
+
+    BOOL option = 1;
+    rv = setsockopt((SOCKET)osfd, IPPROTO_TCP, TCP_FASTOPEN, (char*)&option, sizeof(option));
+    if (rv != 0) {
+        err = WSAGetLastError();
+        PR_LOG(_pr_io_lm, PR_LOG_MIN,
+               ("_PR_MD_TCPSENDTO error set opt TCP_FASTOPEN failed %d\n", err));
+        if (err == WSAENOPROTOOPT) {
+            PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0);
+        } else {
+            _PR_MD_MAP_SETSOCKOPT_ERROR(err);
+        }
+        return -1;
+    }
+
+    /* ConnectEx requires the socket to be initially bound. We will use INADDR_ANY. */
+    PRNetAddr bindAddr;
+    memset(&bindAddr, 0, sizeof(bindAddr));
+    bindAddr.raw.family = addr->raw.family;
+
+    rv = bind((SOCKET)osfd, (const struct sockaddr *)&(bindAddr.inet), PR_NETADDR_SIZE(&bindAddr));
+    if (rv != 0) {
+        err = WSAGetLastError();
+        PR_LOG(_pr_io_lm, PR_LOG_MIN,
+               ("_PR_MD_TCPSENDTO error bind failed %d\n", err));
+        _PR_MD_MAP_SETSOCKOPT_ERROR(err);
+        return -1;
+    }
+
+    PR_LOG(_pr_io_lm, PR_LOG_MIN,
+           ("_PR_MD_TCPSENDTO calling _pr_win_connectex  %d %p\n", amount, (char*)buf));
+
+    rvSent = 0;
+    memset(&fd->secret->ol, 0, sizeof(fd->secret->ol));
+    /* ConnectEx return TRUE on a success and FALSE on an error. */
+    if (_pr_win_connectex( (SOCKET)osfd, (struct sockaddr *) addr,
+                           addrlen, buf, amount,
+                           &rvSent, &fd->secret->ol) == TRUE) {
+        /* When ConnectEx is used, all previously set socket options and
+         * property are not enabled and to enable them
+         * SO_UPDATE_CONNECT_CONTEXT option need to be set. */
+        rv = setsockopt((SOCKET)osfd, SOL_SOCKET, SO_UPDATE_CONNECT_CONTEXT, NULL, 0);
+        if (rv != 0) {
+            err = WSAGetLastError();
+            PR_LOG(_pr_io_lm, PR_LOG_MIN,
+               ("_PR_MD_TCPSENDTO setting SO_UPDATE_CONNECT_CONTEXT failed %d\n", err));
+            _PR_MD_MAP_SETSOCKOPT_ERROR(err);
+            return -1;
+        }
+        /* We imitate Linux here. SendTo will return number of bytes send but
+         * it can not return connection success at the same time, so we return
+         * number of bytes send and "connection success" will be return on the
+         * connectcontinue. */
+        fd->secret->alreadyConnected = PR_TRUE;
+        return rvSent;
+    } else {
+        err = WSAGetLastError();
+        PR_LOG(_pr_io_lm, PR_LOG_MIN,
+               ("_PR_MD_TCPSENDTO error _pr_win_connectex failed %d\n", err));
+        if (err != ERROR_IO_PENDING) {
+            _PR_MD_MAP_CONNECT_ERROR(err);
+            return -1;
+        } else if (fd->secret->nonblocking) {
+            /* Remember that overlapped structure is set. We will need to get
+             * the final result of ConnectEx call. */
+            fd->secret->overlappedActive = PR_TRUE;
+
+            /* ConnectEx will copy supplied data to a internal buffer and send
+             * them during Fast Open or after connect. Therefore we can assumed
+             * this data already send. */
+            if (amount > 0) {
+              return amount;
+            }
+
+            _PR_MD_MAP_CONNECT_ERROR(WSAEWOULDBLOCK);
+            return -1;
+        }
+        // err is ERROR_IO_PENDING and socket is blocking, so query
+        // GetOverlappedResult.
+        err = ERROR_IO_INCOMPLETE;
+        while (err == ERROR_IO_INCOMPLETE) {
+            rv = socket_io_wait(osfd, WRITE_FD, timeout);
+            if ( rv < 0 ) {
+                return -1;
+            }
+            rv = GetOverlappedResult(osfd, &fd->secret->ol, &rvSent, FALSE);
+            if ( rv == TRUE ) {
+                return rvSent;
+            } else {
+                err = WSAGetLastError();
+                if (err != ERROR_IO_INCOMPLETE) {
+                    _PR_MD_MAP_CONNECT_ERROR(err);
+                    return -1;
+                }
+            }
+        }
+    }
+    return -1;
+}
+#endif
+
 PRInt32
 _PR_MD_RECVFROM(PRFileDesc *fd, void *buf, PRInt32 amount, PRIntn flags,
                 PRNetAddr *addr, PRUint32 *addrlen, PRIntervalTime timeout)
diff --git a/nsprpub/pr/src/misc/prnetdb.c b/nsprpub/pr/src/misc/prnetdb.c
index 1eb4348dc..affebf6ac 100644
--- a/nsprpub/pr/src/misc/prnetdb.c
+++ b/nsprpub/pr/src/misc/prnetdb.c
@@ -1483,19 +1483,21 @@ PR_IsNetAddrType(const PRNetAddr *addr, PRNetAddrValue val)
         if (val == PR_IpAddrAny) {
 			if (_PR_IN6_IS_ADDR_UNSPECIFIED((PRIPv6Addr *)&addr->ipv6.ip)) {
             	return PR_TRUE;
-			} else if (_PR_IN6_IS_ADDR_V4MAPPED((PRIPv6Addr *)&addr->ipv6.ip)
-					&& _PR_IN6_V4MAPPED_TO_IPADDR((PRIPv6Addr *)&addr->ipv6.ip)
-							== htonl(INADDR_ANY)) {
-            	return PR_TRUE;
+			}
+            if (_PR_IN6_IS_ADDR_V4MAPPED((PRIPv6Addr *)&addr->ipv6.ip)
+                && _PR_IN6_V4MAPPED_TO_IPADDR((PRIPv6Addr *)&addr->ipv6.ip)
+                == htonl(INADDR_ANY)) {
+                return PR_TRUE;
 			}
         } else if (val == PR_IpAddrLoopback) {
             if (_PR_IN6_IS_ADDR_LOOPBACK((PRIPv6Addr *)&addr->ipv6.ip)) {
-            	return PR_TRUE;
-			} else if (_PR_IN6_IS_ADDR_V4MAPPED((PRIPv6Addr *)&addr->ipv6.ip)
-					&& _PR_IN6_V4MAPPED_TO_IPADDR((PRIPv6Addr *)&addr->ipv6.ip)
-							== htonl(INADDR_LOOPBACK)) {
             	return PR_TRUE;
 			}
+            if (_PR_IN6_IS_ADDR_V4MAPPED((PRIPv6Addr *)&addr->ipv6.ip)
+                && _PR_IN6_V4MAPPED_TO_IPADDR((PRIPv6Addr *)&addr->ipv6.ip)
+                == htonl(INADDR_LOOPBACK)) {
+                return PR_TRUE;
+			}
         } else if (val == PR_IpAddrV4Mapped
                 && _PR_IN6_IS_ADDR_V4MAPPED((PRIPv6Addr *)&addr->ipv6.ip)) {
             return PR_TRUE;
@@ -1504,8 +1506,9 @@ PR_IsNetAddrType(const PRNetAddr *addr, PRNetAddrValue val)
         if (addr->raw.family == AF_INET) {
             if (val == PR_IpAddrAny && addr->inet.ip == htonl(INADDR_ANY)) {
                 return PR_TRUE;
-            } else if (val == PR_IpAddrLoopback
-                    && addr->inet.ip == htonl(INADDR_LOOPBACK)) {
+            }
+            if (val == PR_IpAddrLoopback
+                && addr->inet.ip == htonl(INADDR_LOOPBACK)) {
                 return PR_TRUE;
             }
         }
diff --git a/nsprpub/pr/src/misc/prtime.c b/nsprpub/pr/src/misc/prtime.c
index b54232281..f03786096 100644
--- a/nsprpub/pr/src/misc/prtime.c
+++ b/nsprpub/pr/src/misc/prtime.c
@@ -279,8 +279,7 @@ static int IsLeapYear(PRInt16 year)
 {
     if ((year % 4 == 0 && year % 100 != 0) || year % 400 == 0)
         return 1;
-    else
-        return 0;
+    return 0;
 }
 
 /*
@@ -1236,7 +1235,7 @@ PR_ParseTimeStringToExplodedTime(
                                 if ((end - rest) > 2)
                                   /* it is [0-9][0-9][0-9]+: */
                                   break;
-                                else if ((end - rest) == 2)
+                                if ((end - rest) == 2)
                                   tmp_hour = ((rest[0]-'0')*10 +
                                                           (rest[1]-'0'));
                                 else
@@ -1251,12 +1250,12 @@ PR_ParseTimeStringToExplodedTime(
                                 if (end == rest)
                                   /* no digits after first colon? */
                                   break;
-                                else if ((end - rest) > 2)
+                                if ((end - rest) > 2)
                                   /* it is [0-9][0-9][0-9]+: */
                                   break;
-                                else if ((end - rest) == 2)
+                                if ((end - rest) == 2)
                                   tmp_min = ((rest[0]-'0')*10 +
-                                                         (rest[1]-'0'));
+                                             (rest[1]-'0'));
                                 else
                                   tmp_min = (rest[0]-'0');
 
@@ -1274,7 +1273,7 @@ PR_ParseTimeStringToExplodedTime(
                                 else if ((end - rest) > 2)
                                   /* it is [0-9][0-9][0-9]+: */
                                   break;
-                                else if ((end - rest) == 2)
+                                if ((end - rest) == 2)
                                   tmp_sec = ((rest[0]-'0')*10 +
                                                          (rest[1]-'0'));
                                 else
@@ -1308,7 +1307,7 @@ PR_ParseTimeStringToExplodedTime(
                                 rest = end;
                                 break;
                           }
-                        else if ((*end == '/' || *end == '-') &&
+                        if ((*end == '/' || *end == '-') &&
                                          end[1] >= '0' && end[1] <= '9')
                           {
                                 /* Perhaps this is 6/16/95, 16/6/95, 6-16-95, or 16-6-95
@@ -2014,24 +2013,22 @@ pr_WeekOfYear(const PRExplodedTime* time, unsigned int firstDayOfWeek)
   dayOfWeek = time->tm_wday - firstDayOfWeek;
   if (dayOfWeek < 0)
     dayOfWeek += 7;
-  
-  dayOfYear = time->tm_yday - dayOfWeek;
 
+  dayOfYear = time->tm_yday - dayOfWeek;
 
   if( dayOfYear <= 0 )
   {
      /* If dayOfYear is <= 0, it is in the first partial week of the year. */
      return 0;
   }
-  else
-  {
-     /* Count the number of full weeks ( dayOfYear / 7 ) then add a week if there
-      * are any days left over ( dayOfYear % 7 ).  Because we are only counting to
-      * the first day of the week containing the given time, rather than to the
-      * actual day representing the given time, any days in week 0 will be "absorbed"
-      * as extra days in the given week.
-      */
-     return (dayOfYear / 7) + ( (dayOfYear % 7) == 0 ? 0 : 1 );
-  }
+
+  /* Count the number of full weeks ( dayOfYear / 7 ) then add a week if there
+   * are any days left over ( dayOfYear % 7 ).  Because we are only counting to
+   * the first day of the week containing the given time, rather than to the
+   * actual day representing the given time, any days in week 0 will be "absorbed"
+   * as extra days in the given week.
+   */
+  return (dayOfYear / 7) + ( (dayOfYear % 7) == 0 ? 0 : 1 );
+
 }
 
diff --git a/nsprpub/pr/src/misc/prtpool.c b/nsprpub/pr/src/misc/prtpool.c
index 0671cc19b..c2cc9c803 100644
--- a/nsprpub/pr/src/misc/prtpool.c
+++ b/nsprpub/pr/src/misc/prtpool.c
@@ -862,16 +862,16 @@ PR_QueueJob_Connect(PRThreadPool *tpool, PRJobIoDesc *iod,
 	if ((rv == PR_FAILURE) && ((err = PR_GetError()) == PR_IN_PROGRESS_ERROR)){
 		/* connection pending */
 		return(queue_io_job(tpool, iod, fn, arg, joinable, JOB_IO_CONNECT));
-	} else {
-		/*
-		 * connection succeeded or failed; add to jobq right away
-		 */
-		if (rv == PR_FAILURE)
-			iod->error = err;
-		else
-			iod->error = 0;
-		return(PR_QueueJob(tpool, fn, arg, joinable));
 	}
+    /*
+     * connection succeeded or failed; add to jobq right away
+     */
+    if (rv == PR_FAILURE)
+      iod->error = err;
+    else
+      iod->error = 0;
+    return(PR_QueueJob(tpool, fn, arg, joinable));
+
 }
 
 /* queue a job, when a timer expires */
diff --git a/nsprpub/pr/src/pthreads/ptio.c b/nsprpub/pr/src/pthreads/ptio.c
index 2c7be9cd3..9dde03191 100644
--- a/nsprpub/pr/src/pthreads/ptio.c
+++ b/nsprpub/pr/src/pthreads/ptio.c
@@ -164,6 +164,9 @@ static ssize_t (*pt_aix_sendfile_fptr)() = NULL;
 #ifndef TCP_CORK
 #define TCP_CORK 3
 #endif
+#ifndef MSG_FASTOPEN
+#define MSG_FASTOPEN    0x20000000
+#endif
 #endif
 
 #ifdef _PR_IPV6_V6ONLY_PROBE
@@ -821,7 +824,7 @@ retry:
         op->arg3.amount -= bytes;  /* and reduce the required count */
         return (0 == op->arg3.amount) ? PR_TRUE : PR_FALSE;
     }
-    else if ((EWOULDBLOCK != op->syserrno) && (EAGAIN != op->syserrno))
+    if ((EWOULDBLOCK != op->syserrno) && (EAGAIN != op->syserrno))
     {
         op->result.code = -1;
         return PR_TRUE;
@@ -850,7 +853,7 @@ static PRBool pt_write_cont(pt_Continuation *op, PRInt16 revents)
         op->arg3.amount -= bytes;  /* and reduce the required count */
         return (0 == op->arg3.amount) ? PR_TRUE : PR_FALSE;
     }
-    else if ((EWOULDBLOCK != op->syserrno) && (EAGAIN != op->syserrno))
+    if ((EWOULDBLOCK != op->syserrno) && (EAGAIN != op->syserrno))
     {
         op->result.code = -1;
         return PR_TRUE;
@@ -892,7 +895,7 @@ static PRBool pt_writev_cont(pt_Continuation *op, PRInt16 revents)
         op->arg3.amount -= iov_index;  /* and array length */
         return (0 == op->arg3.amount) ? PR_TRUE : PR_FALSE;
     }
-    else if ((EWOULDBLOCK != op->syserrno) && (EAGAIN != op->syserrno))
+    if ((EWOULDBLOCK != op->syserrno) && (EAGAIN != op->syserrno))
     {
         op->result.code = -1;
         return PR_TRUE;
@@ -915,7 +918,7 @@ static PRBool pt_sendto_cont(pt_Continuation *op, PRInt16 revents)
         op->arg3.amount -= bytes;  /* and reduce the required count */
         return (0 == op->arg3.amount) ? PR_TRUE : PR_FALSE;
     }
-    else if ((EWOULDBLOCK != op->syserrno) && (EAGAIN != op->syserrno))
+    if ((EWOULDBLOCK != op->syserrno) && (EAGAIN != op->syserrno))
     {
         op->result.code = -1;
         return PR_TRUE;
@@ -2053,6 +2056,101 @@ static PRInt32 pt_SendTo(
     return bytes;
 }  /* pt_SendTo */
 
+#if defined(LINUX) || defined(DARWIN)
+/* Linux uses SendTo to send data during TCP Fast Open. OSX uses connectx, but
+ * we will make it imitate the Linux's interface. */
+static PRInt32 pt_TCP_SendTo(
+    PRFileDesc *fd, const void *buf,
+    PRInt32 amount, PRIntn flags, const PRNetAddr *addr,
+    PRIntervalTime timeout)
+{
+#if defined(LINUX) || HAS_CONNECTX
+    PRInt32 syserrno, bytes = -1;
+    PRBool fNeedContinue = PR_FALSE;
+    pt_SockLen addr_len;
+    const PRNetAddr *addrp = addr;
+#if defined(_PR_HAVE_SOCKADDR_LEN) || defined(_PR_INET6)
+    PRNetAddr addrCopy;
+#endif
+#ifdef _PR_HAVE_SOCKADDR_LEN
+    PRUint16 md_af = addr->raw.family;
+#endif
+
+    if (pt_TestAbort()) return bytes;
+
+    PR_ASSERT(IsValidNetAddr(addr) == PR_TRUE);
+    addr_len = PR_NETADDR_SIZE(addr);
+#if defined(_PR_INET6)
+    if (addr->raw.family == PR_AF_INET6) {
+#ifdef _PR_HAVE_SOCKADDR_LEN
+        md_af = AF_INET6;
+#else
+        /* If _PR_INET6 is defined and it is PR_AF_INET6 we set family
+         * to AF_INET6. */
+        addrCopy = *addr;
+        addrCopy.raw.family = AF_INET6;
+        addrp = &addrCopy;
+#endif
+    }
+#endif
+
+#ifdef _PR_HAVE_SOCKADDR_LEN
+    /* if _PR_HAVE_SOCKADDR_LEN is defined and it is PR_AF_INET6 we set family
+     * to AF_INET6 and we set address length. */
+    addrCopy = *addr;
+    ((struct sockaddr*)&addrCopy)->sa_len = addr_len;
+    ((struct sockaddr*)&addrCopy)->sa_family = md_af;
+    addrp = &addrCopy;
+#endif
+
+#ifndef HAS_CONNECTX
+    bytes = sendto(
+        fd->secret->md.osfd, buf, amount, MSG_FASTOPEN,
+        (struct sockaddr*)addrp, addr_len);
+#else
+    sa_endpoints_t endpoints;
+    endpoints.sae_srcif = 0;
+    endpoints.sae_srcaddr = NULL;
+    endpoints.sae_srcaddrlen = 0;
+    endpoints.sae_dstaddr = (struct sockaddr *)addrp;
+    endpoints.sae_dstaddrlen = addr_len;
+    struct iovec iov[1];
+    iov[0].iov_base = buf;
+    iov[0].iov_len = amount;
+    PRInt32 rv = connectx(fd->secret->md.osfd, &endpoints, SAE_ASSOCID_ANY,
+                         CONNECT_DATA_IDEMPOTENT, iov, 1, &bytes, NULL);
+#endif
+    syserrno = errno;
+    if ( (bytes == -1) && (syserrno == EWOULDBLOCK || syserrno == EAGAIN)
+        && (!fd->secret->nonblocking) ) {
+        if (PR_INTERVAL_NO_WAIT == timeout) syserrno = ETIMEDOUT;
+        else fNeedContinue = PR_TRUE;
+    }
+    if (fNeedContinue == PR_TRUE) {
+        pt_Continuation op;
+        op.arg1.osfd = fd->secret->md.osfd;
+        op.arg2.buffer = (void*)buf;
+        op.arg3.amount = amount;
+        op.arg4.flags = flags;
+        op.arg5.addr = (PRNetAddr*)addrp;
+        op.timeout = timeout;
+        op.result.code = 0;  /* initialize the number sent */
+        op.function = pt_sendto_cont;
+        op.event = POLLOUT | POLLPRI;
+        bytes = pt_Continue(&op);
+        syserrno = op.syserrno;
+    }
+    if (bytes < 0) {
+        pt_MapError(_PR_MD_MAP_SENDTO_ERROR, syserrno);
+    }
+    return bytes;
+#else /* !HAS_CONNECTX */
+    PR_SetError(PR_NOT_IMPLEMENTED_ERROR, 0);
+    return -1;
+#endif
+}  /* pt_TCP_SendTo */
+#endif /* LINUX || DARWIN */
+
 static PRInt32 pt_RecvFrom(PRFileDesc *fd, void *buf, PRInt32 amount,
     PRIntn flags, PRNetAddr *addr, PRIntervalTime timeout)
 {
@@ -2776,22 +2874,21 @@ static PRStatus pt_GetSockName(PRFileDesc *fd, PRNetAddr *addr)
     if (rv == -1) {
         pt_MapError(_PR_MD_MAP_GETSOCKNAME_ERROR, errno);
         return PR_FAILURE;
-    } else {
+    }
 #ifdef _PR_HAVE_SOCKADDR_LEN
-        /* ignore the sa_len field of struct sockaddr */
-        if (addr)
-        {
-            addr->raw.family = ((struct sockaddr*)addr)->sa_family;
-        }
+    /* ignore the sa_len field of struct sockaddr */
+    if (addr)
+    {
+        addr->raw.family = ((struct sockaddr*)addr)->sa_family;
+    }
 #endif /* _PR_HAVE_SOCKADDR_LEN */
 #ifdef _PR_INET6
-		if (AF_INET6 == addr->raw.family)
-			addr->raw.family = PR_AF_INET6;
+    if (AF_INET6 == addr->raw.family)
+        addr->raw.family = PR_AF_INET6;
 #endif
-        PR_ASSERT(IsValidNetAddr(addr) == PR_TRUE);
-        PR_ASSERT(IsValidNetAddrLen(addr, addr_len) == PR_TRUE);
-        return PR_SUCCESS;
-    }
+    PR_ASSERT(IsValidNetAddr(addr) == PR_TRUE);
+    PR_ASSERT(IsValidNetAddrLen(addr, addr_len) == PR_TRUE);
+    return PR_SUCCESS;
 }  /* pt_GetSockName */
 
 static PRStatus pt_GetPeerName(PRFileDesc *fd, PRNetAddr *addr)
@@ -2807,22 +2904,21 @@ static PRStatus pt_GetPeerName(PRFileDesc *fd, PRNetAddr *addr)
     if (rv == -1) {
         pt_MapError(_PR_MD_MAP_GETPEERNAME_ERROR, errno);
         return PR_FAILURE;
-    } else {
+    }
 #ifdef _PR_HAVE_SOCKADDR_LEN
-        /* ignore the sa_len field of struct sockaddr */
-        if (addr)
-        {
-            addr->raw.family = ((struct sockaddr*)addr)->sa_family;
-        }
+    /* ignore the sa_len field of struct sockaddr */
+    if (addr)
+    {
+        addr->raw.family = ((struct sockaddr*)addr)->sa_family;
+    }
 #endif /* _PR_HAVE_SOCKADDR_LEN */
 #ifdef _PR_INET6
-		if (AF_INET6 == addr->raw.family)
-        	addr->raw.family = PR_AF_INET6;
+    if (AF_INET6 == addr->raw.family)
+        addr->raw.family = PR_AF_INET6;
 #endif
-        PR_ASSERT(IsValidNetAddr(addr) == PR_TRUE);
-        PR_ASSERT(IsValidNetAddrLen(addr, addr_len) == PR_TRUE);
-        return PR_SUCCESS;
-    }
+    PR_ASSERT(IsValidNetAddr(addr) == PR_TRUE);
+    PR_ASSERT(IsValidNetAddrLen(addr, addr_len) == PR_TRUE);
+    return PR_SUCCESS;
 }  /* pt_GetPeerName */
 
 static PRStatus pt_GetSocketOption(PRFileDesc *fd, PRSocketOptionData *data)
@@ -3164,7 +3260,11 @@ static PRIOMethods _pr_tcp_methods = {
     pt_Recv,
     pt_Send,
     (PRRecvfromFN)_PR_InvalidInt,
+#if defined(LINUX) || defined(DARWIN)
+    pt_TCP_SendTo, /* This is for TCP Fast Open. Linux uses SendTo function for this. OSX uses connectx, but we imitate Linux. */
+#else
     (PRSendtoFN)_PR_InvalidInt,
+#endif
     pt_Poll,
     pt_AcceptRead,
     pt_TransmitFile,
@@ -3611,8 +3711,8 @@ PR_IMPLEMENT(PRStatus) PR_Delete(const char *name)
     if (rv == -1) {
         pt_MapError(_PR_MD_MAP_UNLINK_ERROR, errno);
         return PR_FAILURE;
-    } else
-        return PR_SUCCESS;
+    }
+    return PR_SUCCESS;
 }  /* PR_Delete */
 
 PR_IMPLEMENT(PRStatus) PR_Access(const char *name, PRAccessHow how)
@@ -3736,11 +3836,10 @@ PR_IMPLEMENT(PRStatus) PR_RmDir(const char *name)
 
     rv = rmdir(name);
     if (0 == rv) {
-    return PR_SUCCESS;
-    } else {
+        return PR_SUCCESS;
+    }
     pt_MapError(_PR_MD_MAP_RMDIR_ERROR, errno);
     return PR_FAILURE;
-    }
 }  /* PR_Rmdir */
 
 
diff --git a/nsprpub/pr/src/pthreads/ptsynch.c b/nsprpub/pr/src/pthreads/ptsynch.c
index 8663a4c71..251205336 100644
--- a/nsprpub/pr/src/pthreads/ptsynch.c
+++ b/nsprpub/pr/src/pthreads/ptsynch.c
@@ -55,11 +55,10 @@ void _PR_InitLocks(void)
     rv = _PT_PTHREAD_MUTEXATTR_INIT(&_pt_mattr); 
     PR_ASSERT(0 == rv);
 
-#ifdef LINUX
-#if (__GLIBC__ > 2) || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 2)
+#if (defined(LINUX) && (__GLIBC__ > 2) || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 2)) || \
+    (defined(FREEBSD) && __FreeBSD_version > 700055)
     rv = pthread_mutexattr_settype(&_pt_mattr, PTHREAD_MUTEX_ADAPTIVE_NP);
     PR_ASSERT(0 == rv);
-#endif
 #endif
 
     rv = _PT_PTHREAD_CONDATTR_INIT(&_pt_cvar_attr);
diff --git a/nsprpub/pr/tests/accept.c b/nsprpub/pr/tests/accept.c
index 7ed2d9859..b327eb211 100644
--- a/nsprpub/pr/tests/accept.c
+++ b/nsprpub/pr/tests/accept.c
@@ -143,12 +143,13 @@ ClientThread(void *_action)
             if (action != CLIENT_TIMEOUT_SEND) {
                 if ((rv = PR_Send(sock, buf, CLIENT_DATA,
                     0, timeoutTime))< 0) {
-                    if (!debug_mode)
+                    if (!debug_mode) {
                         failed_already=1;
-                    else    
-                        PR_fprintf(output, 
+                    } else {
+                        PR_fprintf(output,
                             "client: unable to send to server (%d, %ld, %ld)\n",
                             CLIENT_DATA, rv, PR_GetError());
+                    }
                 	goto ErrorExit;
                 }
             } else {
@@ -200,8 +201,9 @@ int i;
                 continue;
         }
         failed_already=1;
-        if (debug_mode)
+        if (debug_mode) {
         	PR_fprintf(output,"accept: ERROR - PR_Bind failed\n");
+        }
 		return;
     }
 
diff --git a/nsprpub/pr/tests/alarm.c b/nsprpub/pr/tests/alarm.c
index b7b195801..e3dedb67f 100644
--- a/nsprpub/pr/tests/alarm.c
+++ b/nsprpub/pr/tests/alarm.c
@@ -411,15 +411,15 @@ static PRUint32 TimeThis(
     PRUint32 overhead, usecs;
     PRIntervalTime predicted, timein, timeout, ticks;
 
- if (debug_mode)
-    printf("Testing %s ...", msg);
+    if (debug_mode)
+      printf("Testing %s ...", msg);
 
     timein = PR_IntervalNow();
     predicted = func(loops);
     timeout = PR_IntervalNow();
 
-  if (debug_mode)
-    printf(" done\n");
+    if (debug_mode)
+      printf(" done\n");
 
     ticks = timeout - timein;
     usecs = PR_IntervalToMicroseconds(ticks);
@@ -491,17 +491,17 @@ int prmain(int argc, char** argv)
 
     for (cpu = 1; cpu <= cpus; ++cpu)
     {
-    if (debug_mode)
+      if (debug_mode)
         printf("\nAlarm: Using %d CPU(s)\n", cpu);
 
-	PR_SetConcurrency(cpu);
-        
-        /* some basic time test */
-        (void)TimeThis("ConditionNotify", ConditionNotify, loops);
-        (void)TimeThis("ConditionTimeout", ConditionTimeout, loops);
-        (void)TimeThis("Alarms1", Alarms1, loops);
-        (void)TimeThis("Alarms2", Alarms2, loops);
-        (void)TimeThis("Alarms3", Alarms3, loops);
+      PR_SetConcurrency(cpu);
+
+      /* some basic time test */
+      (void)TimeThis("ConditionNotify", ConditionNotify, loops);
+      (void)TimeThis("ConditionTimeout", ConditionTimeout, loops);
+      (void)TimeThis("Alarms1", Alarms1, loops);
+      (void)TimeThis("Alarms2", Alarms2, loops);
+      (void)TimeThis("Alarms3", Alarms3, loops);
     }
     return 0;
 }
diff --git a/nsprpub/pr/tests/vercheck.c b/nsprpub/pr/tests/vercheck.c
index dceb84ecc..6170125de 100644
--- a/nsprpub/pr/tests/vercheck.c
+++ b/nsprpub/pr/tests/vercheck.c
@@ -39,7 +39,7 @@ static char *compatible_version[] = {
     "4.9.6",
     "4.10", "4.10.1", "4.10.2", "4.10.3", "4.10.4",
     "4.10.5", "4.10.6", "4.10.7", "4.10.8", "4.10.9",
-    "4.10.10", "4.11", "4.12", "4.13", "4.14"
+    "4.10.10", "4.11", "4.12", "4.13", "4.14", "4.15"
     PR_VERSION
 };
 
@@ -55,8 +55,8 @@ static char *incompatible_version[] = {
     "3.0", "3.0.1",
     "3.1", "3.1.1", "3.1.2", "3.1.3",
     "3.5", "3.5.1",
-    "4.15.1",
-    "4.16", "4.16.1",
+    "4.16.1",
+    "4.17", "4.17.1",
     "10.0", "11.1", "12.14.20"
 };
 
diff --git a/security/nss/.gitignore b/security/nss/.gitignore
index 079fcae25..b137867f5 100644
--- a/security/nss/.gitignore
+++ b/security/nss/.gitignore
@@ -18,3 +18,4 @@ GTAGS
 fuzz/libFuzzer/*
 fuzz/corpus
 fuzz/out
+.chk
diff --git a/security/nss/Makefile b/security/nss/Makefile
index a24c4caef..48bae3778 100644
--- a/security/nss/Makefile
+++ b/security/nss/Makefile
@@ -28,6 +28,7 @@ include $(CORE_DEPTH)/coreconf/config.mk
 
 ifdef NSS_DISABLE_GTESTS
 DIRS := $(filter-out gtests,$(DIRS))
+DIRS := $(filter-out cpputil,$(DIRS))
 endif
 
 #######################################################################
diff --git a/security/nss/automation/abi-check/expected-report-libnss3.so.txt b/security/nss/automation/abi-check/expected-report-libnss3.so.txt
index 1bdbb4090..e69de29bb 100644
--- a/security/nss/automation/abi-check/expected-report-libnss3.so.txt
+++ b/security/nss/automation/abi-check/expected-report-libnss3.so.txt
@@ -1,12 +0,0 @@
-Functions changes summary: 0 Removed, 0 Changed, 6 Added functions
-Variables changes summary: 0 Removed, 0 Changed, 0 Added variable
-
-6 Added functions:
-
-  'function SECStatus CERT_GetCertIsPerm(const CERTCertificate*, PRBool*)'    {CERT_GetCertIsPerm@@NSS_3.31}
-  'function SECStatus CERT_GetCertIsTemp(const CERTCertificate*, PRBool*)'    {CERT_GetCertIsTemp@@NSS_3.31}
-  'function CERTCertificate* PK11_FindCertFromURI(const char*, void*)'    {PK11_FindCertFromURI@@NSS_3.31}
-  'function CERTCertList* PK11_FindCertsFromURI(const char*, void*)'    {PK11_FindCertsFromURI@@NSS_3.31}
-  'function char* PK11_GetModuleURI(SECMODModule*)'    {PK11_GetModuleURI@@NSS_3.31}
-  'function char* PK11_GetTokenURI()'    {PK11_GetTokenURI@@NSS_3.31}
-
diff --git a/security/nss/automation/abi-check/expected-report-libnssutil3.so.txt b/security/nss/automation/abi-check/expected-report-libnssutil3.so.txt
index 5c6e5d9e5..e69de29bb 100644
--- a/security/nss/automation/abi-check/expected-report-libnssutil3.so.txt
+++ b/security/nss/automation/abi-check/expected-report-libnssutil3.so.txt
@@ -1,12 +0,0 @@
-Functions changes summary: 0 Removed, 0 Changed, 6 Added functions
-Variables changes summary: 0 Removed, 0 Changed, 0 Added variable
-
-6 Added functions:
-
-  'function void PK11URI_CreateURI(size_t, size_t)'    {PK11URI_CreateURI@@NSSUTIL_3.31}
-  'function void PK11URI_DestroyURI()'    {PK11URI_DestroyURI@@NSSUTIL_3.31}
-  'function char* PK11URI_FormatURI()'    {PK11URI_FormatURI@@NSSUTIL_3.31}
-  'function const char* PK11URI_GetPathAttribute(const char*)'    {PK11URI_GetPathAttribute@@NSSUTIL_3.31}
-  'function const char* PK11URI_GetQueryAttribute(const char*)'    {PK11URI_GetQueryAttribute@@NSSUTIL_3.31}
-  'function void PK11URI_ParseURI(const char*)'    {PK11URI_ParseURI@@NSSUTIL_3.31}
-
diff --git a/security/nss/automation/abi-check/expected-report-libssl3.so.txt b/security/nss/automation/abi-check/expected-report-libssl3.so.txt
index b0a279d9c..e69de29bb 100644
--- a/security/nss/automation/abi-check/expected-report-libssl3.so.txt
+++ b/security/nss/automation/abi-check/expected-report-libssl3.so.txt
@@ -1,14 +0,0 @@
-Functions changes summary: 0 Removed, 1 Changed, 0 Added function
-Variables changes summary: 0 Removed, 0 Changed, 0 Added variable
-
-1 function with some indirect sub-type change:
-
-  [C]'function SECStatus SSL_GetPreliminaryChannelInfo(SSLPreliminaryChannelInfo*, PRUintn)' at sslinfo.c:115:1 has some indirect sub-type changes:
-    parameter 1 of type 'SSLPreliminaryChannelInfo*' has sub-type changes:
-      in pointed to type 'typedef SSLPreliminaryChannelInfo' at sslt.h:318:1:
-        underlying type 'struct SSLPreliminaryChannelInfoStr' at sslt.h:287:1 changed:
-          type size changed from 128 to 160 bits
-          1 data member insertion:
-            'PRUint32 SSLPreliminaryChannelInfoStr::maxEarlyDataSize', at offset 128 (in bits) at sslt.h:314:1
-
-
diff --git a/security/nss/automation/abi-check/previous-nss-release b/security/nss/automation/abi-check/previous-nss-release
index 1445e74b1..b8d28cde0 100644
--- a/security/nss/automation/abi-check/previous-nss-release
+++ b/security/nss/automation/abi-check/previous-nss-release
@@ -1 +1 @@
-NSS_3_30_BRANCH
+NSS_3_31_BRANCH
diff --git a/security/nss/automation/release/nspr-version.txt b/security/nss/automation/release/nspr-version.txt
index 9a4d13089..98783a615 100644
--- a/security/nss/automation/release/nspr-version.txt
+++ b/security/nss/automation/release/nspr-version.txt
@@ -1,4 +1,4 @@
-4.15
+4.16
 
 # The first line of this file must contain the human readable NSPR
 # version number, which is the minimum required version of NSPR
diff --git a/security/nss/automation/release/nss-release-helper.py b/security/nss/automation/release/nss-release-helper.py
index d168febde..31ea41966 100644
--- a/security/nss/automation/release/nss-release-helper.py
+++ b/security/nss/automation/release/nss-release-helper.py
@@ -10,11 +10,27 @@ import shutil
 import glob
 from optparse import OptionParser
 from subprocess import check_call
+from subprocess import check_output
 
 nssutil_h = "lib/util/nssutil.h"
 softkver_h = "lib/softoken/softkver.h"
 nss_h = "lib/nss/nss.h"
 nssckbi_h = "lib/ckfw/builtins/nssckbi.h"
+abi_base_version_file = "automation/abi-check/previous-nss-release"
+
+abi_report_files = ['automation/abi-check/expected-report-libfreebl3.so.txt',
+                    'automation/abi-check/expected-report-libfreeblpriv3.so.txt',
+                    'automation/abi-check/expected-report-libnspr4.so.txt',
+                    'automation/abi-check/expected-report-libnss3.so.txt',
+                    'automation/abi-check/expected-report-libnssckbi.so.txt',
+                    'automation/abi-check/expected-report-libnssdbm3.so.txt',
+                    'automation/abi-check/expected-report-libnsssysinit.so.txt',
+                    'automation/abi-check/expected-report-libnssutil3.so.txt',
+                    'automation/abi-check/expected-report-libplc4.so.txt',
+                    'automation/abi-check/expected-report-libplds4.so.txt',
+                    'automation/abi-check/expected-report-libsmime3.so.txt',
+                    'automation/abi-check/expected-report-libsoftokn3.so.txt',
+                    'automation/abi-check/expected-report-libssl3.so.txt']
 
 def check_call_noisy(cmd, *args, **kwargs):
     print "Executing command:", cmd
@@ -132,6 +148,26 @@ def set_root_ca_version():
     sed_inplace('s/^\(#define *NSS_BUILTINS_LIBRARY_VERSION_MINOR *\).*$/\\1' + minor + '/', nssckbi_h)
 
 def set_all_lib_versions(version, major, minor, patch, build):
+    grep_major = check_output(['grep', 'define.*NSS_VMAJOR', nss_h])
+    grep_minor = check_output(['grep', 'define.*NSS_VMINOR', nss_h])
+
+    old_major = int(grep_major.split()[2]);
+    old_minor = int(grep_minor.split()[2]);
+
+    new_major = int(major)
+    new_minor = int(minor)
+
+    if (old_major < new_major or (old_major == new_major and old_minor < new_minor)):
+        print "You're increasing the minor (or major) version:"
+        print "- erasing ABI comparison expectations"
+        new_branch = "NSS_" + str(old_major) + "_" + str(old_minor) + "_BRANCH"
+        print "- setting reference branch to the branch of the previous version: " + new_branch
+        with open(abi_base_version_file, "w") as abi_base:
+            abi_base.write("%s\n" % new_branch)
+        for report_file in abi_report_files:
+            with open(report_file, "w") as report_file_handle:
+                report_file_handle.truncate()
+
     set_full_lib_versions(version)
     set_major_versions(major)
     set_minor_versions(minor)
diff --git a/security/nss/automation/taskcluster/graph/src/extend.js b/security/nss/automation/taskcluster/graph/src/extend.js
index d9f6938c0..d541a1a3b 100644
--- a/security/nss/automation/taskcluster/graph/src/extend.js
+++ b/security/nss/automation/taskcluster/graph/src/extend.js
@@ -746,7 +746,7 @@ async function scheduleTools() {
     command: [
       "/bin/bash",
       "-c",
-      "bin/checkout.sh && nss/automation/taskcluster/scripts/run_clang_format.sh"
+      "bin/checkout.sh && nss/automation/clang-format/run_clang_format.sh"
     ]
   }));
 
diff --git a/security/nss/automation/taskcluster/graph/src/queue.js b/security/nss/automation/taskcluster/graph/src/queue.js
index b78c54d6d..29b570729 100644
--- a/security/nss/automation/taskcluster/graph/src/queue.js
+++ b/security/nss/automation/taskcluster/graph/src/queue.js
@@ -25,10 +25,18 @@ function fromNow(hours) {
 }
 
 function parseRoutes(routes) {
-  return [
+  let rv = [
     `tc-treeherder.v2.${process.env.TC_PROJECT}.${process.env.NSS_HEAD_REVISION}.${process.env.NSS_PUSHLOG_ID}`,
     ...routes
   ];
+
+  // Notify about failures (except on try).
+  if (process.env.TC_PROJECT != "nss-try") {
+    rv.push(`notify.email.${process.env.TC_OWNER}.on-failed`,
+            `notify.email.${process.env.TC_OWNER}.on-exception`);
+  }
+
+  return rv;
 }
 
 function parseFeatures(list) {
diff --git a/security/nss/automation/taskcluster/scripts/split.sh b/security/nss/automation/taskcluster/scripts/split.sh
index c43c3e45f..4d18385ec 100644
--- a/security/nss/automation/taskcluster/scripts/split.sh
+++ b/security/nss/automation/taskcluster/scripts/split.sh
@@ -24,7 +24,7 @@ split_util() {
   cp -R $nssdir $dstdir
 
   # Skip gtests when building.
-  sed '/^DIRS = /s/ gtests$//' $nssdir/manifest.mn > $dstdir/manifest.mn-t && mv $dstdir/manifest.mn-t $dstdir/manifest.mn
+  sed '/^DIRS = /s/ cpputil gtests$//' $nssdir/manifest.mn > $dstdir/manifest.mn-t && mv $dstdir/manifest.mn-t $dstdir/manifest.mn
 
   # Remove subdirectories that we don't want.
   rm -rf $dstdir/cmd
@@ -32,6 +32,7 @@ split_util() {
   rm -rf $dstdir/lib
   rm -rf $dstdir/automation
   rm -rf $dstdir/gtests
+  rm -rf $dstdir/cpputil
   rm -rf $dstdir/doc
 
   # Start with an empty cmd lib directories to be filled selectively.
@@ -66,7 +67,7 @@ split_softoken() {
   cp -R $nssdir $dstdir
 
   # Skip gtests when building.
-  sed '/^DIRS = /s/ gtests$//' $nssdir/manifest.mn > $dstdir/manifest.mn-t && mv $dstdir/manifest.mn-t $dstdir/manifest.mn
+  sed '/^DIRS = /s/ cpputil gtests$//' $nssdir/manifest.mn > $dstdir/manifest.mn-t && mv $dstdir/manifest.mn-t $dstdir/manifest.mn
 
   # Remove subdirectories that we don't want.
   rm -rf $dstdir/cmd
@@ -75,6 +76,7 @@ split_softoken() {
   rm -rf $dstdir/pkg
   rm -rf $dstdir/automation
   rm -rf $dstdir/gtests
+  rm -rf $dstdir/cpputil
   rm -rf $dstdir/doc
 
   # Start with an empty lib directory and copy only what we need.
diff --git a/security/nss/build.sh b/security/nss/build.sh
index 0a9ce762e..2b377dec5 100644
--- a/security/nss/build.sh
+++ b/security/nss/build.sh
@@ -93,6 +93,7 @@ while [ $# -gt 0 ]; do
         --system-sqlite) gyp_params+=(-Duse_system_sqlite=1) ;;
         --with-nspr=?*) set_nspr_path "${1#*=}"; no_local_nspr=1 ;;
         --system-nspr) set_nspr_path "/usr/include/nspr/:"; no_local_nspr=1 ;;
+        --enable-libpkix) gyp_params+=(-Ddisable_libpkix=0) ;;
         *) show_help; exit 2 ;;
     esac
     shift
diff --git a/security/nss/cmd/certutil/keystuff.c b/security/nss/cmd/certutil/keystuff.c
index 1569313ba..2878e3765 100644
--- a/security/nss/cmd/certutil/keystuff.c
+++ b/security/nss/cmd/certutil/keystuff.c
@@ -17,14 +17,6 @@
 #include <conio.h>
 #endif
 
-#if defined(__sun) && !defined(SVR4)
-extern int fclose(FILE *);
-extern int fprintf(FILE *, char *, ...);
-extern int isatty(int);
-extern char *sys_errlist[];
-#define strerror(errno) sys_errlist[errno]
-#endif
-
 #include "nspr.h"
 #include "prtypes.h"
 #include "prtime.h"
diff --git a/security/nss/cmd/platlibs.gypi b/security/nss/cmd/platlibs.gypi
index a945ab20f..9963bdd33 100644
--- a/security/nss/cmd/platlibs.gypi
+++ b/security/nss/cmd/platlibs.gypi
@@ -33,6 +33,7 @@
           '<(DEPTH)/lib/base/base.gyp:nssb',
           '<(DEPTH)/lib/freebl/freebl.gyp:freebl',
           '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3',
+          '<(DEPTH)/lib/libpkix/libpkix.gyp:libpkix',
         ],
         'conditions': [
           [ 'disable_dbm==0', {
@@ -41,21 +42,6 @@
               '<(DEPTH)/lib/softoken/legacydb/legacydb.gyp:nssdbm',
             ],
           }],
-          [ 'disable_libpkix==0', {
-            'dependencies': [
-              '<(DEPTH)/lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
-              '<(DEPTH)/lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
-              '<(DEPTH)/lib/libpkix/pkix/params/params.gyp:pkixparams',
-              '<(DEPTH)/lib/libpkix/pkix/results/results.gyp:pkixresults',
-              '<(DEPTH)/lib/libpkix/pkix/top/top.gyp:pkixtop',
-              '<(DEPTH)/lib/libpkix/pkix/util/util.gyp:pkixutil',
-              '<(DEPTH)/lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
-              '<(DEPTH)/lib/libpkix/pkix/store/store.gyp:pkixstore',
-              '<(DEPTH)/lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
-              '<(DEPTH)/lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
-              '<(DEPTH)/lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule'
-            ],
-          }],
         ]},{ # !use_static_libs
           'conditions': [
             ['moz_fold_libs==0', {
diff --git a/security/nss/cmd/platlibs.mk b/security/nss/cmd/platlibs.mk
index 25b4bdffe..a59d03d06 100644
--- a/security/nss/cmd/platlibs.mk
+++ b/security/nss/cmd/platlibs.mk
@@ -32,6 +32,12 @@ else
 DBMLIB = $(DIST)/lib/$(LIB_PREFIX)dbm.$(LIB_SUFFIX) 
 endif
 
+ifeq ($(NSS_BUILD_UTIL_ONLY),1)
+SECTOOL_LIB = $(NULL)
+else
+SECTOOL_LIB = $(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX)
+endif
+
 ifdef USE_STATIC_LIBS
 
 DEFINES += -DNSS_USE_STATIC_LIBS
@@ -70,20 +76,10 @@ endif
 endif
 
 NSS_LIBS_1=
-SECTOOL_LIB=
 NSS_LIBS_2=
 NSS_LIBS_3=
 NSS_LIBS_4=
 
-ifneq ($(NSS_BUILD_UTIL_ONLY),1)
-SECTOOL_LIB = \
-	$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
-	$(NULL)
-else
-SECTOOL_LIB = \
-	$(NULL)
-endif
-
 ifneq ($(NSS_BUILD_SOFTOKEN_ONLY),1)
 ifeq ($(OS_ARCH), WINNT)
 # breakdown for windows
@@ -121,9 +117,6 @@ NSS_LIBS_1 = \
 	$(DIST)/lib/$(LIB_PREFIX)ssl.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nss.$(LIB_SUFFIX) \
 	$(NULL)
-SECTOOL_LIB = \
-	$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
-	$(NULL)
 NSS_LIBS_2 = \
 	$(DIST)/lib/$(LIB_PREFIX)pkcs12.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)pkcs7.$(LIB_SUFFIX) \
@@ -201,7 +194,7 @@ ifeq ($(OS_ARCH), WINNT)
 
 # $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS)
 EXTRA_LIBS += \
-	$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
+	$(SECTOOL_LIB) \
 	$(NSSUTIL_LIB_DIR)/$(IMPORT_LIB_PREFIX)nssutil3$(IMPORT_LIB_SUFFIX) \
 	$(DIST)/lib/$(IMPORT_LIB_PREFIX)smime3$(IMPORT_LIB_SUFFIX) \
 	$(DIST)/lib/$(IMPORT_LIB_PREFIX)ssl3$(IMPORT_LIB_SUFFIX) \
@@ -220,7 +213,7 @@ else
 
 # $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS)
 EXTRA_LIBS += \
-	$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
+	$(SECTOOL_LIB) \
 	$(NULL)
 
 ifeq ($(OS_ARCH), AIX) 
@@ -238,6 +231,7 @@ EXTRA_SHARED_LIBS += \
 	-lplds4 \
 	-lnspr4 \
 	$(NULL)
+ifndef NSS_BUILD_UTIL_ONLY
 ifndef NSS_BUILD_SOFTOKEN_ONLY
 EXTRA_SHARED_LIBS += \
 	-lssl3 \
@@ -245,6 +239,7 @@ EXTRA_SHARED_LIBS += \
 	-lnss3
 endif
 endif
+endif
 
 ifdef SOFTOKEN_LIB_DIR
 ifdef NSS_USE_SYSTEM_FREEBL
diff --git a/security/nss/cmd/symkeyutil/symkeyutil.c b/security/nss/cmd/symkeyutil/symkeyutil.c
index 6170cc3c5..444456808 100644
--- a/security/nss/cmd/symkeyutil/symkeyutil.c
+++ b/security/nss/cmd/symkeyutil/symkeyutil.c
@@ -233,6 +233,9 @@ BufToHex(SECItem *outbuf)
     unsigned int i;
 
     string = PORT_Alloc(len);
+    if (!string) {
+        return NULL;
+    }
 
     ptr = string;
     for (i = 0; i < outbuf->len; i++) {
diff --git a/security/nss/coreconf/coreconf.dep b/security/nss/coreconf/coreconf.dep
index 5182f7555..590d1bfae 100644
--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -10,3 +10,4 @@
  */
 
 #error "Do not include this header file."
+
diff --git a/security/nss/cpputil/dummy_io.cc b/security/nss/cpputil/dummy_io.cc
index a8dacedbe..ef45db833 100644
--- a/security/nss/cpputil/dummy_io.cc
+++ b/security/nss/cpputil/dummy_io.cc
@@ -19,6 +19,10 @@ extern const struct PRIOMethods DummyMethodsForward;
 ScopedPRFileDesc DummyIOLayerMethods::CreateFD(PRDescIdentity id,
                                                DummyIOLayerMethods *methods) {
   ScopedPRFileDesc fd(PR_CreateIOLayerStub(id, &DummyMethodsForward));
+  assert(fd);
+  if (!fd) {
+    return nullptr;
+  }
   fd->secret = reinterpret_cast<PRFilePrivate *>(methods);
   return fd;
 }
diff --git a/security/nss/cpputil/scoped_ptrs.h b/security/nss/cpputil/scoped_ptrs.h
index 0436cd20e..9f224dfc0 100644
--- a/security/nss/cpputil/scoped_ptrs.h
+++ b/security/nss/cpputil/scoped_ptrs.h
@@ -35,6 +35,7 @@ struct ScopedDelete {
   }
   void operator()(PK11URI* uri) { PK11URI_DestroyURI(uri); }
   void operator()(PLArenaPool* arena) { PORT_FreeArena(arena, PR_FALSE); }
+  void operator()(PK11Context* context) { PK11_DestroyContext(context, true); }
 };
 
 template <class T>
@@ -64,6 +65,7 @@ SCOPED(SECKEYPrivateKey);
 SCOPED(SECKEYPrivateKeyList);
 SCOPED(PK11URI);
 SCOPED(PLArenaPool);
+SCOPED(PK11Context);
 
 #undef SCOPED
 
diff --git a/security/nss/fuzz/config/git-copy.sh b/security/nss/fuzz/config/git-copy.sh
index 1389ddabd..a5c7d371d 100644
--- a/security/nss/fuzz/config/git-copy.sh
+++ b/security/nss/fuzz/config/git-copy.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/usr/bin/env bash
 
 set -e
 
@@ -15,18 +15,19 @@ echo "Copy '$COMMIT' from '$REPO' to '$DIR'"
 if [ -f $DIR/.git-copy ]; then
   CURRENT=$(cat $DIR/.git-copy)
   if [ $(echo -n $COMMIT | wc -c) != "40" ]; then
+    # On the off chance that $COMMIT is a remote head.
     ACTUAL=$(git ls-remote $REPO $COMMIT | cut -c 1-40 -)
   else
     ACTUAL=$COMMIT
   fi
-  if [ CURRENT = ACTUAL ]; then
+  if [ "$CURRENT" = "$ACTUAL" ]; then
     echo "Up to date."
+    exit
   fi
 fi
 
-mkdir -p $DIR
-git -C $DIR init -q
+git init -q $DIR
 git -C $DIR fetch -q --depth=1 $REPO $COMMIT:git-copy-tmp
 git -C $DIR reset --hard git-copy-tmp
-git -C $DIR show-ref HEAD | cut -c 1-40 - > $DIR/.git-copy
+git -C $DIR rev-parse --verify HEAD > $DIR/.git-copy
 rm -rf $DIR/.git
diff --git a/security/nss/gtests/.clang-format b/security/nss/gtests/.clang-format
index 06e3c5115..e0cd94ad7 100644
--- a/security/nss/gtests/.clang-format
+++ b/security/nss/gtests/.clang-format
@@ -1,4 +1,5 @@
 ---
 Language: Cpp
 BasedOnStyle: Google
+SortIncludes: false
 ...
diff --git a/security/nss/gtests/certdb_gtest/alg1485_unittest.cc b/security/nss/gtests/certdb_gtest/alg1485_unittest.cc
index a6bd40b4b..b7c659414 100644
--- a/security/nss/gtests/certdb_gtest/alg1485_unittest.cc
+++ b/security/nss/gtests/certdb_gtest/alg1485_unittest.cc
@@ -18,8 +18,20 @@ typedef struct AVATestValuesStr {
   bool expectedResult;
 } AVATestValues;
 
-class Alg1485Test : public ::testing::Test,
-                    public ::testing::WithParamInterface<AVATestValues> {};
+typedef struct AVACompareValuesStr {
+  std::string avaString1;
+  std::string avaString2;
+  SECComparison expectedResult;
+} AVACompareValues;
+
+class Alg1485Test : public ::testing::Test {};
+
+class Alg1485ParseTest : public Alg1485Test,
+                         public ::testing::WithParamInterface<AVATestValues> {};
+
+class Alg1485CompareTest
+    : public Alg1485Test,
+      public ::testing::WithParamInterface<AVACompareValues> {};
 
 static const AVATestValues kAVATestStrings[] = {
     {"CN=Marshall T. Rose, O=Dover Beach Consulting, L=Santa Clara, "
@@ -45,13 +57,36 @@ static const AVATestValues kAVATestStrings[] = {
     // { "CN=Somebody,L=Set,O=Up,C=US,01=The,02=Bomb", false },
 };
 
-TEST_P(Alg1485Test, TryParsingAVAStrings) {
+static const AVACompareValues kAVACompareStrings[] = {
+    {"CN=Max, O=Mozilla, ST=Berlin", "CN=Max, O=Mozilla, ST=Berlin, C=DE",
+     SECLessThan},
+    {"CN=Max, O=Mozilla, ST=Berlin, C=DE", "CN=Max, O=Mozilla, ST=Berlin",
+     SECGreaterThan},
+    {"CN=Max, O=Mozilla, ST=Berlin, C=DE", "CN=Max, O=Mozilla, ST=Berlin, C=DE",
+     SECEqual},
+    {"CN=Max1, O=Mozilla, ST=Berlin, C=DE",
+     "CN=Max2, O=Mozilla, ST=Berlin, C=DE", SECLessThan},
+    {"CN=Max, O=Mozilla, ST=Berlin, C=DE", "CN=Max, O=Mozilla, ST=Berlin, C=US",
+     SECLessThan},
+};
+
+TEST_P(Alg1485ParseTest, TryParsingAVAStrings) {
   const AVATestValues& param(GetParam());
 
   ScopedCERTName certName(CERT_AsciiToName(param.avaString.c_str()));
   ASSERT_EQ(certName != nullptr, param.expectedResult);
 }
 
-INSTANTIATE_TEST_CASE_P(ParseAVAStrings, Alg1485Test,
+TEST_P(Alg1485CompareTest, CompareAVAStrings) {
+  const AVACompareValues& param(GetParam());
+  ScopedCERTName a(CERT_AsciiToName(param.avaString1.c_str()));
+  ScopedCERTName b(CERT_AsciiToName(param.avaString2.c_str()));
+  ASSERT_TRUE(a && b);
+  EXPECT_EQ(param.expectedResult, CERT_CompareName(a.get(), b.get()));
+}
+
+INSTANTIATE_TEST_CASE_P(ParseAVAStrings, Alg1485ParseTest,
                         ::testing::ValuesIn(kAVATestStrings));
+INSTANTIATE_TEST_CASE_P(CompareAVAStrings, Alg1485CompareTest,
+                        ::testing::ValuesIn(kAVACompareStrings));
 }
diff --git a/security/nss/gtests/certhigh_gtest/manifest.mn b/security/nss/gtests/certhigh_gtest/manifest.mn
index f642f57c5..998f7a363 100644
--- a/security/nss/gtests/certhigh_gtest/manifest.mn
+++ b/security/nss/gtests/certhigh_gtest/manifest.mn
@@ -14,9 +14,9 @@ INCLUDES += -I$(CORE_DEPTH)/gtests/google_test/gtest/include \
             -I$(CORE_DEPTH)/gtests/common \
             -I$(CORE_DEPTH)/cpputil
 
-REQUIRES = nspr nss libdbm gtest
+REQUIRES = nspr gtest
 
 PROGRAM = certhigh_gtest
 
 EXTRA_LIBS = $(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX) $(EXTRA_OBJS) \
-             ../common/$(OBJDIR)/gtests$(OBJ_SUFFIX)
+             $(DIST)/lib/$(LIB_PREFIX)gtestutil.$(LIB_SUFFIX)
diff --git a/security/nss/gtests/common/manifest.mn b/security/nss/gtests/common/manifest.mn
index a40989bf7..5d36c269f 100644
--- a/security/nss/gtests/common/manifest.mn
+++ b/security/nss/gtests/common/manifest.mn
@@ -6,9 +6,13 @@ CORE_DEPTH = ../..
 DEPTH      = ../..
 MODULE = nss
 
-CPPSRCS = \
-      gtests.cc \
-      $(NULL)
+LIBRARY_NAME = gtestutil
+
+ifeq ($(NSS_BUILD_UTIL_ONLY),1)
+CPPSRCS = gtests-util.cc
+else
+CPPSRCS = gtests.cc
+endif
 
 INCLUDES += -I$(CORE_DEPTH)/gtests/google_test/gtest/include \
             -I$(CORE_DEPTH)/gtests/common \
@@ -17,6 +21,3 @@ INCLUDES += -I$(CORE_DEPTH)/gtests/google_test/gtest/include \
 REQUIRES = gtest
 
 EXTRA_LIBS = $(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX)
-
-# NOTE: this is not actually used but required to build gtests.o
-PROGRAM = gtests
diff --git a/security/nss/gtests/der_gtest/der_getint_unittest.cc b/security/nss/gtests/der_gtest/der_getint_unittest.cc
index e4b225e5c..11429ff10 100644
--- a/security/nss/gtests/der_gtest/der_getint_unittest.cc
+++ b/security/nss/gtests/der_gtest/der_getint_unittest.cc
@@ -4,14 +4,13 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "secder.h"
+#include "secerr.h"
+
 #include <climits>
 #include <memory>
-#include "nss.h"
-#include "pk11pub.h"
-#include "secutil.h"
 
 #include "gtest/gtest.h"
-#include "scoped_ptrs.h"
 
 namespace nss_test {
 
diff --git a/security/nss/gtests/der_gtest/der_gtest.gyp b/security/nss/gtests/der_gtest/der_gtest.gyp
index 23915ba7a..9a382912e 100644
--- a/security/nss/gtests/der_gtest/der_gtest.gyp
+++ b/security/nss/gtests/der_gtest/der_gtest.gyp
@@ -12,7 +12,6 @@
       'type': 'executable',
       'sources': [
         'der_getint_unittest.cc',
-        'der_private_key_import_unittest.cc',
         'der_quickder_unittest.cc',
         '<(DEPTH)/gtests/common/gtests.cc'
       ],
diff --git a/security/nss/gtests/der_gtest/der_quickder_unittest.cc b/security/nss/gtests/der_gtest/der_quickder_unittest.cc
index fab115bbf..944117909 100644
--- a/security/nss/gtests/der_gtest/der_quickder_unittest.cc
+++ b/security/nss/gtests/der_gtest/der_quickder_unittest.cc
@@ -7,11 +7,12 @@
 #include <stdint.h>
 
 #include "gtest/gtest.h"
-#include "scoped_ptrs.h"
+#include "scoped_ptrs_util.h"
 
 #include "nss.h"
 #include "prerror.h"
 #include "secasn1.h"
+#include "secder.h"
 #include "secerr.h"
 #include "secitem.h"
 
diff --git a/security/nss/gtests/der_gtest/manifest.mn b/security/nss/gtests/der_gtest/manifest.mn
index 5935ed0e3..a61d0f104 100644
--- a/security/nss/gtests/der_gtest/manifest.mn
+++ b/security/nss/gtests/der_gtest/manifest.mn
@@ -8,7 +8,6 @@ MODULE = nss
 
 CPPSRCS = \
       der_getint_unittest.cc \
-      der_private_key_import_unittest.cc \
       der_quickder_unittest.cc \
       $(NULL)
 
@@ -16,9 +15,9 @@ INCLUDES += -I$(CORE_DEPTH)/gtests/google_test/gtest/include \
             -I$(CORE_DEPTH)/gtests/common \
             -I$(CORE_DEPTH)/cpputil
 
-REQUIRES = nspr nss libdbm gtest
+REQUIRES = nspr gtest
 
 PROGRAM = der_gtest
 
 EXTRA_LIBS = $(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX) $(EXTRA_OBJS) \
-             ../common/$(OBJDIR)/gtests$(OBJ_SUFFIX)
+             $(DIST)/lib/$(LIB_PREFIX)gtestutil.$(LIB_SUFFIX)
diff --git a/security/nss/gtests/freebl_gtest/freebl_gtest.gyp b/security/nss/gtests/freebl_gtest/freebl_gtest.gyp
index 99f10fbd2..7e11cd103 100644
--- a/security/nss/gtests/freebl_gtest/freebl_gtest.gyp
+++ b/security/nss/gtests/freebl_gtest/freebl_gtest.gyp
@@ -14,6 +14,7 @@
         'mpi_unittest.cc',
         'dh_unittest.cc',
         'ecl_unittest.cc',
+        'ghash_unittest.cc',
         '<(DEPTH)/gtests/common/gtests.cc'
       ],
       'dependencies': [
@@ -50,6 +51,7 @@
         '<(DEPTH)/lib/dev/dev.gyp:nssdev',
         '<(DEPTH)/lib/pki/pki.gyp:nsspki',
         '<(DEPTH)/lib/ssl/ssl.gyp:ssl',
+        '<(DEPTH)/lib/libpkix/libpkix.gyp:libpkix',
       ],
       'conditions': [
         [ 'OS=="win"', {
diff --git a/security/nss/gtests/freebl_gtest/prng_kat_unittest.cc b/security/nss/gtests/freebl_gtest/prng_kat_unittest.cc
index 7bc9beea3..6537685a2 100644
--- a/security/nss/gtests/freebl_gtest/prng_kat_unittest.cc
+++ b/security/nss/gtests/freebl_gtest/prng_kat_unittest.cc
@@ -8,10 +8,10 @@
 
 #include <cstdlib>
 #include <fstream>
-#include <string>
 
 #define GTEST_HAS_RTTI 0
 #include "gtest/gtest.h"
+#include "util.h"
 
 #include "blapi.h"
 
@@ -44,15 +44,6 @@ std::string trim(std::string str) {
   return str.substr(strBegin, strRange);
 }
 
-std::vector<uint8_t> hex_string_to_bytes(std::string s) {
-  std::vector<uint8_t> bytes;
-  assert(s.length() % 2 == 0);
-  for (size_t i = 0; i < s.length(); i += 2) {
-    bytes.push_back(std::stoul(s.substr(i, 2), nullptr, 16));
-  }
-  return bytes;
-}
-
 std::vector<uint8_t> read_option_s(std::string& s) {
   size_t start = s.find("=") + 1;
   assert(start > 0);
diff --git a/security/nss/gtests/manifest.mn b/security/nss/gtests/manifest.mn
index d572edad0..1ae4cab77 100644
--- a/security/nss/gtests/manifest.mn
+++ b/security/nss/gtests/manifest.mn
@@ -5,14 +5,32 @@
 CORE_DEPTH = ..
 DEPTH      = ..
 
-DIRS = \
+LIB_SRCDIRS = \
 	google_test \
 	common \
+	$(NULL)
+
+ifneq ($(NSS_BUILD_WITHOUT_UTIL),1)
+UTIL_SRCDIRS = \
+	util_gtest \
+	der_gtest \
+	$(NULL)
+endif
+
+ifneq ($(NSS_BUILD_SOFTOKEN_ONLY),1)
+ifneq ($(NSS_BUILD_UTIL_ONLY),1)
+NSS_SRCDIRS = \
 	certdb_gtest \
 	certhigh_gtest \
-	der_gtest \
-	util_gtest \
 	pk11_gtest \
 	ssl_gtest \
         nss_bogo_shim \
 	$(NULL)
+endif
+endif
+
+DIRS = \
+	$(LIB_SRCDIRS) \
+	$(UTIL_SRCDIRS) \
+	$(NSS_SRCDIRS) \
+	$(NULL)
diff --git a/security/nss/gtests/nss_bogo_shim/nss_bogo_shim.gyp b/security/nss/gtests/nss_bogo_shim/nss_bogo_shim.gyp
index 7f7131125..b8f71f95f 100644
--- a/security/nss/gtests/nss_bogo_shim/nss_bogo_shim.gyp
+++ b/security/nss/gtests/nss_bogo_shim/nss_bogo_shim.gyp
@@ -35,7 +35,8 @@
         '<(DEPTH)/lib/dev/dev.gyp:nssdev',
         '<(DEPTH)/lib/base/base.gyp:nssb',
         '<(DEPTH)/lib/freebl/freebl.gyp:freebl',
-        '<(DEPTH)/lib/zlib/zlib.gyp:nss_zlib'
+        '<(DEPTH)/lib/zlib/zlib.gyp:nss_zlib',
+        '<(DEPTH)/lib/libpkix/libpkix.gyp:libpkix',
       ],
       'conditions': [
         [ 'disable_dbm==0', {
@@ -43,21 +44,6 @@
             '<(DEPTH)/lib/dbm/src/src.gyp:dbm',
           ],
         }],
-        [ 'disable_libpkix==0', {
-          'dependencies': [
-            '<(DEPTH)/lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
-            '<(DEPTH)/lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
-            '<(DEPTH)/lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
-            '<(DEPTH)/lib/libpkix/pkix/params/params.gyp:pkixparams',
-            '<(DEPTH)/lib/libpkix/pkix/results/results.gyp:pkixresults',
-            '<(DEPTH)/lib/libpkix/pkix/store/store.gyp:pkixstore',
-            '<(DEPTH)/lib/libpkix/pkix/top/top.gyp:pkixtop',
-            '<(DEPTH)/lib/libpkix/pkix/util/util.gyp:pkixutil',
-            '<(DEPTH)/lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
-            '<(DEPTH)/lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule',
-            '<(DEPTH)/lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
-          ],
-        }],
       ],
     }
   ],
diff --git a/security/nss/gtests/pk11_gtest/manifest.mn b/security/nss/gtests/pk11_gtest/manifest.mn
index 453e09afd..fb773ee18 100644
--- a/security/nss/gtests/pk11_gtest/manifest.mn
+++ b/security/nss/gtests/pk11_gtest/manifest.mn
@@ -16,6 +16,7 @@ CPPSRCS = \
       pk11_prf_unittest.cc \
       pk11_prng_unittest.cc \
       pk11_rsapss_unittest.cc \
+      pk11_der_private_key_import_unittest.cc \
       $(NULL)
 
 INCLUDES += -I$(CORE_DEPTH)/gtests/google_test/gtest/include \
@@ -27,5 +28,5 @@ REQUIRES = nspr nss libdbm gtest
 PROGRAM = pk11_gtest
 
 EXTRA_LIBS = $(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX) $(EXTRA_OBJS) \
-             ../common/$(OBJDIR)/gtests$(OBJ_SUFFIX)
+             $(DIST)/lib/$(LIB_PREFIX)gtestutil.$(LIB_SUFFIX)
 
diff --git a/security/nss/gtests/pk11_gtest/pk11_gtest.gyp b/security/nss/gtests/pk11_gtest/pk11_gtest.gyp
index 41578e7ca..c47ff4778 100644
--- a/security/nss/gtests/pk11_gtest/pk11_gtest.gyp
+++ b/security/nss/gtests/pk11_gtest/pk11_gtest.gyp
@@ -12,6 +12,7 @@
       'type': 'executable',
       'sources': [
         'pk11_aeskeywrap_unittest.cc',
+        'pk11_aes_gcm_unittest.cc',
         'pk11_chacha20poly1305_unittest.cc',
         'pk11_curve25519_unittest.cc',
         'pk11_ecdsa_unittest.cc',
@@ -19,6 +20,7 @@
         'pk11_prf_unittest.cc',
         'pk11_prng_unittest.cc',
         'pk11_rsapss_unittest.cc',
+        'pk11_der_private_key_import_unittest.cc',
         '<(DEPTH)/gtests/common/gtests.cc'
       ],
       'dependencies': [
diff --git a/security/nss/gtests/ssl_gtest/libssl_internals.c b/security/nss/gtests/ssl_gtest/libssl_internals.c
index 32ffcb6f4..97b8354ae 100644
--- a/security/nss/gtests/ssl_gtest/libssl_internals.c
+++ b/security/nss/gtests/ssl_gtest/libssl_internals.c
@@ -10,6 +10,7 @@
 #include "nss.h"
 #include "pk11pub.h"
 #include "seccomon.h"
+#include "selfencrypt.h"
 
 SECStatus SSLInt_IncrementClientHandshakeVersion(PRFileDesc *fd) {
   sslSocket *ss = ssl_FindSocket(fd);
@@ -55,7 +56,16 @@ PRBool SSLInt_ExtensionNegotiated(PRFileDesc *fd, PRUint16 ext) {
   return (PRBool)(ss && ssl3_ExtensionNegotiated(ss, ext));
 }
 
-void SSLInt_ClearSessionTicketKey() { ssl_ResetSessionTicketKeys(); }
+void SSLInt_ClearSelfEncryptKey() { ssl_ResetSelfEncryptKeys(); }
+
+sslSelfEncryptKeys *ssl_GetSelfEncryptKeysInt();
+
+void SSLInt_SetSelfEncryptMacKey(PK11SymKey *key) {
+  sslSelfEncryptKeys *keys = ssl_GetSelfEncryptKeysInt();
+
+  PK11_FreeSymKey(keys->macKey);
+  keys->macKey = key;
+}
 
 SECStatus SSLInt_SetMTU(PRFileDesc *fd, PRUint16 mtu) {
   sslSocket *ss = ssl_FindSocket(fd);
diff --git a/security/nss/gtests/ssl_gtest/libssl_internals.h b/security/nss/gtests/ssl_gtest/libssl_internals.h
index 531c31ffc..33709c4b4 100644
--- a/security/nss/gtests/ssl_gtest/libssl_internals.h
+++ b/security/nss/gtests/ssl_gtest/libssl_internals.h
@@ -22,7 +22,8 @@ SECStatus SSLInt_UpdateSSLv2ClientRandom(PRFileDesc *fd, uint8_t *rnd,
                                          size_t msg_len);
 
 PRBool SSLInt_ExtensionNegotiated(PRFileDesc *fd, PRUint16 ext);
-void SSLInt_ClearSessionTicketKey();
+void SSLInt_ClearSelfEncryptKey();
+void SSLInt_SetSelfEncryptMacKey(PK11SymKey *key);
 PRInt32 SSLInt_CountTls13CipherSpecs(PRFileDesc *fd);
 void SSLInt_PrintTls13CipherSpecs(PRFileDesc *fd);
 void SSLInt_ForceTimerExpiry(PRFileDesc *fd);
diff --git a/security/nss/gtests/ssl_gtest/manifest.mn b/security/nss/gtests/ssl_gtest/manifest.mn
index e3775cc04..cc729c0f1 100644
--- a/security/nss/gtests/ssl_gtest/manifest.mn
+++ b/security/nss/gtests/ssl_gtest/manifest.mn
@@ -12,9 +12,6 @@ CSRCS = \
       $(NULL)
 
 CPPSRCS = \
-      $(CORE_DEPTH)/cpputil/dummy_io.cc \
-      $(CORE_DEPTH)/cpputil/dummy_io_fwd.cc \
-      $(CORE_DEPTH)/cpputil/tls_parser.cc \
       ssl_0rtt_unittest.cc \
       ssl_agent_unittest.cc \
       ssl_auth_unittest.cc \
@@ -40,6 +37,7 @@ CPPSRCS = \
       ssl_v2_client_hello_unittest.cc \
       ssl_version_unittest.cc \
       ssl_versionpolicy_unittest.cc \
+      selfencrypt_unittest.cc \
       test_io.cc \
       tls_agent.cc \
       tls_connect.cc \
@@ -52,9 +50,12 @@ INCLUDES += -I$(CORE_DEPTH)/gtests/google_test/gtest/include \
             -I$(CORE_DEPTH)/gtests/common \
             -I$(CORE_DEPTH)/cpputil
 
-REQUIRES = nspr nss libdbm gtest
+REQUIRES = nspr nss libdbm gtest cpputil
 
 PROGRAM = ssl_gtest
-EXTRA_LIBS = $(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX)
+EXTRA_LIBS += \
+      $(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX) \
+      $(DIST)/lib/$(LIB_PREFIX)cpputil.$(LIB_SUFFIX) \
+      $(NULL)
 
 USE_STATIC_LIBS = 1
diff --git a/security/nss/gtests/ssl_gtest/ssl_fuzz_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_fuzz_unittest.cc
index d08a0b60c..1587b66de 100644
--- a/security/nss/gtests/ssl_gtest/ssl_fuzz_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_fuzz_unittest.cc
@@ -281,13 +281,8 @@ FUZZ_P(TlsConnectGeneric, UnencryptedSessionTickets) {
     offset += 1 + 1 + /* ke_modes */
               1 + 1;  /* auth_modes */
   }
-
-  offset += 2 +  /* ticket length */
-            16 + /* SESS_TICKET_KEY_NAME_LEN */
-            16 + /* AES-128 IV */
-            2 +  /* ciphertext length */
-            2;   /* TLS_EX_SESS_TICKET_VERSION */
-
+  offset += 2 + /* ticket length */
+            2;  /* TLS_EX_SESS_TICKET_VERSION */
   // Check the protocol version number.
   uint32_t tls_version = 0;
   EXPECT_TRUE(i1->buffer().Read(offset, sizeof(version_), &tls_version));
diff --git a/security/nss/gtests/ssl_gtest/ssl_gtest.gyp b/security/nss/gtests/ssl_gtest/ssl_gtest.gyp
index f0b96d6e5..8cd7d1009 100644
--- a/security/nss/gtests/ssl_gtest/ssl_gtest.gyp
+++ b/security/nss/gtests/ssl_gtest/ssl_gtest.gyp
@@ -12,6 +12,7 @@
       'type': 'executable',
       'sources': [
         'libssl_internals.c',
+        'selfencrypt_unittest.cc',
         'ssl_0rtt_unittest.cc',
         'ssl_agent_unittest.cc',
         'ssl_auth_unittest.cc',
@@ -61,6 +62,7 @@
         '<(DEPTH)/lib/base/base.gyp:nssb',
         '<(DEPTH)/lib/zlib/zlib.gyp:nss_zlib',
         '<(DEPTH)/cpputil/cpputil.gyp:cpputil',
+        '<(DEPTH)/lib/libpkix/libpkix.gyp:libpkix',
       ],
       'conditions': [
         [ 'test_build==1', {
@@ -80,21 +82,6 @@
             '<(DEPTH)/lib/dbm/src/src.gyp:dbm',
           ],
         }],
-        [ 'disable_libpkix==0', {
-          'dependencies': [
-            '<(DEPTH)/lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
-            '<(DEPTH)/lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
-            '<(DEPTH)/lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
-            '<(DEPTH)/lib/libpkix/pkix/params/params.gyp:pkixparams',
-            '<(DEPTH)/lib/libpkix/pkix/results/results.gyp:pkixresults',
-            '<(DEPTH)/lib/libpkix/pkix/store/store.gyp:pkixstore',
-            '<(DEPTH)/lib/libpkix/pkix/top/top.gyp:pkixtop',
-            '<(DEPTH)/lib/libpkix/pkix/util/util.gyp:pkixutil',
-            '<(DEPTH)/lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
-            '<(DEPTH)/lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule',
-            '<(DEPTH)/lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
-          ],
-        }],
       ],
     }
   ],
diff --git a/security/nss/gtests/ssl_gtest/ssl_loopback_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_loopback_unittest.cc
index fd05754d8..77703dd8e 100644
--- a/security/nss/gtests/ssl_gtest/ssl_loopback_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_loopback_unittest.cc
@@ -198,8 +198,10 @@ TEST_P(TlsConnectGeneric, ConnectSendReceive) {
 TEST_P(TlsConnectDatagram, ShortRead) {
   Connect();
   client_->ExpectReadWriteError();
-  server_->SendData(1200, 1200);
-  client_->WaitForErrorCode(SSL_ERROR_RX_SHORT_DTLS_READ, 2000);
+  server_->SendData(50, 50);
+  client_->ReadBytes(20);
+  EXPECT_EQ(0U, client_->received_bytes());
+  EXPECT_EQ(SSL_ERROR_RX_SHORT_DTLS_READ, PORT_GetError());
 
   // Now send and receive another packet.
   server_->ResetSentBytes();  // Reset the counter.
@@ -213,13 +215,13 @@ TEST_P(TlsConnectStream, ShortRead) {
   if (version_ < SSL_LIBRARY_VERSION_TLS_1_1) return;
 
   Connect();
-  server_->SendData(1200, 1200);
+  server_->SendData(50, 50);
   // Read the first tranche.
-  WAIT_(client_->received_bytes() == 1024, 2000);
-  ASSERT_EQ(1024U, client_->received_bytes());
+  client_->ReadBytes(20);
+  ASSERT_EQ(20U, client_->received_bytes());
   // The second tranche should now immediately be available.
   client_->ReadBytes();
-  ASSERT_EQ(1200U, client_->received_bytes());
+  ASSERT_EQ(50U, client_->received_bytes());
 }
 
 TEST_P(TlsConnectGeneric, ConnectWithCompressionMaybe) {
diff --git a/security/nss/gtests/ssl_gtest/ssl_resumption_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_resumption_unittest.cc
index 7b43870b0..ce0e3ca8d 100644
--- a/security/nss/gtests/ssl_gtest/ssl_resumption_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_resumption_unittest.cc
@@ -258,6 +258,30 @@ TEST_P(TlsConnectGeneric, ConnectWithExpiredTicketAtServer) {
   CheckConnected();
 }
 
+TEST_P(TlsConnectGeneric, ConnectResumeCorruptTicket) {
+  // This causes a ticket resumption.
+  ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
+  Connect();
+  SendReceive();
+
+  Reset();
+  static const uint8_t kHmacKey1Buf[32] = {0};
+  static const DataBuffer kHmacKey1(kHmacKey1Buf, sizeof(kHmacKey1Buf));
+
+  SECItem key_item = {siBuffer, const_cast<uint8_t*>(kHmacKey1Buf),
+                      sizeof(kHmacKey1Buf)};
+
+  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+  PK11SymKey* hmac_key =
+      PK11_ImportSymKey(slot.get(), CKM_SHA256_HMAC, PK11_OriginUnwrap,
+                        CKA_SIGN, &key_item, nullptr);
+  ASSERT_NE(nullptr, hmac_key);
+  SSLInt_SetSelfEncryptMacKey(hmac_key);
+  ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
+  ConnectExpectAlert(server_, illegal_parameter);
+  server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
+}
+
 // This callback switches out the "server" cert used on the server with
 // the "client" certificate, which should be the same type.
 static int32_t SwitchCertificates(TlsAgent* agent, const SECItem* srvNameArr,
@@ -627,7 +651,7 @@ TEST_F(TlsConnectTest, TestTls13ResumptionDuplicateNST) {
   Connect();
 
   // Clear the session ticket keys to invalidate the old ticket.
-  SSLInt_ClearSessionTicketKey();
+  SSLInt_ClearSelfEncryptKey();
   SSLInt_SendNewSessionTicket(server_->ssl_fd());
 
   SendReceive();  // Need to read so that we absorb the session tickets.
diff --git a/security/nss/gtests/ssl_gtest/tls_agent.cc b/security/nss/gtests/ssl_gtest/tls_agent.cc
index a53cf8868..d6d91f7f7 100644
--- a/security/nss/gtests/ssl_gtest/tls_agent.cc
+++ b/security/nss/gtests/ssl_gtest/tls_agent.cc
@@ -918,10 +918,10 @@ void TlsAgent::SendBuffer(const DataBuffer& buf) {
   }
 }
 
-void TlsAgent::ReadBytes() {
-  uint8_t block[1024];
+void TlsAgent::ReadBytes(size_t amount) {
+  uint8_t block[16384];
 
-  int32_t rv = PR_Read(ssl_fd(), block, sizeof(block));
+  int32_t rv = PR_Read(ssl_fd(), block, (std::min)(amount, sizeof(block)));
   LOGV("ReadBytes " << rv);
   int32_t err;
 
diff --git a/security/nss/gtests/ssl_gtest/tls_agent.h b/security/nss/gtests/ssl_gtest/tls_agent.h
index 32f6175b6..4bccb9a84 100644
--- a/security/nss/gtests/ssl_gtest/tls_agent.h
+++ b/security/nss/gtests/ssl_gtest/tls_agent.h
@@ -151,7 +151,7 @@ class TlsAgent : public PollTarget {
   void SendBuffer(const DataBuffer& buf);
   // Send data directly to the underlying socket, skipping the TLS layer.
   void SendDirect(const DataBuffer& buf);
-  void ReadBytes();
+  void ReadBytes(size_t max = 16384U);
   void ResetSentBytes();  // Hack to test drops.
   void EnableExtendedMasterSecret();
   void CheckExtendedMasterSecret(bool expected);
diff --git a/security/nss/gtests/ssl_gtest/tls_connect.cc b/security/nss/gtests/ssl_gtest/tls_connect.cc
index 861d162ae..c8de5a1fe 100644
--- a/security/nss/gtests/ssl_gtest/tls_connect.cc
+++ b/security/nss/gtests/ssl_gtest/tls_connect.cc
@@ -169,13 +169,13 @@ void TlsConnectTestBase::ClearStats() {
 
 void TlsConnectTestBase::ClearServerCache() {
   SSL_ShutdownServerSessionIDCache();
-  SSLInt_ClearSessionTicketKey();
+  SSLInt_ClearSelfEncryptKey();
   SSL_ConfigServerSessionIDCache(1024, 0, 0, g_working_dir_path.c_str());
 }
 
 void TlsConnectTestBase::SetUp() {
   SSL_ConfigServerSessionIDCache(1024, 0, 0, g_working_dir_path.c_str());
-  SSLInt_ClearSessionTicketKey();
+  SSLInt_ClearSelfEncryptKey();
   SSLInt_SetTicketLifetime(30);
   SSLInt_SetMaxEarlyDataSize(1024);
   ClearStats();
@@ -187,7 +187,7 @@ void TlsConnectTestBase::TearDown() {
   server_ = nullptr;
 
   SSL_ClearSessionCache();
-  SSLInt_ClearSessionTicketKey();
+  SSLInt_ClearSelfEncryptKey();
   SSL_ShutdownServerSessionIDCache();
 }
 
diff --git a/security/nss/gtests/util_gtest/manifest.mn b/security/nss/gtests/util_gtest/manifest.mn
index c6fb60ee7..edede657f 100644
--- a/security/nss/gtests/util_gtest/manifest.mn
+++ b/security/nss/gtests/util_gtest/manifest.mn
@@ -25,5 +25,5 @@ PROGRAM = util_gtest
 EXTRA_LIBS = \
 	$(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nssutil.$(LIB_SUFFIX) \
-	../common/$(OBJDIR)/gtests$(OBJ_SUFFIX) \
+	$(DIST)/lib/$(LIB_PREFIX)gtestutil.$(LIB_SUFFIX) \
 	$(NULL)
diff --git a/security/nss/gtests/util_gtest/util_b64_unittest.cc b/security/nss/gtests/util_gtest/util_b64_unittest.cc
index 097fde2e8..cef9c7318 100644
--- a/security/nss/gtests/util_gtest/util_b64_unittest.cc
+++ b/security/nss/gtests/util_gtest/util_b64_unittest.cc
@@ -9,7 +9,7 @@
 #include "nssb64.h"
 
 #include "gtest/gtest.h"
-#include "scoped_ptrs.h"
+#include "scoped_ptrs_util.h"
 
 namespace nss_test {
 
diff --git a/security/nss/gtests/util_gtest/util_gtest.gyp b/security/nss/gtests/util_gtest/util_gtest.gyp
index d0ea99e5d..7abd71b2f 100644
--- a/security/nss/gtests/util_gtest/util_gtest.gyp
+++ b/security/nss/gtests/util_gtest/util_gtest.gyp
@@ -29,6 +29,7 @@
         '<(DEPTH)/lib/dev/dev.gyp:nssdev',
         '<(DEPTH)/lib/pki/pki.gyp:nsspki',
         '<(DEPTH)/lib/ssl/ssl.gyp:ssl',
+        '<(DEPTH)/lib/libpkix/libpkix.gyp:libpkix',
       ],
       'conditions': [
         [ 'OS=="win"', {
diff --git a/security/nss/gtests/util_gtest/util_pkcs11uri_unittest.cc b/security/nss/gtests/util_gtest/util_pkcs11uri_unittest.cc
index e64d8a744..5f1d94acf 100644
--- a/security/nss/gtests/util_gtest/util_pkcs11uri_unittest.cc
+++ b/security/nss/gtests/util_gtest/util_pkcs11uri_unittest.cc
@@ -9,7 +9,7 @@
 #include "pkcs11uri.h"
 
 #include "gtest/gtest.h"
-#include "scoped_ptrs.h"
+#include "scoped_ptrs_util.h"
 
 namespace nss_test {
 
diff --git a/security/nss/help.txt b/security/nss/help.txt
index 394a12d26..30ebef6b1 100644
--- a/security/nss/help.txt
+++ b/security/nss/help.txt
@@ -1,8 +1,8 @@
-Usage: ${0##*/} [-hcv] [-j <n>] [--nspr] [--gyp|-g] [--opt|-o] [-m32]
+Usage: build.sh [-hcv] [-j <n>] [--nspr] [--gyp|-g] [--opt|-o] [-m32]
                 [--test] [--pprof] [--scan-build[=output]] [--ct-verif]
                 [--asan] [--ubsan] [--msan] [--sancov[=edge|bb|func|...]]
                 [--disable-tests] [--fuzz[=tls|oss]] [--system-sqlite]
-                [--no-zdefs] [--with-nspr] [--system-nspr]
+                [--no-zdefs] [--with-nspr] [--system-nspr] [--enable-libpkix]
 
 This script builds NSS with gyp and ninja.
 
@@ -40,3 +40,4 @@ NSS build tool options:
                      --with-nspr=/path/to/nspr/include:/path/to/nspr/lib
     --system-nspr    use system nspr. This requires an installation of NSPR and
                      might not work on all systems.
+    --enable-libpkix make libpkix part of the build.
diff --git a/security/nss/lib/certdb/certv3.c b/security/nss/lib/certdb/certv3.c
index bf0bcf96c..d27fc1ba0 100644
--- a/security/nss/lib/certdb/certv3.c
+++ b/security/nss/lib/certdb/certv3.c
@@ -213,7 +213,7 @@ CERT_CheckCertUsage(CERTCertificate *cert, unsigned char usage)
     if (rv == SECFailure) {
         rv = (PORT_GetError() == SEC_ERROR_EXTENSION_NOT_FOUND) ? SECSuccess
                                                                 : SECFailure;
-    } else if (!(keyUsage.data[0] & usage)) {
+    } else if (!keyUsage.data || !(keyUsage.data[0] & usage)) {
         PORT_SetError(SEC_ERROR_CERT_USAGES_INVALID);
         rv = SECFailure;
     }
diff --git a/security/nss/lib/certdb/secname.c b/security/nss/lib/certdb/secname.c
index 6d3e9d372..654dfdf3f 100644
--- a/security/nss/lib/certdb/secname.c
+++ b/security/nss/lib/certdb/secname.c
@@ -568,8 +568,8 @@ CERT_CompareRDN(const CERTRDN *a, const CERTRDN *b)
 SECComparison
 CERT_CompareName(const CERTName *a, const CERTName *b)
 {
-    CERTRDN **ardns, *ardn;
-    CERTRDN **brdns, *brdn;
+    CERTRDN **ardns;
+    CERTRDN **brdns;
     int ac, bc;
     SECComparison rv = SECEqual;
 
@@ -587,18 +587,8 @@ CERT_CompareName(const CERTName *a, const CERTName *b)
     if (ac > bc)
         return SECGreaterThan;
 
-    for (;;) {
-        if (!ardns++ || !brdns++) {
-            break;
-        }
-        ardn = *ardns;
-        brdn = *brdns;
-        if (!ardn) {
-            break;
-        }
-        rv = CERT_CompareRDN(ardn, brdn);
-        if (rv)
-            return rv;
+    while (rv == SECEqual && *ardns) {
+        rv = CERT_CompareRDN(*ardns++, *brdns++);
     }
     return rv;
 }
diff --git a/security/nss/lib/ckfw/builtins/certdata.txt b/security/nss/lib/ckfw/builtins/certdata.txt
index 020db76b1..45b659b7a 100644
--- a/security/nss/lib/ckfw/builtins/certdata.txt
+++ b/security/nss/lib/ckfw/builtins/certdata.txt
@@ -226,7 +226,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -359,7 +359,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -854,7 +854,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 # Distrust "Distrust: O=Egypt Trust, OU=VeriSign Trust Network (cert 1/3)"
@@ -1127,7 +1127,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -1402,7 +1402,7 @@ END
 CKA_SERIAL_NUMBER MULTILINE_OCTAL
 \002\001\001
 END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
@@ -1554,298 +1554,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "AddTrust Public Services Root"
-#
-# Issuer: CN=AddTrust Public CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
-# Serial Number: 1 (0x1)
-# Subject: CN=AddTrust Public CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
-# Not Valid Before: Tue May 30 10:41:50 2000
-# Not Valid After : Sat May 30 10:41:50 2020
-# Fingerprint (MD5): C1:62:3E:23:C5:82:73:9C:03:59:4B:2B:E9:77:49:7F
-# Fingerprint (SHA1): 2A:B6:28:48:5E:78:FB:F3:AD:9E:79:10:DD:6B:DF:99:72:2C:96:E5
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "AddTrust Public Services Root"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\144\061\013\060\011\006\003\125\004\006\023\002\123\105\061
-\024\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165
-\163\164\040\101\102\061\035\060\033\006\003\125\004\013\023\024
-\101\144\144\124\162\165\163\164\040\124\124\120\040\116\145\164
-\167\157\162\153\061\040\060\036\006\003\125\004\003\023\027\101
-\144\144\124\162\165\163\164\040\120\165\142\154\151\143\040\103
-\101\040\122\157\157\164
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\144\061\013\060\011\006\003\125\004\006\023\002\123\105\061
-\024\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165
-\163\164\040\101\102\061\035\060\033\006\003\125\004\013\023\024
-\101\144\144\124\162\165\163\164\040\124\124\120\040\116\145\164
-\167\157\162\153\061\040\060\036\006\003\125\004\003\023\027\101
-\144\144\124\162\165\163\164\040\120\165\142\154\151\143\040\103
-\101\040\122\157\157\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\025\060\202\002\375\240\003\002\001\002\002\001\001
-\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060
-\144\061\013\060\011\006\003\125\004\006\023\002\123\105\061\024
-\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165\163
-\164\040\101\102\061\035\060\033\006\003\125\004\013\023\024\101
-\144\144\124\162\165\163\164\040\124\124\120\040\116\145\164\167
-\157\162\153\061\040\060\036\006\003\125\004\003\023\027\101\144
-\144\124\162\165\163\164\040\120\165\142\154\151\143\040\103\101
-\040\122\157\157\164\060\036\027\015\060\060\060\065\063\060\061
-\060\064\061\065\060\132\027\015\062\060\060\065\063\060\061\060
-\064\061\065\060\132\060\144\061\013\060\011\006\003\125\004\006
-\023\002\123\105\061\024\060\022\006\003\125\004\012\023\013\101
-\144\144\124\162\165\163\164\040\101\102\061\035\060\033\006\003
-\125\004\013\023\024\101\144\144\124\162\165\163\164\040\124\124
-\120\040\116\145\164\167\157\162\153\061\040\060\036\006\003\125
-\004\003\023\027\101\144\144\124\162\165\163\164\040\120\165\142
-\154\151\143\040\103\101\040\122\157\157\164\060\202\001\042\060
-\015\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202
-\001\017\000\060\202\001\012\002\202\001\001\000\351\032\060\217
-\203\210\024\301\040\330\074\233\217\033\176\003\164\273\332\151
-\323\106\245\370\216\302\014\021\220\121\245\057\146\124\100\125
-\352\333\037\112\126\356\237\043\156\364\071\313\241\271\157\362
-\176\371\135\207\046\141\236\034\370\342\354\246\201\370\041\305
-\044\314\021\014\077\333\046\162\172\307\001\227\007\027\371\327
-\030\054\060\175\016\172\036\142\036\306\113\300\375\175\142\167
-\323\104\036\047\366\077\113\104\263\267\070\331\071\037\140\325
-\121\222\163\003\264\000\151\343\363\024\116\356\321\334\011\317
-\167\064\106\120\260\370\021\362\376\070\171\367\007\071\376\121
-\222\227\013\133\010\137\064\206\001\255\210\227\353\146\315\136
-\321\377\334\175\362\204\332\272\167\255\334\200\010\307\247\207
-\326\125\237\227\152\350\310\021\144\272\347\031\051\077\021\263
-\170\220\204\040\122\133\021\357\170\320\203\366\325\110\220\320
-\060\034\317\200\371\140\376\171\344\210\362\335\000\353\224\105
-\353\145\224\151\100\272\300\325\264\270\272\175\004\021\250\353
-\061\005\226\224\116\130\041\216\237\320\140\375\002\003\001\000
-\001\243\201\321\060\201\316\060\035\006\003\125\035\016\004\026
-\004\024\201\076\067\330\222\260\037\167\237\134\264\253\163\252
-\347\366\064\140\057\372\060\013\006\003\125\035\017\004\004\003
-\002\001\006\060\017\006\003\125\035\023\001\001\377\004\005\060
-\003\001\001\377\060\201\216\006\003\125\035\043\004\201\206\060
-\201\203\200\024\201\076\067\330\222\260\037\167\237\134\264\253
-\163\252\347\366\064\140\057\372\241\150\244\146\060\144\061\013
-\060\011\006\003\125\004\006\023\002\123\105\061\024\060\022\006
-\003\125\004\012\023\013\101\144\144\124\162\165\163\164\040\101
-\102\061\035\060\033\006\003\125\004\013\023\024\101\144\144\124
-\162\165\163\164\040\124\124\120\040\116\145\164\167\157\162\153
-\061\040\060\036\006\003\125\004\003\023\027\101\144\144\124\162
-\165\163\164\040\120\165\142\154\151\143\040\103\101\040\122\157
-\157\164\202\001\001\060\015\006\011\052\206\110\206\367\015\001
-\001\005\005\000\003\202\001\001\000\003\367\025\112\370\044\332
-\043\126\026\223\166\335\066\050\271\256\033\270\303\361\144\272
-\040\030\170\225\051\047\127\005\274\174\052\364\271\121\125\332
-\207\002\336\017\026\027\061\370\252\171\056\011\023\273\257\262
-\040\031\022\345\223\371\113\371\203\350\104\325\262\101\045\277
-\210\165\157\377\020\374\112\124\320\137\360\372\357\066\163\175
-\033\066\105\306\041\155\264\025\270\116\317\234\134\245\075\132
-\000\216\006\343\074\153\062\173\362\237\360\266\375\337\360\050
-\030\110\360\306\274\320\277\064\200\226\302\112\261\155\216\307
-\220\105\336\057\147\254\105\004\243\172\334\125\222\311\107\146
-\330\032\214\307\355\234\116\232\340\022\273\265\152\114\204\341
-\341\042\015\207\000\144\376\214\175\142\071\145\246\357\102\266
-\200\045\022\141\001\250\044\023\160\000\021\046\137\372\065\120
-\305\110\314\006\107\350\047\330\160\215\137\144\346\241\104\046
-\136\042\354\222\315\377\102\232\104\041\155\134\305\343\042\035
-\137\107\022\347\316\137\135\372\330\252\261\063\055\331\166\362
-\116\072\063\014\053\263\055\220\006
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "AddTrust Public Services Root"
-# Issuer: CN=AddTrust Public CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
-# Serial Number: 1 (0x1)
-# Subject: CN=AddTrust Public CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
-# Not Valid Before: Tue May 30 10:41:50 2000
-# Not Valid After : Sat May 30 10:41:50 2020
-# Fingerprint (MD5): C1:62:3E:23:C5:82:73:9C:03:59:4B:2B:E9:77:49:7F
-# Fingerprint (SHA1): 2A:B6:28:48:5E:78:FB:F3:AD:9E:79:10:DD:6B:DF:99:72:2C:96:E5
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "AddTrust Public Services Root"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\052\266\050\110\136\170\373\363\255\236\171\020\335\153\337\231
-\162\054\226\345
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\301\142\076\043\305\202\163\234\003\131\113\053\351\167\111\177
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\144\061\013\060\011\006\003\125\004\006\023\002\123\105\061
-\024\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165
-\163\164\040\101\102\061\035\060\033\006\003\125\004\013\023\024
-\101\144\144\124\162\165\163\164\040\124\124\120\040\116\145\164
-\167\157\162\153\061\040\060\036\006\003\125\004\003\023\027\101
-\144\144\124\162\165\163\164\040\120\165\142\154\151\143\040\103
-\101\040\122\157\157\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "AddTrust Qualified Certificates Root"
-#
-# Issuer: CN=AddTrust Qualified CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
-# Serial Number: 1 (0x1)
-# Subject: CN=AddTrust Qualified CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
-# Not Valid Before: Tue May 30 10:44:50 2000
-# Not Valid After : Sat May 30 10:44:50 2020
-# Fingerprint (MD5): 27:EC:39:47:CD:DA:5A:AF:E2:9A:01:65:21:A9:4C:BB
-# Fingerprint (SHA1): 4D:23:78:EC:91:95:39:B5:00:7F:75:8F:03:3B:21:1E:C5:4D:8B:CF
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "AddTrust Qualified Certificates Root"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\147\061\013\060\011\006\003\125\004\006\023\002\123\105\061
-\024\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165
-\163\164\040\101\102\061\035\060\033\006\003\125\004\013\023\024
-\101\144\144\124\162\165\163\164\040\124\124\120\040\116\145\164
-\167\157\162\153\061\043\060\041\006\003\125\004\003\023\032\101
-\144\144\124\162\165\163\164\040\121\165\141\154\151\146\151\145
-\144\040\103\101\040\122\157\157\164
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\147\061\013\060\011\006\003\125\004\006\023\002\123\105\061
-\024\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165
-\163\164\040\101\102\061\035\060\033\006\003\125\004\013\023\024
-\101\144\144\124\162\165\163\164\040\124\124\120\040\116\145\164
-\167\157\162\153\061\043\060\041\006\003\125\004\003\023\032\101
-\144\144\124\162\165\163\164\040\121\165\141\154\151\146\151\145
-\144\040\103\101\040\122\157\157\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\036\060\202\003\006\240\003\002\001\002\002\001\001
-\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060
-\147\061\013\060\011\006\003\125\004\006\023\002\123\105\061\024
-\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165\163
-\164\040\101\102\061\035\060\033\006\003\125\004\013\023\024\101
-\144\144\124\162\165\163\164\040\124\124\120\040\116\145\164\167
-\157\162\153\061\043\060\041\006\003\125\004\003\023\032\101\144
-\144\124\162\165\163\164\040\121\165\141\154\151\146\151\145\144
-\040\103\101\040\122\157\157\164\060\036\027\015\060\060\060\065
-\063\060\061\060\064\064\065\060\132\027\015\062\060\060\065\063
-\060\061\060\064\064\065\060\132\060\147\061\013\060\011\006\003
-\125\004\006\023\002\123\105\061\024\060\022\006\003\125\004\012
-\023\013\101\144\144\124\162\165\163\164\040\101\102\061\035\060
-\033\006\003\125\004\013\023\024\101\144\144\124\162\165\163\164
-\040\124\124\120\040\116\145\164\167\157\162\153\061\043\060\041
-\006\003\125\004\003\023\032\101\144\144\124\162\165\163\164\040
-\121\165\141\154\151\146\151\145\144\040\103\101\040\122\157\157
-\164\060\202\001\042\060\015\006\011\052\206\110\206\367\015\001
-\001\001\005\000\003\202\001\017\000\060\202\001\012\002\202\001
-\001\000\344\036\232\376\334\011\132\207\244\237\107\276\021\137
-\257\204\064\333\142\074\171\170\267\351\060\265\354\014\034\052
-\304\026\377\340\354\161\353\212\365\021\156\355\117\015\221\322
-\022\030\055\111\025\001\302\244\042\023\307\021\144\377\042\022
-\232\271\216\134\057\010\317\161\152\263\147\001\131\361\135\106
-\363\260\170\245\366\016\102\172\343\177\033\314\320\360\267\050
-\375\052\352\236\263\260\271\004\252\375\366\307\264\261\270\052
-\240\373\130\361\031\240\157\160\045\176\076\151\112\177\017\042
-\330\357\255\010\021\232\051\231\341\252\104\105\232\022\136\076
-\235\155\122\374\347\240\075\150\057\360\113\160\174\023\070\255
-\274\025\045\361\326\316\253\242\300\061\326\057\237\340\377\024
-\131\374\204\223\331\207\174\114\124\023\353\237\321\055\021\370
-\030\072\072\336\045\331\367\323\100\355\244\006\022\304\073\341
-\221\301\126\065\360\024\334\145\066\011\156\253\244\007\307\065
-\321\302\003\063\066\133\165\046\155\102\361\022\153\103\157\113
-\161\224\372\064\035\355\023\156\312\200\177\230\057\154\271\145
-\330\351\002\003\001\000\001\243\201\324\060\201\321\060\035\006
-\003\125\035\016\004\026\004\024\071\225\213\142\213\134\311\324
-\200\272\130\017\227\077\025\010\103\314\230\247\060\013\006\003
-\125\035\017\004\004\003\002\001\006\060\017\006\003\125\035\023
-\001\001\377\004\005\060\003\001\001\377\060\201\221\006\003\125
-\035\043\004\201\211\060\201\206\200\024\071\225\213\142\213\134
-\311\324\200\272\130\017\227\077\025\010\103\314\230\247\241\153
-\244\151\060\147\061\013\060\011\006\003\125\004\006\023\002\123
-\105\061\024\060\022\006\003\125\004\012\023\013\101\144\144\124
-\162\165\163\164\040\101\102\061\035\060\033\006\003\125\004\013
-\023\024\101\144\144\124\162\165\163\164\040\124\124\120\040\116
-\145\164\167\157\162\153\061\043\060\041\006\003\125\004\003\023
-\032\101\144\144\124\162\165\163\164\040\121\165\141\154\151\146
-\151\145\144\040\103\101\040\122\157\157\164\202\001\001\060\015
-\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202\001
-\001\000\031\253\165\352\370\213\145\141\225\023\272\151\004\357
-\206\312\023\240\307\252\117\144\033\077\030\366\250\055\054\125
-\217\005\267\060\352\102\152\035\300\045\121\055\247\277\014\263
-\355\357\010\177\154\074\106\032\352\030\103\337\166\314\371\146
-\206\234\054\150\365\351\027\370\061\263\030\304\326\110\175\043
-\114\150\301\176\273\001\024\157\305\331\156\336\273\004\102\152
-\370\366\134\175\345\332\372\207\353\015\065\122\147\320\236\227
-\166\005\223\077\225\307\001\346\151\125\070\177\020\141\231\311
-\343\137\246\312\076\202\143\110\252\342\010\110\076\252\362\262
-\205\142\246\264\247\331\275\067\234\150\265\055\126\175\260\267
-\077\240\261\007\326\351\117\334\336\105\161\060\062\177\033\056
-\011\371\277\122\241\356\302\200\076\006\134\056\125\100\301\033
-\365\160\105\260\334\135\372\366\162\132\167\322\143\315\317\130
-\211\000\102\143\077\171\071\320\104\260\202\156\101\031\350\335
-\340\301\210\132\321\036\161\223\037\044\060\164\345\036\250\336
-\074\047\067\177\203\256\236\167\317\360\060\261\377\113\231\350
-\306\241
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "AddTrust Qualified Certificates Root"
-# Issuer: CN=AddTrust Qualified CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
-# Serial Number: 1 (0x1)
-# Subject: CN=AddTrust Qualified CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
-# Not Valid Before: Tue May 30 10:44:50 2000
-# Not Valid After : Sat May 30 10:44:50 2020
-# Fingerprint (MD5): 27:EC:39:47:CD:DA:5A:AF:E2:9A:01:65:21:A9:4C:BB
-# Fingerprint (SHA1): 4D:23:78:EC:91:95:39:B5:00:7F:75:8F:03:3B:21:1E:C5:4D:8B:CF
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "AddTrust Qualified Certificates Root"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\115\043\170\354\221\225\071\265\000\177\165\217\003\073\041\036
-\305\115\213\317
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\047\354\071\107\315\332\132\257\342\232\001\145\041\251\114\273
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\147\061\013\060\011\006\003\125\004\006\023\002\123\105\061
-\024\060\022\006\003\125\004\012\023\013\101\144\144\124\162\165
-\163\164\040\101\102\061\035\060\033\006\003\125\004\013\023\024
-\101\144\144\124\162\165\163\164\040\124\124\120\040\116\145\164
-\167\157\162\153\061\043\060\041\006\003\125\004\003\023\032\101
-\144\144\124\162\165\163\164\040\121\165\141\154\151\146\151\145
-\144\040\103\101\040\122\157\157\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -2140,135 +1849,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "GeoTrust Global CA 2"
-#
-# Issuer: CN=GeoTrust Global CA 2,O=GeoTrust Inc.,C=US
-# Serial Number: 1 (0x1)
-# Subject: CN=GeoTrust Global CA 2,O=GeoTrust Inc.,C=US
-# Not Valid Before: Thu Mar 04 05:00:00 2004
-# Not Valid After : Mon Mar 04 05:00:00 2019
-# Fingerprint (MD5): 0E:40:A7:6C:DE:03:5D:8F:D1:0F:E4:D1:8D:F9:6C:A9
-# Fingerprint (SHA1): A9:E9:78:08:14:37:58:88:F2:05:19:B0:6D:2B:0D:2B:60:16:90:7D
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "GeoTrust Global CA 2"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\104\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\026\060\024\006\003\125\004\012\023\015\107\145\157\124\162\165
-\163\164\040\111\156\143\056\061\035\060\033\006\003\125\004\003
-\023\024\107\145\157\124\162\165\163\164\040\107\154\157\142\141
-\154\040\103\101\040\062
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\104\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\026\060\024\006\003\125\004\012\023\015\107\145\157\124\162\165
-\163\164\040\111\156\143\056\061\035\060\033\006\003\125\004\003
-\023\024\107\145\157\124\162\165\163\164\040\107\154\157\142\141
-\154\040\103\101\040\062
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\146\060\202\002\116\240\003\002\001\002\002\001\001
-\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060
-\104\061\013\060\011\006\003\125\004\006\023\002\125\123\061\026
-\060\024\006\003\125\004\012\023\015\107\145\157\124\162\165\163
-\164\040\111\156\143\056\061\035\060\033\006\003\125\004\003\023
-\024\107\145\157\124\162\165\163\164\040\107\154\157\142\141\154
-\040\103\101\040\062\060\036\027\015\060\064\060\063\060\064\060
-\065\060\060\060\060\132\027\015\061\071\060\063\060\064\060\065
-\060\060\060\060\132\060\104\061\013\060\011\006\003\125\004\006
-\023\002\125\123\061\026\060\024\006\003\125\004\012\023\015\107
-\145\157\124\162\165\163\164\040\111\156\143\056\061\035\060\033
-\006\003\125\004\003\023\024\107\145\157\124\162\165\163\164\040
-\107\154\157\142\141\154\040\103\101\040\062\060\202\001\042\060
-\015\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202
-\001\017\000\060\202\001\012\002\202\001\001\000\357\074\115\100
-\075\020\337\073\123\000\341\147\376\224\140\025\076\205\210\361
-\211\015\220\310\050\043\231\005\350\053\040\235\306\363\140\106
-\330\301\262\325\214\061\331\334\040\171\044\201\277\065\062\374
-\143\151\333\261\052\153\356\041\130\362\010\351\170\313\157\313
-\374\026\122\310\221\304\377\075\163\336\261\076\247\302\175\146
-\301\365\176\122\044\032\342\325\147\221\320\202\020\327\170\113
-\117\053\102\071\275\144\055\100\240\260\020\323\070\110\106\210
-\241\014\273\072\063\052\142\230\373\000\235\023\131\177\157\073
-\162\252\356\246\017\206\371\005\141\352\147\177\014\067\226\213
-\346\151\026\107\021\302\047\131\003\263\246\140\302\041\100\126
-\372\240\307\175\072\023\343\354\127\307\263\326\256\235\211\200
-\367\001\347\054\366\226\053\023\015\171\054\331\300\344\206\173
-\113\214\014\162\202\212\373\027\315\000\154\072\023\074\260\204
-\207\113\026\172\051\262\117\333\035\324\013\363\146\067\275\330
-\366\127\273\136\044\172\270\074\213\271\372\222\032\032\204\236
-\330\164\217\252\033\177\136\364\376\105\042\041\002\003\001\000
-\001\243\143\060\141\060\017\006\003\125\035\023\001\001\377\004
-\005\060\003\001\001\377\060\035\006\003\125\035\016\004\026\004
-\024\161\070\066\362\002\061\123\107\053\156\272\145\106\251\020
-\025\130\040\005\011\060\037\006\003\125\035\043\004\030\060\026
-\200\024\161\070\066\362\002\061\123\107\053\156\272\145\106\251
-\020\025\130\040\005\011\060\016\006\003\125\035\017\001\001\377
-\004\004\003\002\001\206\060\015\006\011\052\206\110\206\367\015
-\001\001\005\005\000\003\202\001\001\000\003\367\265\053\253\135
-\020\374\173\262\262\136\254\233\016\176\123\170\131\076\102\004
-\376\165\243\255\254\201\116\327\002\213\136\304\055\310\122\166
-\307\054\037\374\201\062\230\321\113\306\222\223\063\065\061\057
-\374\330\035\104\335\340\201\177\235\351\213\341\144\221\142\013
-\071\010\214\254\164\235\131\331\172\131\122\227\021\271\026\173
-\157\105\323\226\331\061\175\002\066\017\234\073\156\317\054\015
-\003\106\105\353\240\364\177\110\104\306\010\100\314\336\033\160
-\265\051\255\272\213\073\064\145\165\033\161\041\035\054\024\012
-\260\226\225\270\326\352\362\145\373\051\272\117\352\221\223\164
-\151\266\362\377\341\032\320\014\321\166\205\313\212\045\275\227
-\136\054\157\025\231\046\347\266\051\377\042\354\311\002\307\126
-\000\315\111\271\263\154\173\123\004\032\342\250\311\252\022\005
-\043\302\316\347\273\004\002\314\300\107\242\344\304\051\057\133
-\105\127\211\121\356\074\353\122\010\377\007\065\036\237\065\152
-\107\112\126\230\321\132\205\037\214\365\042\277\253\316\203\363
-\342\042\051\256\175\203\100\250\272\154
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "GeoTrust Global CA 2"
-# Issuer: CN=GeoTrust Global CA 2,O=GeoTrust Inc.,C=US
-# Serial Number: 1 (0x1)
-# Subject: CN=GeoTrust Global CA 2,O=GeoTrust Inc.,C=US
-# Not Valid Before: Thu Mar 04 05:00:00 2004
-# Not Valid After : Mon Mar 04 05:00:00 2019
-# Fingerprint (MD5): 0E:40:A7:6C:DE:03:5D:8F:D1:0F:E4:D1:8D:F9:6C:A9
-# Fingerprint (SHA1): A9:E9:78:08:14:37:58:88:F2:05:19:B0:6D:2B:0D:2B:60:16:90:7D
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "GeoTrust Global CA 2"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\251\351\170\010\024\067\130\210\362\005\031\260\155\053\015\053
-\140\026\220\175
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\016\100\247\154\336\003\135\217\321\017\344\321\215\371\154\251
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\104\061\013\060\011\006\003\125\004\006\023\002\125\123\061
-\026\060\024\006\003\125\004\012\023\015\107\145\157\124\162\165
-\163\164\040\111\156\143\056\061\035\060\033\006\003\125\004\003
-\023\024\107\145\157\124\162\165\163\164\040\107\154\157\142\141
-\154\040\103\101\040\062
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -2428,7 +2009,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -2588,7 +2169,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -2728,7 +2309,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -2847,7 +2428,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -2997,355 +2578,50 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
-# Certificate "Comodo Secure Services root"
+# Certificate "QuoVadis Root CA"
 #
-# Issuer: CN=Secure Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
-# Serial Number: 1 (0x1)
-# Subject: CN=Secure Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
-# Not Valid Before: Thu Jan 01 00:00:00 2004
-# Not Valid After : Sun Dec 31 23:59:59 2028
-# Fingerprint (MD5): D3:D9:BD:AE:9F:AC:67:24:B3:C8:1B:52:E1:B9:A9:BD
-# Fingerprint (SHA1): 4A:65:D5:F4:1D:EF:39:B8:B8:90:4A:4A:D3:64:81:33:CF:C7:A1:D1
+# Issuer: CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM
+# Serial Number: 985026699 (0x3ab6508b)
+# Subject: CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM
+# Not Valid Before: Mon Mar 19 18:33:33 2001
+# Not Valid After : Wed Mar 17 18:33:33 2021
+# Fingerprint (MD5): 27:DE:36:FE:72:B7:00:03:00:9D:F4:F0:1E:6C:04:24
+# Fingerprint (SHA1): DE:3F:40:BD:50:93:D3:9B:6C:60:F6:DA:BC:07:62:01:00:89:76:C9
 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
 CKA_TOKEN CK_BBOOL CK_TRUE
 CKA_PRIVATE CK_BBOOL CK_FALSE
 CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Comodo Secure Services root"
+CKA_LABEL UTF8 "QuoVadis Root CA"
 CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
 CKA_SUBJECT MULTILINE_OCTAL
-\060\176\061\013\060\011\006\003\125\004\006\023\002\107\102\061
-\033\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145
-\162\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016
-\006\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032
-\060\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040
-\103\101\040\114\151\155\151\164\145\144\061\044\060\042\006\003
-\125\004\003\014\033\123\145\143\165\162\145\040\103\145\162\164
-\151\146\151\143\141\164\145\040\123\145\162\166\151\143\145\163
+\060\177\061\013\060\011\006\003\125\004\006\023\002\102\115\061
+\031\060\027\006\003\125\004\012\023\020\121\165\157\126\141\144
+\151\163\040\114\151\155\151\164\145\144\061\045\060\043\006\003
+\125\004\013\023\034\122\157\157\164\040\103\145\162\164\151\146
+\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
+\171\061\056\060\054\006\003\125\004\003\023\045\121\165\157\126
+\141\144\151\163\040\122\157\157\164\040\103\145\162\164\151\146
+\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
+\171
 END
 CKA_ID UTF8 "0"
 CKA_ISSUER MULTILINE_OCTAL
-\060\176\061\013\060\011\006\003\125\004\006\023\002\107\102\061
-\033\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145
-\162\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016
-\006\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032
-\060\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040
-\103\101\040\114\151\155\151\164\145\144\061\044\060\042\006\003
-\125\004\003\014\033\123\145\143\165\162\145\040\103\145\162\164
-\151\146\151\143\141\164\145\040\123\145\162\166\151\143\145\163
+\060\177\061\013\060\011\006\003\125\004\006\023\002\102\115\061
+\031\060\027\006\003\125\004\012\023\020\121\165\157\126\141\144
+\151\163\040\114\151\155\151\164\145\144\061\045\060\043\006\003
+\125\004\013\023\034\122\157\157\164\040\103\145\162\164\151\146
+\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
+\171\061\056\060\054\006\003\125\004\003\023\045\121\165\157\126
+\141\144\151\163\040\122\157\157\164\040\103\145\162\164\151\146
+\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
+\171
 END
 CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\077\060\202\003\047\240\003\002\001\002\002\001\001
-\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060
-\176\061\013\060\011\006\003\125\004\006\023\002\107\102\061\033
-\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145\162
-\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016\006
-\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032\060
-\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040\103
-\101\040\114\151\155\151\164\145\144\061\044\060\042\006\003\125
-\004\003\014\033\123\145\143\165\162\145\040\103\145\162\164\151
-\146\151\143\141\164\145\040\123\145\162\166\151\143\145\163\060
-\036\027\015\060\064\060\061\060\061\060\060\060\060\060\060\132
-\027\015\062\070\061\062\063\061\062\063\065\071\065\071\132\060
-\176\061\013\060\011\006\003\125\004\006\023\002\107\102\061\033
-\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145\162
-\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016\006
-\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032\060
-\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040\103
-\101\040\114\151\155\151\164\145\144\061\044\060\042\006\003\125
-\004\003\014\033\123\145\143\165\162\145\040\103\145\162\164\151
-\146\151\143\141\164\145\040\123\145\162\166\151\143\145\163\060
-\202\001\042\060\015\006\011\052\206\110\206\367\015\001\001\001
-\005\000\003\202\001\017\000\060\202\001\012\002\202\001\001\000
-\300\161\063\202\212\320\160\353\163\207\202\100\325\035\344\313
-\311\016\102\220\371\336\064\271\241\272\021\364\045\205\363\314
-\162\155\362\173\227\153\263\007\361\167\044\221\137\045\217\366
-\164\075\344\200\302\370\074\015\363\277\100\352\367\310\122\321
-\162\157\357\310\253\101\270\156\056\027\052\225\151\014\315\322
-\036\224\173\055\224\035\252\165\327\263\230\313\254\274\144\123
-\100\274\217\254\254\066\313\134\255\273\335\340\224\027\354\321
-\134\320\277\357\245\225\311\220\305\260\254\373\033\103\337\172
-\010\135\267\270\362\100\033\053\047\236\120\316\136\145\202\210
-\214\136\323\116\014\172\352\010\221\266\066\252\053\102\373\352
-\302\243\071\345\333\046\070\255\213\012\356\031\143\307\034\044
-\337\003\170\332\346\352\301\107\032\013\013\106\011\335\002\374
-\336\313\207\137\327\060\143\150\241\256\334\062\241\272\276\376
-\104\253\150\266\245\027\025\375\275\325\247\247\232\344\104\063
-\351\210\216\374\355\121\353\223\161\116\255\001\347\104\216\253
-\055\313\250\376\001\111\110\360\300\335\307\150\330\222\376\075
-\002\003\001\000\001\243\201\307\060\201\304\060\035\006\003\125
-\035\016\004\026\004\024\074\330\223\210\302\300\202\011\314\001
-\231\006\223\040\351\236\160\011\143\117\060\016\006\003\125\035
-\017\001\001\377\004\004\003\002\001\006\060\017\006\003\125\035
-\023\001\001\377\004\005\060\003\001\001\377\060\201\201\006\003
-\125\035\037\004\172\060\170\060\073\240\071\240\067\206\065\150
-\164\164\160\072\057\057\143\162\154\056\143\157\155\157\144\157
-\143\141\056\143\157\155\057\123\145\143\165\162\145\103\145\162
-\164\151\146\151\143\141\164\145\123\145\162\166\151\143\145\163
-\056\143\162\154\060\071\240\067\240\065\206\063\150\164\164\160
-\072\057\057\143\162\154\056\143\157\155\157\144\157\056\156\145
-\164\057\123\145\143\165\162\145\103\145\162\164\151\146\151\143
-\141\164\145\123\145\162\166\151\143\145\163\056\143\162\154\060
-\015\006\011\052\206\110\206\367\015\001\001\005\005\000\003\202
-\001\001\000\207\001\155\043\035\176\133\027\175\301\141\062\317
-\217\347\363\212\224\131\146\340\236\050\250\136\323\267\364\064
-\346\252\071\262\227\026\305\202\157\062\244\351\214\347\257\375
-\357\302\350\271\113\252\243\364\346\332\215\145\041\373\272\200
-\353\046\050\205\032\376\071\214\336\133\004\004\264\124\371\243
-\147\236\101\372\011\122\314\005\110\250\311\077\041\004\036\316
-\110\153\374\205\350\302\173\257\177\267\314\370\137\072\375\065
-\306\015\357\227\334\114\253\021\341\153\313\061\321\154\373\110
-\200\253\334\234\067\270\041\024\113\015\161\075\354\203\063\156
-\321\156\062\026\354\230\307\026\213\131\246\064\253\005\127\055
-\223\367\252\023\313\322\023\342\267\056\073\315\153\120\027\011
-\150\076\265\046\127\356\266\340\266\335\271\051\200\171\175\217
-\243\360\244\050\244\025\304\205\364\047\324\153\277\345\134\344
-\145\002\166\124\264\343\067\146\044\323\031\141\310\122\020\345
-\213\067\232\271\251\371\035\277\352\231\222\141\226\377\001\315
-\241\137\015\274\161\274\016\254\013\035\107\105\035\301\354\174
-\354\375\051
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "Comodo Secure Services root"
-# Issuer: CN=Secure Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
-# Serial Number: 1 (0x1)
-# Subject: CN=Secure Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
-# Not Valid Before: Thu Jan 01 00:00:00 2004
-# Not Valid After : Sun Dec 31 23:59:59 2028
-# Fingerprint (MD5): D3:D9:BD:AE:9F:AC:67:24:B3:C8:1B:52:E1:B9:A9:BD
-# Fingerprint (SHA1): 4A:65:D5:F4:1D:EF:39:B8:B8:90:4A:4A:D3:64:81:33:CF:C7:A1:D1
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Comodo Secure Services root"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\112\145\325\364\035\357\071\270\270\220\112\112\323\144\201\063
-\317\307\241\321
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\323\331\275\256\237\254\147\044\263\310\033\122\341\271\251\275
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\176\061\013\060\011\006\003\125\004\006\023\002\107\102\061
-\033\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145
-\162\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016
-\006\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032
-\060\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040
-\103\101\040\114\151\155\151\164\145\144\061\044\060\042\006\003
-\125\004\003\014\033\123\145\143\165\162\145\040\103\145\162\164
-\151\146\151\143\141\164\145\040\123\145\162\166\151\143\145\163
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "Comodo Trusted Services root"
-#
-# Issuer: CN=Trusted Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
-# Serial Number: 1 (0x1)
-# Subject: CN=Trusted Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
-# Not Valid Before: Thu Jan 01 00:00:00 2004
-# Not Valid After : Sun Dec 31 23:59:59 2028
-# Fingerprint (MD5): 91:1B:3F:6E:CD:9E:AB:EE:07:FE:1F:71:D2:B3:61:27
-# Fingerprint (SHA1): E1:9F:E3:0E:8B:84:60:9E:80:9B:17:0D:72:A8:C5:BA:6E:14:09:BD
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Comodo Trusted Services root"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\177\061\013\060\011\006\003\125\004\006\023\002\107\102\061
-\033\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145
-\162\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016
-\006\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032
-\060\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040
-\103\101\040\114\151\155\151\164\145\144\061\045\060\043\006\003
-\125\004\003\014\034\124\162\165\163\164\145\144\040\103\145\162
-\164\151\146\151\143\141\164\145\040\123\145\162\166\151\143\145
-\163
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\177\061\013\060\011\006\003\125\004\006\023\002\107\102\061
-\033\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145
-\162\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016
-\006\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032
-\060\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040
-\103\101\040\114\151\155\151\164\145\144\061\045\060\043\006\003
-\125\004\003\014\034\124\162\165\163\164\145\144\040\103\145\162
-\164\151\146\151\143\141\164\145\040\123\145\162\166\151\143\145
-\163
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\103\060\202\003\053\240\003\002\001\002\002\001\001
-\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060
-\177\061\013\060\011\006\003\125\004\006\023\002\107\102\061\033
-\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145\162
-\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016\006
-\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032\060
-\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040\103
-\101\040\114\151\155\151\164\145\144\061\045\060\043\006\003\125
-\004\003\014\034\124\162\165\163\164\145\144\040\103\145\162\164
-\151\146\151\143\141\164\145\040\123\145\162\166\151\143\145\163
-\060\036\027\015\060\064\060\061\060\061\060\060\060\060\060\060
-\132\027\015\062\070\061\062\063\061\062\063\065\071\065\071\132
-\060\177\061\013\060\011\006\003\125\004\006\023\002\107\102\061
-\033\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145
-\162\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016
-\006\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032
-\060\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040
-\103\101\040\114\151\155\151\164\145\144\061\045\060\043\006\003
-\125\004\003\014\034\124\162\165\163\164\145\144\040\103\145\162
-\164\151\146\151\143\141\164\145\040\123\145\162\166\151\143\145
-\163\060\202\001\042\060\015\006\011\052\206\110\206\367\015\001
-\001\001\005\000\003\202\001\017\000\060\202\001\012\002\202\001
-\001\000\337\161\157\066\130\123\132\362\066\124\127\200\304\164
-\010\040\355\030\177\052\035\346\065\232\036\045\254\234\345\226
-\176\162\122\240\025\102\333\131\335\144\172\032\320\270\173\335
-\071\025\274\125\110\304\355\072\000\352\061\021\272\362\161\164
-\032\147\270\317\063\314\250\061\257\243\343\327\177\277\063\055
-\114\152\074\354\213\303\222\322\123\167\044\164\234\007\156\160
-\374\275\013\133\166\272\137\362\377\327\067\113\112\140\170\367
-\360\372\312\160\264\352\131\252\243\316\110\057\251\303\262\013
-\176\027\162\026\014\246\007\014\033\070\317\311\142\267\077\240
-\223\245\207\101\362\267\160\100\167\330\276\024\174\343\250\300
-\172\216\351\143\152\321\017\232\306\322\364\213\072\024\004\126
-\324\355\270\314\156\365\373\342\054\130\275\177\117\153\053\367
-\140\044\130\044\316\046\357\064\221\072\325\343\201\320\262\360
-\004\002\327\133\267\076\222\254\153\022\212\371\344\005\260\073
-\221\111\134\262\353\123\352\370\237\107\206\356\277\225\300\300
-\006\237\322\133\136\021\033\364\307\004\065\051\322\125\134\344
-\355\353\002\003\001\000\001\243\201\311\060\201\306\060\035\006
-\003\125\035\016\004\026\004\024\305\173\130\275\355\332\045\151
-\322\367\131\026\250\263\062\300\173\047\133\364\060\016\006\003
-\125\035\017\001\001\377\004\004\003\002\001\006\060\017\006\003
-\125\035\023\001\001\377\004\005\060\003\001\001\377\060\201\203
-\006\003\125\035\037\004\174\060\172\060\074\240\072\240\070\206
-\066\150\164\164\160\072\057\057\143\162\154\056\143\157\155\157
-\144\157\143\141\056\143\157\155\057\124\162\165\163\164\145\144
-\103\145\162\164\151\146\151\143\141\164\145\123\145\162\166\151
-\143\145\163\056\143\162\154\060\072\240\070\240\066\206\064\150
-\164\164\160\072\057\057\143\162\154\056\143\157\155\157\144\157
-\056\156\145\164\057\124\162\165\163\164\145\144\103\145\162\164
-\151\146\151\143\141\164\145\123\145\162\166\151\143\145\163\056
-\143\162\154\060\015\006\011\052\206\110\206\367\015\001\001\005
-\005\000\003\202\001\001\000\310\223\201\073\211\264\257\270\204
-\022\114\215\322\360\333\160\272\127\206\025\064\020\271\057\177
-\036\260\250\211\140\241\212\302\167\014\120\112\233\000\213\330
-\213\364\101\342\320\203\212\112\034\024\006\260\243\150\005\160
-\061\060\247\123\233\016\351\112\240\130\151\147\016\256\235\366
-\245\054\101\277\074\006\153\344\131\314\155\020\361\226\157\037
-\337\364\004\002\244\237\105\076\310\330\372\066\106\104\120\077
-\202\227\221\037\050\333\030\021\214\052\344\145\203\127\022\022
-\214\027\077\224\066\376\135\260\300\004\167\023\270\364\025\325
-\077\070\314\224\072\125\320\254\230\365\272\000\137\340\206\031
-\201\170\057\050\300\176\323\314\102\012\365\256\120\240\321\076
-\306\241\161\354\077\240\040\214\146\072\211\264\216\324\330\261
-\115\045\107\356\057\210\310\265\341\005\105\300\276\024\161\336
-\172\375\216\173\175\115\010\226\245\022\163\360\055\312\067\047
-\164\022\047\114\313\266\227\351\331\256\010\155\132\071\100\335
-\005\107\165\152\132\041\263\243\030\317\116\367\056\127\267\230
-\160\136\310\304\170\260\142
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "Comodo Trusted Services root"
-# Issuer: CN=Trusted Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
-# Serial Number: 1 (0x1)
-# Subject: CN=Trusted Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
-# Not Valid Before: Thu Jan 01 00:00:00 2004
-# Not Valid After : Sun Dec 31 23:59:59 2028
-# Fingerprint (MD5): 91:1B:3F:6E:CD:9E:AB:EE:07:FE:1F:71:D2:B3:61:27
-# Fingerprint (SHA1): E1:9F:E3:0E:8B:84:60:9E:80:9B:17:0D:72:A8:C5:BA:6E:14:09:BD
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Comodo Trusted Services root"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\341\237\343\016\213\204\140\236\200\233\027\015\162\250\305\272
-\156\024\011\275
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\221\033\077\156\315\236\253\356\007\376\037\161\322\263\141\047
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\177\061\013\060\011\006\003\125\004\006\023\002\107\102\061
-\033\060\031\006\003\125\004\010\014\022\107\162\145\141\164\145
-\162\040\115\141\156\143\150\145\163\164\145\162\061\020\060\016
-\006\003\125\004\007\014\007\123\141\154\146\157\162\144\061\032
-\060\030\006\003\125\004\012\014\021\103\157\155\157\144\157\040
-\103\101\040\114\151\155\151\164\145\144\061\045\060\043\006\003
-\125\004\003\014\034\124\162\165\163\164\145\144\040\103\145\162
-\164\151\146\151\143\141\164\145\040\123\145\162\166\151\143\145
-\163
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\001\001
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "QuoVadis Root CA"
-#
-# Issuer: CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM
-# Serial Number: 985026699 (0x3ab6508b)
-# Subject: CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM
-# Not Valid Before: Mon Mar 19 18:33:33 2001
-# Not Valid After : Wed Mar 17 18:33:33 2021
-# Fingerprint (MD5): 27:DE:36:FE:72:B7:00:03:00:9D:F4:F0:1E:6C:04:24
-# Fingerprint (SHA1): DE:3F:40:BD:50:93:D3:9B:6C:60:F6:DA:BC:07:62:01:00:89:76:C9
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "QuoVadis Root CA"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\177\061\013\060\011\006\003\125\004\006\023\002\102\115\061
-\031\060\027\006\003\125\004\012\023\020\121\165\157\126\141\144
-\151\163\040\114\151\155\151\164\145\144\061\045\060\043\006\003
-\125\004\013\023\034\122\157\157\164\040\103\145\162\164\151\146
-\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
-\171\061\056\060\054\006\003\125\004\003\023\045\121\165\157\126
-\141\144\151\163\040\122\157\157\164\040\103\145\162\164\151\146
-\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
-\171
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\177\061\013\060\011\006\003\125\004\006\023\002\102\115\061
-\031\060\027\006\003\125\004\012\023\020\121\165\157\126\141\144
-\151\163\040\114\151\155\151\164\145\144\061\045\060\043\006\003
-\125\004\013\023\034\122\157\157\164\040\103\145\162\164\151\146
-\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
-\171\061\056\060\054\006\003\125\004\003\023\045\121\165\157\126
-\141\144\151\163\040\122\157\157\164\040\103\145\162\164\151\146
-\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
-\171
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\004\072\266\120\213
+\002\004\072\266\120\213
 END
 CKA_VALUE MULTILINE_OCTAL
 \060\202\005\320\060\202\004\270\240\003\002\001\002\002\004\072
@@ -3481,7 +2757,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -3646,7 +2922,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -3826,7 +3102,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -3956,7 +3232,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -4251,329 +3527,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "UTN USERFirst Hardware Root CA"
-#
-# Issuer: CN=UTN-USERFirst-Hardware,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Serial Number:44:be:0c:8b:50:00:24:b4:11:d3:36:2a:fe:65:0a:fd
-# Subject: CN=UTN-USERFirst-Hardware,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Fri Jul 09 18:10:42 1999
-# Not Valid After : Tue Jul 09 18:19:22 2019
-# Fingerprint (MD5): 4C:56:41:E5:0D:BB:2B:E8:CA:A3:ED:18:08:AD:43:39
-# Fingerprint (SHA1): 04:83:ED:33:99:AC:36:08:05:87:22:ED:BC:5E:46:00:E3:BE:F9:D7
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "UTN USERFirst Hardware Root CA"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\201\227\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\037\060\035\006\003\125
-\004\003\023\026\125\124\116\055\125\123\105\122\106\151\162\163
-\164\055\110\141\162\144\167\141\162\145
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\227\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\037\060\035\006\003\125
-\004\003\023\026\125\124\116\055\125\123\105\122\106\151\162\163
-\164\055\110\141\162\144\167\141\162\145
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\104\276\014\213\120\000\044\264\021\323\066\052\376\145
-\012\375
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\164\060\202\003\134\240\003\002\001\002\002\020\104
-\276\014\213\120\000\044\264\021\323\066\052\376\145\012\375\060
-\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060\201
-\227\061\013\060\011\006\003\125\004\006\023\002\125\123\061\013
-\060\011\006\003\125\004\010\023\002\125\124\061\027\060\025\006
-\003\125\004\007\023\016\123\141\154\164\040\114\141\153\145\040
-\103\151\164\171\061\036\060\034\006\003\125\004\012\023\025\124
-\150\145\040\125\123\105\122\124\122\125\123\124\040\116\145\164
-\167\157\162\153\061\041\060\037\006\003\125\004\013\023\030\150
-\164\164\160\072\057\057\167\167\167\056\165\163\145\162\164\162
-\165\163\164\056\143\157\155\061\037\060\035\006\003\125\004\003
-\023\026\125\124\116\055\125\123\105\122\106\151\162\163\164\055
-\110\141\162\144\167\141\162\145\060\036\027\015\071\071\060\067
-\060\071\061\070\061\060\064\062\132\027\015\061\071\060\067\060
-\071\061\070\061\071\062\062\132\060\201\227\061\013\060\011\006
-\003\125\004\006\023\002\125\123\061\013\060\011\006\003\125\004
-\010\023\002\125\124\061\027\060\025\006\003\125\004\007\023\016
-\123\141\154\164\040\114\141\153\145\040\103\151\164\171\061\036
-\060\034\006\003\125\004\012\023\025\124\150\145\040\125\123\105
-\122\124\122\125\123\124\040\116\145\164\167\157\162\153\061\041
-\060\037\006\003\125\004\013\023\030\150\164\164\160\072\057\057
-\167\167\167\056\165\163\145\162\164\162\165\163\164\056\143\157
-\155\061\037\060\035\006\003\125\004\003\023\026\125\124\116\055
-\125\123\105\122\106\151\162\163\164\055\110\141\162\144\167\141
-\162\145\060\202\001\042\060\015\006\011\052\206\110\206\367\015
-\001\001\001\005\000\003\202\001\017\000\060\202\001\012\002\202
-\001\001\000\261\367\303\070\077\264\250\177\317\071\202\121\147
-\320\155\237\322\377\130\363\347\237\053\354\015\211\124\231\271
-\070\231\026\367\340\041\171\110\302\273\141\164\022\226\035\074
-\152\162\325\074\020\147\072\071\355\053\023\315\146\353\225\011
-\063\244\154\227\261\350\306\354\301\165\171\234\106\136\215\253
-\320\152\375\271\052\125\027\020\124\263\031\360\232\366\361\261
-\135\266\247\155\373\340\161\027\153\242\210\373\000\337\376\032
-\061\167\014\232\001\172\261\062\343\053\001\007\070\156\303\245
-\136\043\274\105\233\173\120\301\311\060\217\333\345\053\172\323
-\133\373\063\100\036\240\325\230\027\274\213\207\303\211\323\135
-\240\216\262\252\252\366\216\151\210\006\305\372\211\041\363\010
-\235\151\056\011\063\233\051\015\106\017\214\314\111\064\260\151
-\121\275\371\006\315\150\255\146\114\274\076\254\141\275\012\210
-\016\310\337\075\356\174\004\114\235\012\136\153\221\326\356\307
-\355\050\215\253\115\207\211\163\320\156\244\320\036\026\213\024
-\341\166\104\003\177\143\254\344\315\111\234\305\222\364\253\062
-\241\110\133\002\003\001\000\001\243\201\271\060\201\266\060\013
-\006\003\125\035\017\004\004\003\002\001\306\060\017\006\003\125
-\035\023\001\001\377\004\005\060\003\001\001\377\060\035\006\003
-\125\035\016\004\026\004\024\241\162\137\046\033\050\230\103\225
-\135\007\067\325\205\226\235\113\322\303\105\060\104\006\003\125
-\035\037\004\075\060\073\060\071\240\067\240\065\206\063\150\164
-\164\160\072\057\057\143\162\154\056\165\163\145\162\164\162\165
-\163\164\056\143\157\155\057\125\124\116\055\125\123\105\122\106
-\151\162\163\164\055\110\141\162\144\167\141\162\145\056\143\162
-\154\060\061\006\003\125\035\045\004\052\060\050\006\010\053\006
-\001\005\005\007\003\001\006\010\053\006\001\005\005\007\003\005
-\006\010\053\006\001\005\005\007\003\006\006\010\053\006\001\005
-\005\007\003\007\060\015\006\011\052\206\110\206\367\015\001\001
-\005\005\000\003\202\001\001\000\107\031\017\336\164\306\231\227
-\257\374\255\050\136\165\216\353\055\147\356\116\173\053\327\014
-\377\366\336\313\125\242\012\341\114\124\145\223\140\153\237\022
-\234\255\136\203\054\353\132\256\300\344\055\364\000\143\035\270
-\300\154\362\317\111\273\115\223\157\006\246\012\042\262\111\142
-\010\116\377\310\310\024\262\210\026\135\347\001\344\022\225\345
-\105\064\263\213\151\275\317\264\205\217\165\121\236\175\072\070
-\072\024\110\022\306\373\247\073\032\215\015\202\100\007\350\004
-\010\220\241\211\313\031\120\337\312\034\001\274\035\004\031\173
-\020\166\227\073\356\220\220\312\304\016\037\026\156\165\357\063
-\370\323\157\133\036\226\343\340\164\167\164\173\212\242\156\055
-\335\166\326\071\060\202\360\253\234\122\362\052\307\257\111\136
-\176\307\150\345\202\201\310\152\047\371\047\210\052\325\130\120
-\225\037\360\073\034\127\273\175\024\071\142\053\232\311\224\222
-\052\243\042\014\377\211\046\175\137\043\053\107\327\025\035\251
-\152\236\121\015\052\121\236\201\371\324\073\136\160\022\177\020
-\062\234\036\273\235\370\146\250
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "UTN USERFirst Hardware Root CA"
-# Issuer: CN=UTN-USERFirst-Hardware,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Serial Number:44:be:0c:8b:50:00:24:b4:11:d3:36:2a:fe:65:0a:fd
-# Subject: CN=UTN-USERFirst-Hardware,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Fri Jul 09 18:10:42 1999
-# Not Valid After : Tue Jul 09 18:19:22 2019
-# Fingerprint (MD5): 4C:56:41:E5:0D:BB:2B:E8:CA:A3:ED:18:08:AD:43:39
-# Fingerprint (SHA1): 04:83:ED:33:99:AC:36:08:05:87:22:ED:BC:5E:46:00:E3:BE:F9:D7
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "UTN USERFirst Hardware Root CA"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\004\203\355\063\231\254\066\010\005\207\042\355\274\136\106\000
-\343\276\371\327
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\114\126\101\345\015\273\053\350\312\243\355\030\010\255\103\071
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\227\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\037\060\035\006\003\125
-\004\003\023\026\125\124\116\055\125\123\105\122\106\151\162\163
-\164\055\110\141\162\144\167\141\162\145
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\104\276\014\213\120\000\044\264\021\323\066\052\376\145
-\012\375
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "UTN USERFirst Object Root CA"
-#
-# Issuer: CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Serial Number:44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
-# Subject: CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Fri Jul 09 18:31:20 1999
-# Not Valid After : Tue Jul 09 18:40:36 2019
-# Fingerprint (MD5): A7:F2:E4:16:06:41:11:50:30:6B:9C:E3:B4:9C:B0:C9
-# Fingerprint (SHA1): E1:2D:FB:4B:41:D7:D9:C3:2B:30:51:4B:AC:1D:81:D8:38:5E:2D:46
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "UTN USERFirst Object Root CA"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\201\225\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\035\060\033\006\003\125
-\004\003\023\024\125\124\116\055\125\123\105\122\106\151\162\163
-\164\055\117\142\152\145\143\164
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\225\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\035\060\033\006\003\125
-\004\003\023\024\125\124\116\055\125\123\105\122\106\151\162\163
-\164\055\117\142\152\145\143\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\104\276\014\213\120\000\044\264\021\323\066\055\340\263
-\137\033
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\004\146\060\202\003\116\240\003\002\001\002\002\020\104
-\276\014\213\120\000\044\264\021\323\066\055\340\263\137\033\060
-\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060\201
-\225\061\013\060\011\006\003\125\004\006\023\002\125\123\061\013
-\060\011\006\003\125\004\010\023\002\125\124\061\027\060\025\006
-\003\125\004\007\023\016\123\141\154\164\040\114\141\153\145\040
-\103\151\164\171\061\036\060\034\006\003\125\004\012\023\025\124
-\150\145\040\125\123\105\122\124\122\125\123\124\040\116\145\164
-\167\157\162\153\061\041\060\037\006\003\125\004\013\023\030\150
-\164\164\160\072\057\057\167\167\167\056\165\163\145\162\164\162
-\165\163\164\056\143\157\155\061\035\060\033\006\003\125\004\003
-\023\024\125\124\116\055\125\123\105\122\106\151\162\163\164\055
-\117\142\152\145\143\164\060\036\027\015\071\071\060\067\060\071
-\061\070\063\061\062\060\132\027\015\061\071\060\067\060\071\061
-\070\064\060\063\066\132\060\201\225\061\013\060\011\006\003\125
-\004\006\023\002\125\123\061\013\060\011\006\003\125\004\010\023
-\002\125\124\061\027\060\025\006\003\125\004\007\023\016\123\141
-\154\164\040\114\141\153\145\040\103\151\164\171\061\036\060\034
-\006\003\125\004\012\023\025\124\150\145\040\125\123\105\122\124
-\122\125\123\124\040\116\145\164\167\157\162\153\061\041\060\037
-\006\003\125\004\013\023\030\150\164\164\160\072\057\057\167\167
-\167\056\165\163\145\162\164\162\165\163\164\056\143\157\155\061
-\035\060\033\006\003\125\004\003\023\024\125\124\116\055\125\123
-\105\122\106\151\162\163\164\055\117\142\152\145\143\164\060\202
-\001\042\060\015\006\011\052\206\110\206\367\015\001\001\001\005
-\000\003\202\001\017\000\060\202\001\012\002\202\001\001\000\316
-\252\201\077\243\243\141\170\252\061\000\125\225\021\236\047\017
-\037\034\337\072\233\202\150\060\300\112\141\035\361\057\016\372
-\276\171\367\245\043\357\125\121\226\204\315\333\343\271\156\076
-\061\330\012\040\147\307\364\331\277\224\353\107\004\076\002\316
-\052\242\135\207\004\011\366\060\235\030\212\227\262\252\034\374
-\101\322\241\066\313\373\075\221\272\347\331\160\065\372\344\347
-\220\303\233\243\233\323\074\365\022\231\167\261\267\011\340\150
-\346\034\270\363\224\143\210\152\152\376\013\166\311\276\364\042
-\344\147\271\253\032\136\167\301\205\007\335\015\154\277\356\006
-\307\167\152\101\236\247\017\327\373\356\224\027\267\374\205\276
-\244\253\304\034\061\335\327\266\321\344\360\357\337\026\217\262
-\122\223\327\241\324\211\241\007\056\277\341\001\022\102\036\032
-\341\330\225\064\333\144\171\050\377\272\056\021\302\345\350\133
-\222\110\373\107\013\302\154\332\255\062\203\101\363\245\345\101
-\160\375\145\220\155\372\372\121\304\371\275\226\053\031\004\054
-\323\155\247\334\360\177\157\203\145\342\152\253\207\206\165\002
-\003\001\000\001\243\201\257\060\201\254\060\013\006\003\125\035
-\017\004\004\003\002\001\306\060\017\006\003\125\035\023\001\001
-\377\004\005\060\003\001\001\377\060\035\006\003\125\035\016\004
-\026\004\024\332\355\144\164\024\234\024\074\253\335\231\251\275
-\133\050\115\213\074\311\330\060\102\006\003\125\035\037\004\073
-\060\071\060\067\240\065\240\063\206\061\150\164\164\160\072\057
-\057\143\162\154\056\165\163\145\162\164\162\165\163\164\056\143
-\157\155\057\125\124\116\055\125\123\105\122\106\151\162\163\164
-\055\117\142\152\145\143\164\056\143\162\154\060\051\006\003\125
-\035\045\004\042\060\040\006\010\053\006\001\005\005\007\003\003
-\006\010\053\006\001\005\005\007\003\010\006\012\053\006\001\004
-\001\202\067\012\003\004\060\015\006\011\052\206\110\206\367\015
-\001\001\005\005\000\003\202\001\001\000\010\037\122\261\067\104
-\170\333\375\316\271\332\225\226\230\252\125\144\200\265\132\100
-\335\041\245\305\301\363\137\054\114\310\107\132\151\352\350\360
-\065\065\364\320\045\363\310\246\244\207\112\275\033\261\163\010
-\275\324\303\312\266\065\273\131\206\167\061\315\247\200\024\256
-\023\357\374\261\110\371\153\045\045\055\121\266\054\155\105\301
-\230\310\212\126\135\076\356\103\116\076\153\047\216\320\072\113
-\205\013\137\323\355\152\247\165\313\321\132\207\057\071\165\023
-\132\162\260\002\201\237\276\360\017\204\124\040\142\154\151\324
-\341\115\306\015\231\103\001\015\022\226\214\170\235\277\120\242
-\261\104\252\152\317\027\172\317\157\017\324\370\044\125\137\360
-\064\026\111\146\076\120\106\311\143\161\070\061\142\270\142\271
-\363\123\255\154\265\053\242\022\252\031\117\011\332\136\347\223
-\306\216\024\010\376\360\060\200\030\240\206\205\115\310\175\327
-\213\003\376\156\325\367\235\026\254\222\054\240\043\345\234\221
-\122\037\224\337\027\224\163\303\263\301\301\161\005\040\000\170
-\275\023\122\035\250\076\315\000\037\310
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "UTN USERFirst Object Root CA"
-# Issuer: CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Serial Number:44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
-# Subject: CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
-# Not Valid Before: Fri Jul 09 18:31:20 1999
-# Not Valid After : Tue Jul 09 18:40:36 2019
-# Fingerprint (MD5): A7:F2:E4:16:06:41:11:50:30:6B:9C:E3:B4:9C:B0:C9
-# Fingerprint (SHA1): E1:2D:FB:4B:41:D7:D9:C3:2B:30:51:4B:AC:1D:81:D8:38:5E:2D:46
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "UTN USERFirst Object Root CA"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\341\055\373\113\101\327\331\303\053\060\121\113\254\035\201\330
-\070\136\055\106
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\247\362\344\026\006\101\021\120\060\153\234\343\264\234\260\311
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\225\061\013\060\011\006\003\125\004\006\023\002\125\123
-\061\013\060\011\006\003\125\004\010\023\002\125\124\061\027\060
-\025\006\003\125\004\007\023\016\123\141\154\164\040\114\141\153
-\145\040\103\151\164\171\061\036\060\034\006\003\125\004\012\023
-\025\124\150\145\040\125\123\105\122\124\122\125\123\124\040\116
-\145\164\167\157\162\153\061\041\060\037\006\003\125\004\013\023
-\030\150\164\164\160\072\057\057\167\167\167\056\165\163\145\162
-\164\162\165\163\164\056\143\157\155\061\035\060\033\006\003\125
-\004\003\023\024\125\124\116\055\125\123\105\122\106\151\162\163
-\164\055\117\142\152\145\143\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\104\276\014\213\120\000\044\264\021\323\066\055\340\263
-\137\033
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "Camerfirma Chambers of Commerce Root"
 #
@@ -4733,7 +3686,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -4892,7 +3845,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -5047,7 +4000,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -5191,7 +4144,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -5336,7 +4289,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -5543,7 +4496,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -5690,198 +4643,23 @@ CKA_CERT_SHA1_HASH MULTILINE_OCTAL
 \364\213\021\277\336\253\276\224\124\040\161\346\101\336\153\276
 \210\053\100\271
 END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\067\205\104\123\062\105\037\040\360\363\225\341\045\304\103\116
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\077\061\013\060\011\006\003\125\004\006\023\002\124\127\061
-\060\060\056\006\003\125\004\012\014\047\107\157\166\145\162\156
-\155\145\156\164\040\122\157\157\164\040\103\145\162\164\151\146
-\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
-\171
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\037\235\131\132\327\057\302\006\104\245\200\010\151\343
-\136\366
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "Swisscom Root CA 1"
-#
-# Issuer: CN=Swisscom Root CA 1,OU=Digital Certificate Services,O=Swisscom,C=ch
-# Serial Number:5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36
-# Subject: CN=Swisscom Root CA 1,OU=Digital Certificate Services,O=Swisscom,C=ch
-# Not Valid Before: Thu Aug 18 12:06:20 2005
-# Not Valid After : Mon Aug 18 22:06:20 2025
-# Fingerprint (MD5): F8:38:7C:77:88:DF:2C:16:68:2E:C2:E2:52:4B:B8:F9
-# Fingerprint (SHA1): 5F:3A:FC:0A:8B:64:F6:86:67:34:74:DF:7E:A9:A2:FE:F9:FA:7A:51
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Swisscom Root CA 1"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\144\061\013\060\011\006\003\125\004\006\023\002\143\150\061
-\021\060\017\006\003\125\004\012\023\010\123\167\151\163\163\143
-\157\155\061\045\060\043\006\003\125\004\013\023\034\104\151\147
-\151\164\141\154\040\103\145\162\164\151\146\151\143\141\164\145
-\040\123\145\162\166\151\143\145\163\061\033\060\031\006\003\125
-\004\003\023\022\123\167\151\163\163\143\157\155\040\122\157\157
-\164\040\103\101\040\061
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\144\061\013\060\011\006\003\125\004\006\023\002\143\150\061
-\021\060\017\006\003\125\004\012\023\010\123\167\151\163\163\143
-\157\155\061\045\060\043\006\003\125\004\013\023\034\104\151\147
-\151\164\141\154\040\103\145\162\164\151\146\151\143\141\164\145
-\040\123\145\162\166\151\143\145\163\061\033\060\031\006\003\125
-\004\003\023\022\123\167\151\163\163\143\157\155\040\122\157\157
-\164\040\103\101\040\061
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\134\013\205\134\013\347\131\101\337\127\314\077\177\235
-\250\066
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\005\331\060\202\003\301\240\003\002\001\002\002\020\134
-\013\205\134\013\347\131\101\337\127\314\077\177\235\250\066\060
-\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060\144
-\061\013\060\011\006\003\125\004\006\023\002\143\150\061\021\060
-\017\006\003\125\004\012\023\010\123\167\151\163\163\143\157\155
-\061\045\060\043\006\003\125\004\013\023\034\104\151\147\151\164
-\141\154\040\103\145\162\164\151\146\151\143\141\164\145\040\123
-\145\162\166\151\143\145\163\061\033\060\031\006\003\125\004\003
-\023\022\123\167\151\163\163\143\157\155\040\122\157\157\164\040
-\103\101\040\061\060\036\027\015\060\065\060\070\061\070\061\062
-\060\066\062\060\132\027\015\062\065\060\070\061\070\062\062\060
-\066\062\060\132\060\144\061\013\060\011\006\003\125\004\006\023
-\002\143\150\061\021\060\017\006\003\125\004\012\023\010\123\167
-\151\163\163\143\157\155\061\045\060\043\006\003\125\004\013\023
-\034\104\151\147\151\164\141\154\040\103\145\162\164\151\146\151
-\143\141\164\145\040\123\145\162\166\151\143\145\163\061\033\060
-\031\006\003\125\004\003\023\022\123\167\151\163\163\143\157\155
-\040\122\157\157\164\040\103\101\040\061\060\202\002\042\060\015
-\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202\002
-\017\000\060\202\002\012\002\202\002\001\000\320\271\260\250\014
-\331\273\077\041\370\033\325\063\223\200\026\145\040\165\262\075
-\233\140\155\106\310\214\061\157\027\303\372\232\154\126\355\074
-\305\221\127\303\315\253\226\111\220\052\031\113\036\243\155\127
-\335\361\053\142\050\165\105\136\252\326\133\372\013\045\330\241
-\026\371\034\304\056\346\225\052\147\314\320\051\156\074\205\064
-\070\141\111\261\000\237\326\072\161\137\115\155\316\137\271\251
-\344\211\177\152\122\372\312\233\362\334\251\371\235\231\107\077
-\116\051\137\264\246\215\135\173\013\231\021\003\003\376\347\333
-\333\243\377\035\245\315\220\036\001\037\065\260\177\000\333\220
-\157\306\176\173\321\356\172\172\247\252\014\127\157\244\155\305
-\023\073\260\245\331\355\062\034\264\136\147\213\124\334\163\207
-\345\323\027\174\146\120\162\135\324\032\130\301\331\317\330\211
-\002\157\247\111\264\066\135\320\244\336\007\054\266\165\267\050
-\221\326\227\276\050\365\230\036\352\133\046\311\275\260\227\163
-\332\256\221\046\353\150\301\371\071\025\326\147\113\012\155\117
-\313\317\260\344\102\161\214\123\171\347\356\341\333\035\240\156
-\035\214\032\167\065\134\026\036\053\123\037\064\213\321\154\374
-\362\147\007\172\365\255\355\326\232\253\241\261\113\341\314\067
-\137\375\177\315\115\256\270\037\234\103\371\052\130\125\103\105
-\274\226\315\160\016\374\311\343\146\272\116\215\073\201\313\025
-\144\173\271\224\350\135\063\122\205\161\056\117\216\242\006\021
-\121\311\343\313\241\156\061\010\144\014\302\322\074\365\066\350
-\327\320\016\170\043\040\221\311\044\052\145\051\133\042\367\041
-\316\203\136\244\363\336\113\323\150\217\106\165\134\203\011\156
-\051\153\304\160\214\365\235\327\040\057\377\106\322\053\070\302
-\057\165\034\075\176\332\245\357\036\140\205\151\102\323\314\370
-\143\376\036\103\071\205\246\266\143\101\020\263\163\036\274\323
-\372\312\175\026\107\342\247\325\320\243\212\012\010\226\142\126
-\156\064\333\331\002\271\060\165\343\004\322\347\217\302\260\021
-\100\012\254\325\161\002\142\213\061\276\335\306\043\130\061\102
-\103\055\164\371\306\236\246\212\017\351\376\277\203\346\103\127
-\044\272\357\106\064\252\327\022\001\070\355\002\003\001\000\001
-\243\201\206\060\201\203\060\016\006\003\125\035\017\001\001\377
-\004\004\003\002\001\206\060\035\006\003\125\035\041\004\026\060
-\024\060\022\006\007\140\205\164\001\123\000\001\006\007\140\205
-\164\001\123\000\001\060\022\006\003\125\035\023\001\001\377\004
-\010\060\006\001\001\377\002\001\007\060\037\006\003\125\035\043
-\004\030\060\026\200\024\003\045\057\336\157\202\001\072\134\054
-\334\053\241\151\265\147\324\214\323\375\060\035\006\003\125\035
-\016\004\026\004\024\003\045\057\336\157\202\001\072\134\054\334
-\053\241\151\265\147\324\214\323\375\060\015\006\011\052\206\110
-\206\367\015\001\001\005\005\000\003\202\002\001\000\065\020\313
-\354\246\004\015\015\017\315\300\333\253\250\362\210\227\014\337
-\223\057\115\174\100\126\061\172\353\244\017\140\315\172\363\276
-\303\047\216\003\076\244\335\022\357\176\036\164\006\074\077\061
-\362\034\173\221\061\041\264\360\320\154\227\324\351\227\262\044
-\126\036\126\303\065\275\210\005\017\133\020\032\144\341\307\202
-\060\371\062\255\236\120\054\347\170\005\320\061\261\132\230\212
-\165\116\220\134\152\024\052\340\122\107\202\140\346\036\332\201
-\261\373\024\013\132\361\237\322\225\272\076\320\033\326\025\035
-\243\276\206\325\333\017\300\111\144\273\056\120\031\113\322\044
-\370\335\036\007\126\320\070\240\225\160\040\166\214\327\335\036
-\336\237\161\304\043\357\203\023\134\243\044\025\115\051\100\074
-\152\304\251\330\267\246\104\245\015\364\340\235\167\036\100\160
-\046\374\332\331\066\344\171\344\265\077\274\233\145\276\273\021
-\226\317\333\306\050\071\072\010\316\107\133\123\132\305\231\376
-\135\251\335\357\114\324\306\245\255\002\346\214\007\022\036\157
-\003\321\157\240\243\363\051\275\022\307\120\242\260\177\210\251
-\231\167\232\261\300\245\071\056\134\174\151\342\054\260\352\067
-\152\244\341\132\341\365\120\345\203\357\245\273\052\210\347\214
-\333\375\155\136\227\031\250\176\146\165\153\161\352\277\261\307
-\157\240\364\216\244\354\064\121\133\214\046\003\160\241\167\325
-\001\022\127\000\065\333\043\336\016\212\050\231\375\261\020\157
-\113\377\070\055\140\116\054\234\353\147\265\255\111\356\113\037
-\254\257\373\015\220\132\146\140\160\135\252\315\170\324\044\356
-\310\101\240\223\001\222\234\152\236\374\271\044\305\263\025\202
-\176\276\256\225\053\353\261\300\332\343\001\140\013\136\151\254
-\204\126\141\276\161\027\376\035\023\017\376\306\207\105\351\376
-\062\240\032\015\023\244\224\125\161\245\026\213\272\312\211\260
-\262\307\374\217\330\124\265\223\142\235\316\317\131\373\075\030
-\316\052\313\065\025\202\135\377\124\042\133\161\122\373\267\311
-\376\140\233\000\101\144\360\252\052\354\266\102\103\316\211\146
-\201\310\213\237\071\124\003\045\323\026\065\216\204\320\137\372
-\060\032\365\232\154\364\016\123\371\072\133\321\034
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "Swisscom Root CA 1"
-# Issuer: CN=Swisscom Root CA 1,OU=Digital Certificate Services,O=Swisscom,C=ch
-# Serial Number:5c:0b:85:5c:0b:e7:59:41:df:57:cc:3f:7f:9d:a8:36
-# Subject: CN=Swisscom Root CA 1,OU=Digital Certificate Services,O=Swisscom,C=ch
-# Not Valid Before: Thu Aug 18 12:06:20 2005
-# Not Valid After : Mon Aug 18 22:06:20 2025
-# Fingerprint (MD5): F8:38:7C:77:88:DF:2C:16:68:2E:C2:E2:52:4B:B8:F9
-# Fingerprint (SHA1): 5F:3A:FC:0A:8B:64:F6:86:67:34:74:DF:7E:A9:A2:FE:F9:FA:7A:51
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Swisscom Root CA 1"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\137\072\374\012\213\144\366\206\147\064\164\337\176\251\242\376
-\371\372\172\121
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\370\070\174\167\210\337\054\026\150\056\302\342\122\113\270\371
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\144\061\013\060\011\006\003\125\004\006\023\002\143\150\061
-\021\060\017\006\003\125\004\012\023\010\123\167\151\163\163\143
-\157\155\061\045\060\043\006\003\125\004\013\023\034\104\151\147
-\151\164\141\154\040\103\145\162\164\151\146\151\143\141\164\145
-\040\123\145\162\166\151\143\145\163\061\033\060\031\006\003\125
-\004\003\023\022\123\167\151\163\163\143\157\155\040\122\157\157
-\164\040\103\101\040\061
-END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\067\205\104\123\062\105\037\040\360\363\225\341\045\304\103\116
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\077\061\013\060\011\006\003\125\004\006\023\002\124\127\061
+\060\060\056\006\003\125\004\012\014\047\107\157\166\145\162\156
+\155\145\156\164\040\122\157\157\164\040\103\145\162\164\151\146
+\151\143\141\164\151\157\156\040\101\165\164\150\157\162\151\164
+\171
+END
 CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\020\134\013\205\134\013\347\131\101\337\127\314\077\177\235
-\250\066
+\002\020\037\235\131\132\327\057\302\006\104\245\200\010\151\343
+\136\366
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -6022,7 +4800,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -6163,7 +4941,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -6305,7 +5083,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -6872,7 +5650,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -7037,7 +5815,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -7203,7 +5981,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -7497,7 +6275,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -7674,7 +6452,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -7809,7 +6587,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -7944,7 +6722,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -8098,7 +6876,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -8370,7 +7148,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -9142,7 +7920,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -9440,7 +8218,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -9573,137 +8351,6 @@ CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
-#
-# Certificate "ComSign Secured CA"
-#
-# Issuer: C=IL,O=ComSign,CN=ComSign Secured CA
-# Serial Number:00:c7:28:47:09:b3:b8:6c:45:8c:1d:fa:24:f5:36:4e:e9
-# Subject: C=IL,O=ComSign,CN=ComSign Secured CA
-# Not Valid Before: Wed Mar 24 11:37:20 2004
-# Not Valid After : Fri Mar 16 15:04:56 2029
-# Fingerprint (MD5): 40:01:25:06:8D:21:43:6A:0E:43:00:9C:E7:43:F3:D5
-# Fingerprint (SHA1): F9:CD:0E:2C:DA:76:24:C1:8F:BD:F0:F0:AB:B6:45:B8:F7:FE:D5:7A
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "ComSign Secured CA"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\074\061\033\060\031\006\003\125\004\003\023\022\103\157\155
-\123\151\147\156\040\123\145\143\165\162\145\144\040\103\101\061
-\020\060\016\006\003\125\004\012\023\007\103\157\155\123\151\147
-\156\061\013\060\011\006\003\125\004\006\023\002\111\114
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\074\061\033\060\031\006\003\125\004\003\023\022\103\157\155
-\123\151\147\156\040\123\145\143\165\162\145\144\040\103\101\061
-\020\060\016\006\003\125\004\012\023\007\103\157\155\123\151\147
-\156\061\013\060\011\006\003\125\004\006\023\002\111\114
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\021\000\307\050\107\011\263\270\154\105\214\035\372\044\365
-\066\116\351
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\253\060\202\002\223\240\003\002\001\002\002\021\000
-\307\050\107\011\263\270\154\105\214\035\372\044\365\066\116\351
-\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060
-\074\061\033\060\031\006\003\125\004\003\023\022\103\157\155\123
-\151\147\156\040\123\145\143\165\162\145\144\040\103\101\061\020
-\060\016\006\003\125\004\012\023\007\103\157\155\123\151\147\156
-\061\013\060\011\006\003\125\004\006\023\002\111\114\060\036\027
-\015\060\064\060\063\062\064\061\061\063\067\062\060\132\027\015
-\062\071\060\063\061\066\061\065\060\064\065\066\132\060\074\061
-\033\060\031\006\003\125\004\003\023\022\103\157\155\123\151\147
-\156\040\123\145\143\165\162\145\144\040\103\101\061\020\060\016
-\006\003\125\004\012\023\007\103\157\155\123\151\147\156\061\013
-\060\011\006\003\125\004\006\023\002\111\114\060\202\001\042\060
-\015\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202
-\001\017\000\060\202\001\012\002\202\001\001\000\306\265\150\137
-\035\224\025\303\244\010\125\055\343\240\127\172\357\351\164\052
-\273\271\174\127\111\032\021\136\117\051\207\014\110\326\152\347
-\217\324\176\127\044\271\006\211\344\034\074\352\254\343\332\041
-\200\163\041\012\357\171\230\154\037\010\377\241\120\175\362\230
-\033\311\124\157\076\245\050\354\041\004\017\105\273\007\075\241
-\300\372\052\230\035\116\006\223\373\365\210\073\253\137\313\026
-\277\346\363\236\112\207\355\031\352\302\237\103\344\361\201\245
-\177\020\117\076\321\112\142\255\123\033\313\203\377\007\145\245
-\222\055\146\251\133\270\132\364\035\264\041\221\112\027\173\236
-\062\376\126\044\071\262\124\204\103\365\204\302\330\274\101\220
-\314\235\326\150\332\351\202\120\251\073\150\317\265\135\002\224
-\140\026\261\103\331\103\135\335\135\207\156\352\273\263\311\153
-\366\003\224\011\160\336\026\021\172\053\350\166\217\111\020\230
-\167\271\143\134\213\063\227\165\366\013\214\262\253\133\336\164
-\040\045\077\343\363\021\371\207\150\206\065\161\303\035\214\055
-\353\345\032\254\017\163\325\202\131\100\200\323\002\003\001\000
-\001\243\201\247\060\201\244\060\014\006\003\125\035\023\004\005
-\060\003\001\001\377\060\104\006\003\125\035\037\004\075\060\073
-\060\071\240\067\240\065\206\063\150\164\164\160\072\057\057\146
-\145\144\151\162\056\143\157\155\163\151\147\156\056\143\157\056
-\151\154\057\143\162\154\057\103\157\155\123\151\147\156\123\145
-\143\165\162\145\144\103\101\056\143\162\154\060\016\006\003\125
-\035\017\001\001\377\004\004\003\002\001\206\060\037\006\003\125
-\035\043\004\030\060\026\200\024\301\113\355\160\266\367\076\174
-\000\073\000\217\307\076\016\105\237\036\135\354\060\035\006\003
-\125\035\016\004\026\004\024\301\113\355\160\266\367\076\174\000
-\073\000\217\307\076\016\105\237\036\135\354\060\015\006\011\052
-\206\110\206\367\015\001\001\005\005\000\003\202\001\001\000\026
-\317\356\222\023\120\253\173\024\236\063\266\102\040\152\324\025
-\275\011\253\374\162\350\357\107\172\220\254\121\301\144\116\351
-\210\275\103\105\201\343\146\043\077\022\206\115\031\344\005\260
-\346\067\302\215\332\006\050\311\017\211\244\123\251\165\077\260
-\226\373\253\114\063\125\371\170\046\106\157\033\066\230\373\102
-\166\301\202\271\216\336\373\105\371\143\033\142\073\071\006\312
-\167\172\250\074\011\317\154\066\075\017\012\105\113\151\026\032
-\105\175\063\003\145\371\122\161\220\046\225\254\114\014\365\213
-\223\077\314\165\164\205\230\272\377\142\172\115\037\211\376\256
-\275\224\000\231\277\021\245\334\340\171\305\026\013\175\002\141
-\035\352\205\371\002\025\117\347\132\211\116\024\157\343\067\113
-\205\365\301\074\141\340\375\005\101\262\222\177\303\035\240\320
-\256\122\144\140\153\030\306\046\234\330\365\144\344\066\032\142
-\237\212\017\076\377\155\116\031\126\116\040\221\154\237\064\063
-\072\064\127\120\072\157\201\136\006\306\365\076\174\116\216\053
-\316\145\006\056\135\322\052\123\164\136\323\156\047\236\217
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "ComSign Secured CA"
-# Issuer: C=IL,O=ComSign,CN=ComSign Secured CA
-# Serial Number:00:c7:28:47:09:b3:b8:6c:45:8c:1d:fa:24:f5:36:4e:e9
-# Subject: C=IL,O=ComSign,CN=ComSign Secured CA
-# Not Valid Before: Wed Mar 24 11:37:20 2004
-# Not Valid After : Fri Mar 16 15:04:56 2029
-# Fingerprint (MD5): 40:01:25:06:8D:21:43:6A:0E:43:00:9C:E7:43:F3:D5
-# Fingerprint (SHA1): F9:CD:0E:2C:DA:76:24:C1:8F:BD:F0:F0:AB:B6:45:B8:F7:FE:D5:7A
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "ComSign Secured CA"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\371\315\016\054\332\166\044\301\217\275\360\360\253\266\105\270
-\367\376\325\172
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\100\001\045\006\215\041\103\152\016\103\000\234\347\103\363\325
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\074\061\033\060\031\006\003\125\004\003\023\022\103\157\155
-\123\151\147\156\040\123\145\143\165\162\145\144\040\103\101\061
-\020\060\016\006\003\125\004\012\023\007\103\157\155\123\151\147
-\156\061\013\060\011\006\003\125\004\006\023\002\111\114
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\021\000\307\050\107\011\263\270\154\105\214\035\372\044\365
-\066\116\351
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
 #
 # Certificate "Cybertrust Global Root"
 #
@@ -10000,7 +8647,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -10319,130 +8966,6 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "CNNIC ROOT"
-#
-# Issuer: CN=CNNIC ROOT,O=CNNIC,C=CN
-# Serial Number: 1228079105 (0x49330001)
-# Subject: CN=CNNIC ROOT,O=CNNIC,C=CN
-# Not Valid Before: Mon Apr 16 07:09:14 2007
-# Not Valid After : Fri Apr 16 07:09:14 2027
-# Fingerprint (MD5): 21:BC:82:AB:49:C4:13:3B:4B:B2:2B:5C:6B:90:9C:19
-# Fingerprint (SHA1): 8B:AF:4C:9B:1D:F0:2A:92:F7:DA:12:8E:B9:1B:AC:F4:98:60:4B:6F
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "CNNIC ROOT"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\062\061\013\060\011\006\003\125\004\006\023\002\103\116\061
-\016\060\014\006\003\125\004\012\023\005\103\116\116\111\103\061
-\023\060\021\006\003\125\004\003\023\012\103\116\116\111\103\040
-\122\117\117\124
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\062\061\013\060\011\006\003\125\004\006\023\002\103\116\061
-\016\060\014\006\003\125\004\012\023\005\103\116\116\111\103\061
-\023\060\021\006\003\125\004\003\023\012\103\116\116\111\103\040
-\122\117\117\124
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\004\111\063\000\001
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\125\060\202\002\075\240\003\002\001\002\002\004\111
-\063\000\001\060\015\006\011\052\206\110\206\367\015\001\001\005
-\005\000\060\062\061\013\060\011\006\003\125\004\006\023\002\103
-\116\061\016\060\014\006\003\125\004\012\023\005\103\116\116\111
-\103\061\023\060\021\006\003\125\004\003\023\012\103\116\116\111
-\103\040\122\117\117\124\060\036\027\015\060\067\060\064\061\066
-\060\067\060\071\061\064\132\027\015\062\067\060\064\061\066\060
-\067\060\071\061\064\132\060\062\061\013\060\011\006\003\125\004
-\006\023\002\103\116\061\016\060\014\006\003\125\004\012\023\005
-\103\116\116\111\103\061\023\060\021\006\003\125\004\003\023\012
-\103\116\116\111\103\040\122\117\117\124\060\202\001\042\060\015
-\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202\001
-\017\000\060\202\001\012\002\202\001\001\000\323\065\367\077\163
-\167\255\350\133\163\027\302\321\157\355\125\274\156\352\350\244
-\171\262\154\303\243\357\341\237\261\073\110\205\365\232\134\041
-\042\020\054\305\202\316\332\343\232\156\067\341\207\054\334\271
-\014\132\272\210\125\337\375\252\333\037\061\352\001\361\337\071
-\001\301\023\375\110\122\041\304\125\337\332\330\263\124\166\272
-\164\261\267\175\327\300\350\366\131\305\115\310\275\255\037\024
-\332\337\130\104\045\062\031\052\307\176\176\216\256\070\260\060
-\173\107\162\011\061\360\060\333\303\033\166\051\273\151\166\116
-\127\371\033\144\242\223\126\267\157\231\156\333\012\004\234\021
-\343\200\037\313\143\224\020\012\251\341\144\202\061\371\214\047
-\355\246\231\000\366\160\223\030\370\241\064\206\243\335\172\302
-\030\171\366\172\145\065\317\220\353\275\063\223\237\123\253\163
-\073\346\233\064\040\057\035\357\251\035\143\032\240\200\333\003
-\057\371\046\032\206\322\215\273\251\276\122\072\207\147\110\015
-\277\264\240\330\046\276\043\137\163\067\177\046\346\222\004\243
-\177\317\040\247\267\363\072\312\313\231\313\002\003\001\000\001
-\243\163\060\161\060\021\006\011\140\206\110\001\206\370\102\001
-\001\004\004\003\002\000\007\060\037\006\003\125\035\043\004\030
-\060\026\200\024\145\362\061\255\052\367\367\335\122\226\012\307
-\002\301\016\357\246\325\073\021\060\017\006\003\125\035\023\001
-\001\377\004\005\060\003\001\001\377\060\013\006\003\125\035\017
-\004\004\003\002\001\376\060\035\006\003\125\035\016\004\026\004
-\024\145\362\061\255\052\367\367\335\122\226\012\307\002\301\016
-\357\246\325\073\021\060\015\006\011\052\206\110\206\367\015\001
-\001\005\005\000\003\202\001\001\000\113\065\356\314\344\256\277
-\303\156\255\237\225\073\113\077\133\036\337\127\051\242\131\312
-\070\342\271\032\377\236\346\156\062\335\036\256\352\065\267\365
-\223\221\116\332\102\341\303\027\140\120\362\321\134\046\271\202
-\267\352\155\344\234\204\347\003\171\027\257\230\075\224\333\307
-\272\000\347\270\277\001\127\301\167\105\062\014\073\361\264\034
-\010\260\375\121\240\241\335\232\035\023\066\232\155\267\307\074
-\271\341\305\331\027\372\203\325\075\025\240\074\273\036\013\342
-\310\220\077\250\206\014\374\371\213\136\205\313\117\133\113\142
-\021\107\305\105\174\005\057\101\261\236\020\151\033\231\226\340
-\125\171\373\116\206\231\270\224\332\206\070\152\223\243\347\313
-\156\345\337\352\041\125\211\234\175\175\177\230\365\000\211\356
-\343\204\300\134\226\265\305\106\352\106\340\205\125\266\033\311
-\022\326\301\315\315\200\363\002\001\074\310\151\313\105\110\143
-\330\224\320\354\205\016\073\116\021\145\364\202\214\246\075\256
-\056\042\224\011\310\134\352\074\201\135\026\052\003\227\026\125
-\011\333\212\101\202\236\146\233\021
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for Certificate "CNNIC ROOT"
-# Issuer: CN=CNNIC ROOT,O=CNNIC,C=CN
-# Serial Number: 1228079105 (0x49330001)
-# Subject: CN=CNNIC ROOT,O=CNNIC,C=CN
-# Not Valid Before: Mon Apr 16 07:09:14 2007
-# Not Valid After : Fri Apr 16 07:09:14 2027
-# Fingerprint (MD5): 21:BC:82:AB:49:C4:13:3B:4B:B2:2B:5C:6B:90:9C:19
-# Fingerprint (SHA1): 8B:AF:4C:9B:1D:F0:2A:92:F7:DA:12:8E:B9:1B:AC:F4:98:60:4B:6F
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "CNNIC ROOT"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\213\257\114\233\035\360\052\222\367\332\022\216\271\033\254\364
-\230\140\113\157
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\041\274\202\253\111\304\023\073\113\262\053\134\153\220\234\031
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\062\061\013\060\011\006\003\125\004\006\023\002\103\116\061
-\016\060\014\006\003\125\004\012\023\005\103\116\116\111\103\061
-\023\060\021\006\003\125\004\003\023\012\103\116\116\111\103\040
-\122\117\117\124
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\004\111\063\000\001
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
@@ -10598,7 +9121,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -10726,7 +9249,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -10889,7 +9412,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -11023,7 +9546,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -11195,7 +9718,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -11351,7 +9874,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -11508,7 +10031,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -11677,7 +10200,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -12099,7 +10622,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 
@@ -12250,7 +10773,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -12378,7 +10901,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -12552,7 +11075,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -12720,7 +11243,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -12932,7 +11455,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -13140,7 +11663,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -15005,7 +13528,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -15156,7 +13679,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -15308,7 +13831,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -15966,7 +14489,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -16270,7 +14793,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -17660,7 +16183,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -18010,7 +16533,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 # Explicitly Distrust "MITM subCA 1 issued by Trustwave", Bug 724929
@@ -18243,7 +16766,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -18576,7 +17099,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -18739,7 +17262,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -19352,7 +17875,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 # Explicitly Distrust "TURKTRUST Mis-issued Intermediate CA 1", Bug 825022
@@ -19586,7 +18109,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -20135,155 +18658,6 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "China Internet Network Information Center EV Certificates Root"
-#
-# Issuer: CN=China Internet Network Information Center EV Certificates Root,O=China Internet Network Information Center,C=CN
-# Serial Number: 1218379777 (0x489f0001)
-# Subject: CN=China Internet Network Information Center EV Certificates Root,O=China Internet Network Information Center,C=CN
-# Not Valid Before: Tue Aug 31 07:11:25 2010
-# Not Valid After : Sat Aug 31 07:11:25 2030
-# Fingerprint (MD5): 55:5D:63:00:97:BD:6A:97:F5:67:AB:4B:FB:6E:63:15
-# Fingerprint (SHA1): 4F:99:AA:93:FB:2B:D1:37:26:A1:99:4A:CE:7F:F0:05:F2:93:5D:1E
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "China Internet Network Information Center EV Certificates Root"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\201\212\061\013\060\011\006\003\125\004\006\023\002\103\116
-\061\062\060\060\006\003\125\004\012\014\051\103\150\151\156\141
-\040\111\156\164\145\162\156\145\164\040\116\145\164\167\157\162
-\153\040\111\156\146\157\162\155\141\164\151\157\156\040\103\145
-\156\164\145\162\061\107\060\105\006\003\125\004\003\014\076\103
-\150\151\156\141\040\111\156\164\145\162\156\145\164\040\116\145
-\164\167\157\162\153\040\111\156\146\157\162\155\141\164\151\157
-\156\040\103\145\156\164\145\162\040\105\126\040\103\145\162\164
-\151\146\151\143\141\164\145\163\040\122\157\157\164
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\212\061\013\060\011\006\003\125\004\006\023\002\103\116
-\061\062\060\060\006\003\125\004\012\014\051\103\150\151\156\141
-\040\111\156\164\145\162\156\145\164\040\116\145\164\167\157\162
-\153\040\111\156\146\157\162\155\141\164\151\157\156\040\103\145
-\156\164\145\162\061\107\060\105\006\003\125\004\003\014\076\103
-\150\151\156\141\040\111\156\164\145\162\156\145\164\040\116\145
-\164\167\157\162\153\040\111\156\146\157\162\155\141\164\151\157
-\156\040\103\145\156\164\145\162\040\105\126\040\103\145\162\164
-\151\146\151\143\141\164\145\163\040\122\157\157\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\004\110\237\000\001
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\367\060\202\002\337\240\003\002\001\002\002\004\110
-\237\000\001\060\015\006\011\052\206\110\206\367\015\001\001\005
-\005\000\060\201\212\061\013\060\011\006\003\125\004\006\023\002
-\103\116\061\062\060\060\006\003\125\004\012\014\051\103\150\151
-\156\141\040\111\156\164\145\162\156\145\164\040\116\145\164\167
-\157\162\153\040\111\156\146\157\162\155\141\164\151\157\156\040
-\103\145\156\164\145\162\061\107\060\105\006\003\125\004\003\014
-\076\103\150\151\156\141\040\111\156\164\145\162\156\145\164\040
-\116\145\164\167\157\162\153\040\111\156\146\157\162\155\141\164
-\151\157\156\040\103\145\156\164\145\162\040\105\126\040\103\145
-\162\164\151\146\151\143\141\164\145\163\040\122\157\157\164\060
-\036\027\015\061\060\060\070\063\061\060\067\061\061\062\065\132
-\027\015\063\060\060\070\063\061\060\067\061\061\062\065\132\060
-\201\212\061\013\060\011\006\003\125\004\006\023\002\103\116\061
-\062\060\060\006\003\125\004\012\014\051\103\150\151\156\141\040
-\111\156\164\145\162\156\145\164\040\116\145\164\167\157\162\153
-\040\111\156\146\157\162\155\141\164\151\157\156\040\103\145\156
-\164\145\162\061\107\060\105\006\003\125\004\003\014\076\103\150
-\151\156\141\040\111\156\164\145\162\156\145\164\040\116\145\164
-\167\157\162\153\040\111\156\146\157\162\155\141\164\151\157\156
-\040\103\145\156\164\145\162\040\105\126\040\103\145\162\164\151
-\146\151\143\141\164\145\163\040\122\157\157\164\060\202\001\042
-\060\015\006\011\052\206\110\206\367\015\001\001\001\005\000\003
-\202\001\017\000\060\202\001\012\002\202\001\001\000\233\176\163
-\356\275\073\170\252\144\103\101\365\120\337\224\362\056\262\215
-\112\216\106\124\322\041\022\310\071\062\102\006\351\203\325\237
-\122\355\345\147\003\073\124\301\214\231\231\314\351\300\017\377
-\015\331\204\021\262\270\321\313\133\334\036\371\150\061\144\341
-\233\372\164\353\150\271\040\225\367\306\017\215\107\254\132\006
-\335\141\253\342\354\330\237\027\055\234\312\074\065\227\125\161
-\315\103\205\261\107\026\365\054\123\200\166\317\323\000\144\275
-\100\231\335\314\330\333\304\237\326\023\137\101\203\213\371\015
-\207\222\126\064\154\032\020\013\027\325\132\034\227\130\204\074
-\204\032\056\134\221\064\156\031\137\177\027\151\305\145\357\153
-\041\306\325\120\072\277\141\271\005\215\357\157\064\072\262\157
-\024\143\277\026\073\233\251\052\375\267\053\070\146\006\305\054
-\342\252\147\036\105\247\215\004\146\102\366\217\053\357\210\040
-\151\217\062\214\024\163\332\053\206\221\143\042\232\362\247\333
-\316\211\213\253\135\307\024\301\133\060\152\037\261\267\236\056
-\201\001\002\355\317\226\136\143\333\250\346\070\267\002\003\001
-\000\001\243\143\060\141\060\037\006\003\125\035\043\004\030\060
-\026\200\024\174\162\113\071\307\300\333\142\245\117\233\252\030
-\064\222\242\312\203\202\131\060\017\006\003\125\035\023\001\001
-\377\004\005\060\003\001\001\377\060\016\006\003\125\035\017\001
-\001\377\004\004\003\002\001\006\060\035\006\003\125\035\016\004
-\026\004\024\174\162\113\071\307\300\333\142\245\117\233\252\030
-\064\222\242\312\203\202\131\060\015\006\011\052\206\110\206\367
-\015\001\001\005\005\000\003\202\001\001\000\052\303\307\103\067
-\217\335\255\244\262\014\356\334\024\155\217\050\244\230\111\313
-\014\200\352\363\355\043\146\165\175\305\323\041\147\171\321\163
-\305\265\003\267\130\254\014\124\057\306\126\023\017\061\332\006
-\347\145\073\035\157\066\333\310\035\371\375\200\006\312\243\075
-\146\026\250\235\114\026\175\300\225\106\265\121\344\342\037\327
-\352\006\115\143\215\226\214\357\347\063\127\102\072\353\214\301
-\171\310\115\166\175\336\366\261\267\201\340\240\371\241\170\106
-\027\032\126\230\360\116\075\253\034\355\354\071\334\007\110\367
-\143\376\006\256\302\244\134\152\133\062\210\305\307\063\205\254
-\146\102\107\302\130\044\231\341\345\076\345\165\054\216\103\326
-\135\074\170\036\250\225\202\051\120\321\321\026\272\357\301\276
-\172\331\264\330\314\036\114\106\341\167\261\061\253\275\052\310
-\316\217\156\241\135\177\003\165\064\344\255\211\105\124\136\276
-\256\050\245\273\077\170\171\353\163\263\012\015\375\276\311\367
-\126\254\366\267\355\057\233\041\051\307\070\266\225\304\004\362
-\303\055\375\024\052\220\231\271\007\314\237
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for "China Internet Network Information Center EV Certificates Root"
-# Issuer: CN=China Internet Network Information Center EV Certificates Root,O=China Internet Network Information Center,C=CN
-# Serial Number: 1218379777 (0x489f0001)
-# Subject: CN=China Internet Network Information Center EV Certificates Root,O=China Internet Network Information Center,C=CN
-# Not Valid Before: Tue Aug 31 07:11:25 2010
-# Not Valid After : Sat Aug 31 07:11:25 2030
-# Fingerprint (MD5): 55:5D:63:00:97:BD:6A:97:F5:67:AB:4B:FB:6E:63:15
-# Fingerprint (SHA1): 4F:99:AA:93:FB:2B:D1:37:26:A1:99:4A:CE:7F:F0:05:F2:93:5D:1E
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "China Internet Network Information Center EV Certificates Root"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\117\231\252\223\373\053\321\067\046\241\231\112\316\177\360\005
-\362\223\135\036
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\125\135\143\000\227\275\152\227\365\147\253\113\373\156\143\025
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\201\212\061\013\060\011\006\003\125\004\006\023\002\103\116
-\061\062\060\060\006\003\125\004\012\014\051\103\150\151\156\141
-\040\111\156\164\145\162\156\145\164\040\116\145\164\167\157\162
-\153\040\111\156\146\157\162\155\141\164\151\157\156\040\103\145
-\156\164\145\162\061\107\060\105\006\003\125\004\003\014\076\103
-\150\151\156\141\040\111\156\164\145\162\156\145\164\040\116\145
-\164\167\157\162\153\040\111\156\146\157\162\155\141\164\151\157
-\156\040\103\145\156\164\145\162\040\105\126\040\103\145\162\164
-\151\146\151\143\141\164\145\163\040\122\157\157\164
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\004\110\237\000\001
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
@@ -20457,185 +18831,9 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 \002\020\036\236\050\350\110\362\345\357\303\174\112\036\132\030
 \147\266
 END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "Swisscom Root EV CA 2"
-#
-# Issuer: CN=Swisscom Root EV CA 2,OU=Digital Certificate Services,O=Swisscom,C=ch
-# Serial Number:00:f2:fa:64:e2:74:63:d3:8d:fd:10:1d:04:1f:76:ca:58
-# Subject: CN=Swisscom Root EV CA 2,OU=Digital Certificate Services,O=Swisscom,C=ch
-# Not Valid Before: Fri Jun 24 09:45:08 2011
-# Not Valid After : Wed Jun 25 08:45:08 2031
-# Fingerprint (MD5): 7B:30:34:9F:DD:0A:4B:6B:35:CA:31:51:28:5D:AE:EC
-# Fingerprint (SHA1): E7:A1:90:29:D3:D5:52:DC:0D:0F:C6:92:D3:EA:88:0D:15:2E:1A:6B
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Swisscom Root EV CA 2"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\147\061\013\060\011\006\003\125\004\006\023\002\143\150\061
-\021\060\017\006\003\125\004\012\023\010\123\167\151\163\163\143
-\157\155\061\045\060\043\006\003\125\004\013\023\034\104\151\147
-\151\164\141\154\040\103\145\162\164\151\146\151\143\141\164\145
-\040\123\145\162\166\151\143\145\163\061\036\060\034\006\003\125
-\004\003\023\025\123\167\151\163\163\143\157\155\040\122\157\157
-\164\040\105\126\040\103\101\040\062
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\147\061\013\060\011\006\003\125\004\006\023\002\143\150\061
-\021\060\017\006\003\125\004\012\023\010\123\167\151\163\163\143
-\157\155\061\045\060\043\006\003\125\004\013\023\034\104\151\147
-\151\164\141\154\040\103\145\162\164\151\146\151\143\141\164\145
-\040\123\145\162\166\151\143\145\163\061\036\060\034\006\003\125
-\004\003\023\025\123\167\151\163\163\143\157\155\040\122\157\157
-\164\040\105\126\040\103\101\040\062
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\021\000\362\372\144\342\164\143\323\215\375\020\035\004\037
-\166\312\130
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\005\340\060\202\003\310\240\003\002\001\002\002\021\000
-\362\372\144\342\164\143\323\215\375\020\035\004\037\166\312\130
-\060\015\006\011\052\206\110\206\367\015\001\001\013\005\000\060
-\147\061\013\060\011\006\003\125\004\006\023\002\143\150\061\021
-\060\017\006\003\125\004\012\023\010\123\167\151\163\163\143\157
-\155\061\045\060\043\006\003\125\004\013\023\034\104\151\147\151
-\164\141\154\040\103\145\162\164\151\146\151\143\141\164\145\040
-\123\145\162\166\151\143\145\163\061\036\060\034\006\003\125\004
-\003\023\025\123\167\151\163\163\143\157\155\040\122\157\157\164
-\040\105\126\040\103\101\040\062\060\036\027\015\061\061\060\066
-\062\064\060\071\064\065\060\070\132\027\015\063\061\060\066\062
-\065\060\070\064\065\060\070\132\060\147\061\013\060\011\006\003
-\125\004\006\023\002\143\150\061\021\060\017\006\003\125\004\012
-\023\010\123\167\151\163\163\143\157\155\061\045\060\043\006\003
-\125\004\013\023\034\104\151\147\151\164\141\154\040\103\145\162
-\164\151\146\151\143\141\164\145\040\123\145\162\166\151\143\145
-\163\061\036\060\034\006\003\125\004\003\023\025\123\167\151\163
-\163\143\157\155\040\122\157\157\164\040\105\126\040\103\101\040
-\062\060\202\002\042\060\015\006\011\052\206\110\206\367\015\001
-\001\001\005\000\003\202\002\017\000\060\202\002\012\002\202\002
-\001\000\304\367\035\057\127\352\127\154\367\160\135\143\260\161
-\122\011\140\104\050\063\243\172\116\012\372\330\352\154\213\121
-\026\032\125\256\124\046\304\314\105\007\101\117\020\171\177\161
-\322\172\116\077\070\116\263\000\306\225\312\133\315\301\052\203
-\327\047\037\061\016\043\026\267\045\313\034\264\271\200\062\136
-\032\235\223\361\350\074\140\054\247\136\127\031\130\121\136\274
-\054\126\013\270\330\357\213\202\264\074\270\302\044\250\023\307
-\240\041\066\033\172\127\051\050\247\056\277\161\045\220\363\104
-\203\151\120\244\344\341\033\142\031\224\011\243\363\303\274\357
-\364\275\354\333\023\235\317\235\110\011\122\147\300\067\051\021
-\036\373\322\021\247\205\030\164\171\344\117\205\024\353\122\067
-\342\261\105\330\314\015\103\177\256\023\322\153\053\077\247\302
-\342\250\155\166\133\103\237\276\264\235\263\046\206\073\037\177
-\345\362\350\146\050\026\045\320\113\227\070\247\344\317\011\321
-\066\303\013\276\332\073\104\130\215\276\361\236\011\153\076\363
-\062\307\053\207\306\354\136\234\366\207\145\255\063\051\304\057
-\211\331\271\313\311\003\235\373\154\224\121\227\020\033\206\013
-\032\033\077\366\002\176\173\324\305\121\144\050\235\365\323\254
-\203\201\210\323\164\264\131\235\301\353\141\063\132\105\321\313
-\071\320\006\152\123\140\035\257\366\373\151\274\152\334\001\317
-\275\371\217\331\275\133\301\072\137\216\332\017\113\251\233\235
-\052\050\153\032\012\174\074\253\042\013\345\167\055\161\366\202
-\065\201\256\370\173\201\346\352\376\254\364\032\233\164\134\350
-\217\044\366\135\235\106\304\054\322\036\053\041\152\203\047\147
-\125\112\244\343\310\062\227\146\220\162\332\343\324\144\056\137
-\343\241\152\366\140\324\347\065\315\312\304\150\215\327\161\310
-\323\044\063\163\261\154\371\152\341\050\333\137\306\075\350\276
-\125\346\067\033\355\044\331\017\031\217\137\143\030\130\120\201
-\121\145\157\362\237\176\152\004\347\064\044\161\272\166\113\130
-\036\031\275\025\140\105\252\014\022\100\001\235\020\342\307\070
-\007\162\012\145\300\266\273\045\051\332\026\236\213\065\213\141
-\355\345\161\127\203\265\074\161\237\343\117\277\176\036\201\237
-\101\227\002\003\001\000\001\243\201\206\060\201\203\060\016\006
-\003\125\035\017\001\001\377\004\004\003\002\001\206\060\035\006
-\003\125\035\041\004\026\060\024\060\022\006\007\140\205\164\001
-\123\002\002\006\007\140\205\164\001\123\002\002\060\022\006\003
-\125\035\023\001\001\377\004\010\060\006\001\001\377\002\001\003
-\060\035\006\003\125\035\016\004\026\004\024\105\331\245\201\156
-\075\210\115\215\161\322\106\301\156\105\036\363\304\200\235\060
-\037\006\003\125\035\043\004\030\060\026\200\024\105\331\245\201
-\156\075\210\115\215\161\322\106\301\156\105\036\363\304\200\235
-\060\015\006\011\052\206\110\206\367\015\001\001\013\005\000\003
-\202\002\001\000\224\072\163\006\237\122\113\060\134\324\376\261
-\134\045\371\327\216\157\365\207\144\237\355\024\216\270\004\216
-\050\113\217\252\173\216\071\264\331\130\366\173\241\065\012\241
-\235\212\367\143\345\353\275\071\202\324\343\172\055\157\337\023
-\074\272\376\176\126\230\013\363\124\237\315\104\116\156\074\341
-\076\025\277\006\046\235\344\360\220\266\324\302\236\060\056\037
-\357\307\172\304\120\307\352\173\332\120\313\172\046\313\000\264
-\132\253\265\223\037\200\211\204\004\225\215\215\177\011\223\277
-\324\250\250\344\143\155\331\144\344\270\051\132\010\277\120\341
-\204\017\125\173\137\010\042\033\365\275\231\036\024\366\316\364
-\130\020\202\263\012\075\031\301\277\133\253\252\231\330\362\061
-\275\345\070\146\334\130\005\307\355\143\032\056\012\227\174\207
-\223\053\262\212\343\361\354\030\345\165\266\051\207\347\334\213
-\032\176\264\330\311\323\212\027\154\175\051\104\276\212\252\365
-\176\072\056\150\061\223\271\152\332\232\340\333\351\056\245\204
-\315\034\012\270\112\010\371\234\361\141\046\230\223\267\173\146
-\354\221\136\335\121\077\333\163\017\255\004\130\011\335\004\002
-\225\012\076\323\166\337\246\020\036\200\075\350\315\244\144\321
-\063\307\222\307\342\116\104\343\011\311\116\302\135\207\016\022
-\236\277\017\311\005\020\336\172\243\261\074\362\077\245\252\047
-\171\255\061\175\037\375\374\031\151\305\335\271\077\174\315\306
-\264\302\060\036\176\156\222\327\177\141\166\132\217\353\225\115
-\274\021\156\041\174\131\067\231\320\006\274\371\006\155\062\026
-\245\331\151\250\341\334\074\200\036\140\121\334\327\124\041\036
-\312\142\167\117\372\330\217\263\053\072\015\170\162\311\150\101
-\132\107\112\302\243\353\032\327\012\253\074\062\125\310\012\021
-\234\337\164\326\360\100\025\035\310\271\217\265\066\305\257\370
-\042\270\312\035\363\326\266\031\017\237\141\145\152\352\164\310
-\174\217\303\117\135\145\202\037\331\015\211\332\165\162\373\357
-\361\107\147\023\263\310\321\031\210\047\046\232\231\171\177\036
-\344\054\077\173\356\361\336\115\213\226\227\303\325\077\174\033
-\043\355\244\263\035\026\162\103\113\040\341\131\176\302\350\255
-\046\277\242\367
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-
-# Trust for "Swisscom Root EV CA 2"
-# Issuer: CN=Swisscom Root EV CA 2,OU=Digital Certificate Services,O=Swisscom,C=ch
-# Serial Number:00:f2:fa:64:e2:74:63:d3:8d:fd:10:1d:04:1f:76:ca:58
-# Subject: CN=Swisscom Root EV CA 2,OU=Digital Certificate Services,O=Swisscom,C=ch
-# Not Valid Before: Fri Jun 24 09:45:08 2011
-# Not Valid After : Wed Jun 25 08:45:08 2031
-# Fingerprint (MD5): 7B:30:34:9F:DD:0A:4B:6B:35:CA:31:51:28:5D:AE:EC
-# Fingerprint (SHA1): E7:A1:90:29:D3:D5:52:DC:0D:0F:C6:92:D3:EA:88:0D:15:2E:1A:6B
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Swisscom Root EV CA 2"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\347\241\220\051\323\325\122\334\015\017\306\222\323\352\210\015
-\025\056\032\153
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\173\060\064\237\335\012\113\153\065\312\061\121\050\135\256\354
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\147\061\013\060\011\006\003\125\004\006\023\002\143\150\061
-\021\060\017\006\003\125\004\012\023\010\123\167\151\163\163\143
-\157\155\061\045\060\043\006\003\125\004\013\023\034\104\151\147
-\151\164\141\154\040\103\145\162\164\151\146\151\143\141\164\145
-\040\123\145\162\166\151\143\145\163\061\036\060\034\006\003\125
-\004\003\023\025\123\167\151\163\163\143\157\155\040\122\157\157
-\164\040\105\126\040\103\101\040\062
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\021\000\362\372\144\342\164\143\323\215\375\020\035\004\037
-\166\312\130
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -20798,7 +18996,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -20961,7 +19159,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -21160,7 +19358,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -21321,7 +19519,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -21672,7 +19870,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -21944,7 +20142,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -22106,7 +20304,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -22268,7 +20466,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -22430,7 +20628,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -22569,7 +20767,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -22687,7 +20885,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -22826,7 +21024,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -22944,7 +21142,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -23115,7 +21313,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -23281,7 +21479,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -23442,7 +21640,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -23623,7 +21821,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -23805,7 +22003,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -23934,7 +22132,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -24043,7 +22241,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -24156,7 +22354,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -25305,7 +23503,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -25450,7 +23648,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -25920,7 +24118,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -26227,7 +24425,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -26361,7 +24559,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
@@ -26469,7 +24667,7 @@ CKA_SERIAL_NUMBER MULTILINE_OCTAL
 END
 CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
 CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
 CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
 
 #
diff --git a/security/nss/lib/ckfw/builtins/nssckbi.h b/security/nss/lib/ckfw/builtins/nssckbi.h
index 6e7aa2b61..498751d13 100644
--- a/security/nss/lib/ckfw/builtins/nssckbi.h
+++ b/security/nss/lib/ckfw/builtins/nssckbi.h
@@ -46,8 +46,8 @@
  * It's recommend to switch back to 0 after having reached version 98/99.
  */
 #define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 2
-#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 14
-#define NSS_BUILTINS_LIBRARY_VERSION "2.14"
+#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 16
+#define NSS_BUILTINS_LIBRARY_VERSION "2.16"
 
 /* These version numbers detail the semantic changes to the ckfw engine. */
 #define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1
diff --git a/security/nss/lib/freebl/Makefile b/security/nss/lib/freebl/Makefile
index aa02f4be3..914a0119c 100644
--- a/security/nss/lib/freebl/Makefile
+++ b/security/nss/lib/freebl/Makefile
@@ -110,6 +110,7 @@ endif
 # NSS_X86_OR_X64 means the target is either x86 or x64
 ifeq (,$(filter-out i386 x386 x86 x86_64,$(CPU_ARCH)))
         DEFINES += -DNSS_X86_OR_X64
+        CFLAGS += -mpclmul -maes
 ifneq (,$(USE_64)$(USE_X32))
         DEFINES += -DNSS_X64
 else
diff --git a/security/nss/lib/freebl/aeskeywrap.c b/security/nss/lib/freebl/aeskeywrap.c
index 79ff8a852..ee909dbd0 100644
--- a/security/nss/lib/freebl/aeskeywrap.c
+++ b/security/nss/lib/freebl/aeskeywrap.c
@@ -22,8 +22,9 @@
 #include "rijndael.h"
 
 struct AESKeyWrapContextStr {
-    unsigned char iv[AES_KEY_WRAP_IV_BYTES];
     AESContext aescx;
+    unsigned char iv[AES_KEY_WRAP_IV_BYTES];
+    void *mem; /* Pointer to beginning of allocated memory. */
 };
 
 /******************************************/
@@ -34,8 +35,14 @@ struct AESKeyWrapContextStr {
 AESKeyWrapContext *
 AESKeyWrap_AllocateContext(void)
 {
-    AESKeyWrapContext *cx = PORT_New(AESKeyWrapContext);
-    return cx;
+    /* aligned_alloc is C11 so we have to do it the old way. */
+    AESKeyWrapContext *ctx = PORT_ZAlloc(sizeof(AESKeyWrapContext) + 15);
+    if (ctx == NULL) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+    ctx->mem = ctx;
+    return (AESKeyWrapContext *)(((uintptr_t)ctx + 15) & ~(uintptr_t)0x0F);
 }
 
 SECStatus
@@ -77,7 +84,7 @@ AESKeyWrap_CreateContext(const unsigned char *key, const unsigned char *iv,
         return NULL; /* error is already set */
     rv = AESKeyWrap_InitContext(cx, key, keylen, iv, 0, encrypt, 0);
     if (rv != SECSuccess) {
-        PORT_Free(cx);
+        PORT_Free(cx->mem);
         cx = NULL; /* error should already be set */
     }
     return cx;
@@ -94,8 +101,9 @@ AESKeyWrap_DestroyContext(AESKeyWrapContext *cx, PRBool freeit)
     if (cx) {
         AES_DestroyContext(&cx->aescx, PR_FALSE);
         /*  memset(cx, 0, sizeof *cx); */
-        if (freeit)
-            PORT_Free(cx);
+        if (freeit) {
+            PORT_Free(cx->mem);
+        }
     }
 }
 
diff --git a/security/nss/lib/freebl/blapi.h b/security/nss/lib/freebl/blapi.h
index 592624bdf..31e471ac4 100644
--- a/security/nss/lib/freebl/blapi.h
+++ b/security/nss/lib/freebl/blapi.h
@@ -801,8 +801,7 @@ SEED_Decrypt(SEEDContext *cx, unsigned char *output,
 ** Create a new AES context suitable for AES encryption/decryption.
 **  "key" raw key data
 **  "keylen" the number of bytes of key data (16, 24, or 32)
-**      "blocklen" is the blocksize to use (16, 24, or 32)
-**                        XXX currently only blocksize==16 has been tested!
+**  "blocklen" is the blocksize to use. NOTE: only 16 is supported!
 */
 extern AESContext *
 AES_CreateContext(const unsigned char *key, const unsigned char *iv,
diff --git a/security/nss/lib/freebl/blapii.h b/security/nss/lib/freebl/blapii.h
index 0087c7899..b1be7bedf 100644
--- a/security/nss/lib/freebl/blapii.h
+++ b/security/nss/lib/freebl/blapii.h
@@ -51,6 +51,18 @@ SEC_END_PROTOS
 #define HAVE_NO_SANITIZE_ATTR 0
 #endif
 
+/* Alignment helpers. */
+#if defined(_WINDOWS) && defined(NSS_X86_OR_X64)
+#define pre_align __declspec(align(16))
+#define post_align
+#elif defined(NSS_X86_OR_X64)
+#define pre_align
+#define post_align __attribute__((aligned(16)))
+#else
+#define pre_align
+#define post_align
+#endif
+
 #if defined(HAVE_UNALIGNED_ACCESS) && HAVE_NO_SANITIZE_ATTR
 #define NO_SANITIZE_ALIGNMENT __attribute__((no_sanitize("alignment")))
 #else
diff --git a/security/nss/lib/freebl/ctr.c b/security/nss/lib/freebl/ctr.c
index d5715a505..b7167d4c4 100644
--- a/security/nss/lib/freebl/ctr.c
+++ b/security/nss/lib/freebl/ctr.c
@@ -19,30 +19,30 @@
 
 SECStatus
 CTR_InitContext(CTRContext *ctr, void *context, freeblCipherFunc cipher,
-                const unsigned char *param, unsigned int blocksize)
+                const unsigned char *param)
 {
     const CK_AES_CTR_PARAMS *ctrParams = (const CK_AES_CTR_PARAMS *)param;
 
     if (ctrParams->ulCounterBits == 0 ||
-        ctrParams->ulCounterBits > blocksize * PR_BITS_PER_BYTE) {
+        ctrParams->ulCounterBits > AES_BLOCK_SIZE * PR_BITS_PER_BYTE) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
 
-    /* Invariant: 0 < ctr->bufPtr <= blocksize */
+    /* Invariant: 0 < ctr->bufPtr <= AES_BLOCK_SIZE */
     ctr->checkWrap = PR_FALSE;
-    ctr->bufPtr = blocksize; /* no unused data in the buffer */
+    ctr->bufPtr = AES_BLOCK_SIZE; /* no unused data in the buffer */
     ctr->cipher = cipher;
     ctr->context = context;
     ctr->counterBits = ctrParams->ulCounterBits;
-    if (blocksize > sizeof(ctr->counter) ||
-        blocksize > sizeof(ctrParams->cb)) {
+    if (AES_BLOCK_SIZE > sizeof(ctr->counter) ||
+        AES_BLOCK_SIZE > sizeof(ctrParams->cb)) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
     }
-    PORT_Memcpy(ctr->counter, ctrParams->cb, blocksize);
+    PORT_Memcpy(ctr->counter, ctrParams->cb, AES_BLOCK_SIZE);
     if (ctr->counterBits < 64) {
-        PORT_Memcpy(ctr->counterFirst, ctr->counter, blocksize);
+        PORT_Memcpy(ctr->counterFirst, ctr->counter, AES_BLOCK_SIZE);
         ctr->checkWrap = PR_TRUE;
     }
     return SECSuccess;
@@ -50,7 +50,7 @@ CTR_InitContext(CTRContext *ctr, void *context, freeblCipherFunc cipher,
 
 CTRContext *
 CTR_CreateContext(void *context, freeblCipherFunc cipher,
-                  const unsigned char *param, unsigned int blocksize)
+                  const unsigned char *param)
 {
     CTRContext *ctr;
     SECStatus rv;
@@ -60,7 +60,7 @@ CTR_CreateContext(void *context, freeblCipherFunc cipher,
     if (ctr == NULL) {
         return NULL;
     }
-    rv = CTR_InitContext(ctr, context, cipher, param, blocksize);
+    rv = CTR_InitContext(ctr, context, cipher, param);
     if (rv != SECSuccess) {
         CTR_DestroyContext(ctr, PR_TRUE);
         ctr = NULL;
diff --git a/security/nss/lib/freebl/ctr.h b/security/nss/lib/freebl/ctr.h
index a97da144e..a397e690e 100644
--- a/security/nss/lib/freebl/ctr.h
+++ b/security/nss/lib/freebl/ctr.h
@@ -23,8 +23,7 @@ struct CTRContextStr {
 typedef struct CTRContextStr CTRContext;
 
 SECStatus CTR_InitContext(CTRContext *ctr, void *context,
-                          freeblCipherFunc cipher, const unsigned char *param,
-                          unsigned int blocksize);
+                          freeblCipherFunc cipher, const unsigned char *param);
 
 /*
  * The context argument is the inner cipher context to use with cipher. The
@@ -34,7 +33,7 @@ SECStatus CTR_InitContext(CTRContext *ctr, void *context,
  * The cipher argument is a block cipher in the ECB encrypt mode.
  */
 CTRContext *CTR_CreateContext(void *context, freeblCipherFunc cipher,
-                              const unsigned char *param, unsigned int blocksize);
+                              const unsigned char *param);
 
 void CTR_DestroyContext(CTRContext *ctr, PRBool freeit);
 
diff --git a/security/nss/lib/freebl/cts.c b/security/nss/lib/freebl/cts.c
index 99ccebb60..774294b7a 100644
--- a/security/nss/lib/freebl/cts.c
+++ b/security/nss/lib/freebl/cts.c
@@ -20,19 +20,15 @@ struct CTSContextStr {
 
 CTSContext *
 CTS_CreateContext(void *context, freeblCipherFunc cipher,
-                  const unsigned char *iv, unsigned int blocksize)
+                  const unsigned char *iv)
 {
     CTSContext *cts;
 
-    if (blocksize > MAX_BLOCK_SIZE) {
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-        return NULL;
-    }
     cts = PORT_ZNew(CTSContext);
     if (cts == NULL) {
         return NULL;
     }
-    PORT_Memcpy(cts->iv, iv, blocksize);
+    PORT_Memcpy(cts->iv, iv, MAX_BLOCK_SIZE);
     cts->cipher = cipher;
     cts->context = context;
     return cts;
diff --git a/security/nss/lib/freebl/cts.h b/security/nss/lib/freebl/cts.h
index a3ec180af..ddd56197f 100644
--- a/security/nss/lib/freebl/cts.h
+++ b/security/nss/lib/freebl/cts.h
@@ -17,7 +17,7 @@ typedef struct CTSContextStr CTSContext;
  * The cipher argument is a block cipher in the CBC mode.
  */
 CTSContext *CTS_CreateContext(void *context, freeblCipherFunc cipher,
-                              const unsigned char *iv, unsigned int blocksize);
+                              const unsigned char *iv);
 
 void CTS_DestroyContext(CTSContext *cts, PRBool freeit);
 
diff --git a/security/nss/lib/freebl/dh.c b/security/nss/lib/freebl/dh.c
index 587982a97..6f2bafda2 100644
--- a/security/nss/lib/freebl/dh.c
+++ b/security/nss/lib/freebl/dh.c
@@ -85,6 +85,11 @@ DH_GenParam(int primeLen, DHParams **params)
     CHECK_MPI_OK(mp_div_2(&psub1, &q));
     /* construct a generator from the prime. */
     ab = PORT_Alloc(primeLen);
+    if (!ab) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        rv = SECFailure;
+        goto cleanup;
+    }
     /* generate a candidate number a in p's field */
     CHECK_SEC_OK(RNG_GenerateGlobalRandomBytes(ab, primeLen));
     CHECK_MPI_OK(mp_read_unsigned_octets(&a, ab, primeLen));
@@ -114,14 +119,16 @@ cleanup:
     mp_clear(&h);
     mp_clear(&psub1);
     mp_clear(&test);
-    if (ab)
+    if (ab) {
         PORT_ZFree(ab, primeLen);
+    }
     if (err) {
         MP_TO_SEC_ERROR(err);
         rv = SECFailure;
     }
-    if (rv)
+    if (rv != SECSuccess) {
         PORT_FreeArena(arena, PR_TRUE);
+    }
     return rv;
 }
 
diff --git a/security/nss/lib/freebl/fipsfreebl.c b/security/nss/lib/freebl/fipsfreebl.c
index b3ae6865b..094513560 100644
--- a/security/nss/lib/freebl/fipsfreebl.c
+++ b/security/nss/lib/freebl/fipsfreebl.c
@@ -1707,7 +1707,7 @@ BL_FIPSEntryOK(PRBool freebl_only)
         return SECSuccess;
     }
     /* standalone freebl can initialize */
-    if (freebl_only & self_tests_freebl_success) {
+    if (freebl_only && self_tests_freebl_success) {
         return SECSuccess;
     }
     PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
diff --git a/security/nss/lib/freebl/freebl.gyp b/security/nss/lib/freebl/freebl.gyp
index f75474252..8c0d0dcd5 100644
--- a/security/nss/lib/freebl/freebl.gyp
+++ b/security/nss/lib/freebl/freebl.gyp
@@ -153,6 +153,22 @@
       'MP_API_COMPATIBLE'
     ],
     'conditions': [
+      [ 'target_arch=="ia32" or target_arch=="x64"', {
+        'cflags_mozilla': [
+          '-mpclmul',
+          '-maes',
+        ],
+      }],
+      [ 'OS=="mac"', {
+        'xcode_settings': {
+          # I'm not sure since when this is supported.
+          # But I hope that doesn't matter. We also assume this is x86/x64.
+          'OTHER_CFLAGS': [
+            '-mpclmul',
+            '-maes',
+          ],
+        },
+      }],
       [ 'OS=="win" and target_arch=="ia32"', {
         'msvs_settings': {
           'VCCLCompilerTool': {
@@ -243,6 +259,14 @@
               'MP_USE_UINT_DIGIT',
             ],
           }],
+          [ 'target_arch=="ia32" or target_arch=="x64"', {
+            'cflags': [
+              # enable isa option for pclmul am aes-ni; supported since gcc 4.4
+              # This is only support by x84/x64. It's not needed for Windows.
+              '-mpclmul',
+              '-maes',
+            ],
+          }],
           [ 'target_arch=="arm"', {
             'defines': [
               'MP_ASSEMBLY_MULTIPLY',
diff --git a/security/nss/lib/freebl/gcm.c b/security/nss/lib/freebl/gcm.c
index 22121001b..0fdb0fd48 100644
--- a/security/nss/lib/freebl/gcm.c
+++ b/security/nss/lib/freebl/gcm.c
@@ -1,6 +1,8 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* Thanks to Thomas Pornin for the ideas how to implement the constat time
+ * binary multiplication. */
 
 #ifdef FREEBL_NO_DEPEND
 #include "stubs.h"
@@ -15,440 +17,378 @@
 
 #include <limits.h>
 
-/**************************************************************************
- *          First implement the Galois hash function of GCM (gcmHash)     *
- **************************************************************************/
-#define GCM_HASH_LEN_LEN 8 /* gcm hash defines lengths to be 64 bits */
-
-typedef struct gcmHashContextStr gcmHashContext;
-
-static SECStatus gcmHash_InitContext(gcmHashContext *hash,
-                                     const unsigned char *H,
-                                     unsigned int blocksize);
-static void gcmHash_DestroyContext(gcmHashContext *ghash, PRBool freeit);
-static SECStatus gcmHash_Update(gcmHashContext *ghash,
-                                const unsigned char *buf, unsigned int len,
-                                unsigned int blocksize);
-static SECStatus gcmHash_Sync(gcmHashContext *ghash, unsigned int blocksize);
-static SECStatus gcmHash_Final(gcmHashContext *gcm, unsigned char *outbuf,
-                               unsigned int *outlen, unsigned int maxout,
-                               unsigned int blocksize);
-static SECStatus gcmHash_Reset(gcmHashContext *ghash,
-                               const unsigned char *inbuf,
-                               unsigned int inbufLen, unsigned int blocksize);
-
-/* compile time defines to select how the GF2 multiply is calculated.
- * There are currently 2 algorithms implemented here: MPI and ALGORITHM_1.
- *
- * MPI uses the GF2m implemented in mpi to support GF2 ECC.
- * ALGORITHM_1 is the Algorithm 1 in both NIST SP 800-38D and
- * "The Galois/Counter Mode of Operation (GCM)", McGrew & Viega.
- */
-#if !defined(GCM_USE_ALGORITHM_1) && !defined(GCM_USE_MPI)
-#define GCM_USE_MPI 1 /* MPI is about 5x faster with the               \
-                       * same or less complexity. It's possible to use \
-                       * tables to speed things up even more */
-#endif
-
-/* GCM defines the bit string to be LSB first, which is exactly
- * opposite everyone else, including hardware. build array
- * to reverse everything. */
-static const unsigned char gcm_byte_rev[256] = {
-    0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0,
-    0x10, 0x90, 0x50, 0xd0, 0x30, 0xb0, 0x70, 0xf0,
-    0x08, 0x88, 0x48, 0xc8, 0x28, 0xa8, 0x68, 0xe8,
-    0x18, 0x98, 0x58, 0xd8, 0x38, 0xb8, 0x78, 0xf8,
-    0x04, 0x84, 0x44, 0xc4, 0x24, 0xa4, 0x64, 0xe4,
-    0x14, 0x94, 0x54, 0xd4, 0x34, 0xb4, 0x74, 0xf4,
-    0x0c, 0x8c, 0x4c, 0xcc, 0x2c, 0xac, 0x6c, 0xec,
-    0x1c, 0x9c, 0x5c, 0xdc, 0x3c, 0xbc, 0x7c, 0xfc,
-    0x02, 0x82, 0x42, 0xc2, 0x22, 0xa2, 0x62, 0xe2,
-    0x12, 0x92, 0x52, 0xd2, 0x32, 0xb2, 0x72, 0xf2,
-    0x0a, 0x8a, 0x4a, 0xca, 0x2a, 0xaa, 0x6a, 0xea,
-    0x1a, 0x9a, 0x5a, 0xda, 0x3a, 0xba, 0x7a, 0xfa,
-    0x06, 0x86, 0x46, 0xc6, 0x26, 0xa6, 0x66, 0xe6,
-    0x16, 0x96, 0x56, 0xd6, 0x36, 0xb6, 0x76, 0xf6,
-    0x0e, 0x8e, 0x4e, 0xce, 0x2e, 0xae, 0x6e, 0xee,
-    0x1e, 0x9e, 0x5e, 0xde, 0x3e, 0xbe, 0x7e, 0xfe,
-    0x01, 0x81, 0x41, 0xc1, 0x21, 0xa1, 0x61, 0xe1,
-    0x11, 0x91, 0x51, 0xd1, 0x31, 0xb1, 0x71, 0xf1,
-    0x09, 0x89, 0x49, 0xc9, 0x29, 0xa9, 0x69, 0xe9,
-    0x19, 0x99, 0x59, 0xd9, 0x39, 0xb9, 0x79, 0xf9,
-    0x05, 0x85, 0x45, 0xc5, 0x25, 0xa5, 0x65, 0xe5,
-    0x15, 0x95, 0x55, 0xd5, 0x35, 0xb5, 0x75, 0xf5,
-    0x0d, 0x8d, 0x4d, 0xcd, 0x2d, 0xad, 0x6d, 0xed,
-    0x1d, 0x9d, 0x5d, 0xdd, 0x3d, 0xbd, 0x7d, 0xfd,
-    0x03, 0x83, 0x43, 0xc3, 0x23, 0xa3, 0x63, 0xe3,
-    0x13, 0x93, 0x53, 0xd3, 0x33, 0xb3, 0x73, 0xf3,
-    0x0b, 0x8b, 0x4b, 0xcb, 0x2b, 0xab, 0x6b, 0xeb,
-    0x1b, 0x9b, 0x5b, 0xdb, 0x3b, 0xbb, 0x7b, 0xfb,
-    0x07, 0x87, 0x47, 0xc7, 0x27, 0xa7, 0x67, 0xe7,
-    0x17, 0x97, 0x57, 0xd7, 0x37, 0xb7, 0x77, 0xf7,
-    0x0f, 0x8f, 0x4f, 0xcf, 0x2f, 0xaf, 0x6f, 0xef,
-    0x1f, 0x9f, 0x5f, 0xdf, 0x3f, 0xbf, 0x7f, 0xff
-};
-
-#ifdef GCM_TRACE
-#include <stdio.h>
-
-#define GCM_TRACE_X(ghash, label)         \
-    {                                     \
-        unsigned char _X[MAX_BLOCK_SIZE]; \
-        int i;                            \
-        gcm_getX(ghash, _X, blocksize);   \
-        printf(label, (ghash)->m);        \
-        for (i = 0; i < blocksize; i++)   \
-            printf("%02x", _X[i]);        \
-        printf("\n");                     \
-    }
-#define GCM_TRACE_BLOCK(label, buf, blocksize) \
-    {                                          \
-        printf(label);                         \
-        for (i = 0; i < blocksize; i++)        \
-            printf("%02x", buf[i]);            \
-        printf("\n");                          \
-    }
-#else
-#define GCM_TRACE_X(ghash, label)
-#define GCM_TRACE_BLOCK(label, buf, blocksize)
+#ifdef NSS_X86_OR_X64
+#include <wmmintrin.h> /* clmul */
 #endif
 
-#ifdef GCM_USE_MPI
+/* Forward declarations */
+SECStatus gcm_HashMult_hw(gcmHashContext *ghash, const unsigned char *buf,
+                          unsigned int count);
+SECStatus gcm_HashMult_sftw(gcmHashContext *ghash, const unsigned char *buf,
+                            unsigned int count);
+SECStatus gcm_HashMult_sftw32(gcmHashContext *ghash, const unsigned char *buf,
+                              unsigned int count);
 
-#ifdef GCM_USE_ALGORITHM_1
-#error "Only define one of GCM_USE_MPI, GCM_USE_ALGORITHM_1"
-#endif
-/* use the MPI functions to calculate Xn = (Xn-1^C_i)*H mod poly */
-#include "mpi.h"
-#include "secmpi.h"
-#include "mplogic.h"
-#include "mp_gf2m.h"
-
-/* state needed to handle GCM Hash function */
-struct gcmHashContextStr {
-    mp_int H;
-    mp_int X;
-    mp_int C_i;
-    const unsigned int *poly;
-    unsigned char buffer[MAX_BLOCK_SIZE];
-    unsigned int bufLen;
-    int m; /* XXX what is m? */
-    unsigned char counterBuf[2 * GCM_HASH_LEN_LEN];
-    PRUint64 cLen;
-};
-
-/* f = x^128 + x^7 + x^2 + x + 1 */
-static const unsigned int poly_128[] = { 128, 7, 2, 1, 0 };
-
-/* sigh, GCM defines the bit strings exactly backwards from everything else */
-static void
-gcm_reverse(unsigned char *target, const unsigned char *src,
-            unsigned int blocksize)
+uint64_t
+get64(const unsigned char *bytes)
 {
-    unsigned int i;
-    for (i = 0; i < blocksize; i++) {
-        target[blocksize - i - 1] = gcm_byte_rev[src[i]];
-    }
+    return ((uint64_t)bytes[0]) << 56 |
+           ((uint64_t)bytes[1]) << 48 |
+           ((uint64_t)bytes[2]) << 40 |
+           ((uint64_t)bytes[3]) << 32 |
+           ((uint64_t)bytes[4]) << 24 |
+           ((uint64_t)bytes[5]) << 16 |
+           ((uint64_t)bytes[6]) << 8 |
+           ((uint64_t)bytes[7]);
 }
 
 /* Initialize a gcmHashContext */
-static SECStatus
-gcmHash_InitContext(gcmHashContext *ghash, const unsigned char *H,
-                    unsigned int blocksize)
+SECStatus
+gcmHash_InitContext(gcmHashContext *ghash, const unsigned char *H, PRBool sw)
 {
-    mp_err err = MP_OKAY;
-    unsigned char H_rev[MAX_BLOCK_SIZE];
-
-    MP_DIGITS(&ghash->H) = 0;
-    MP_DIGITS(&ghash->X) = 0;
-    MP_DIGITS(&ghash->C_i) = 0;
-    CHECK_MPI_OK(mp_init(&ghash->H));
-    CHECK_MPI_OK(mp_init(&ghash->X));
-    CHECK_MPI_OK(mp_init(&ghash->C_i));
-
-    mp_zero(&ghash->X);
-    gcm_reverse(H_rev, H, blocksize);
-    CHECK_MPI_OK(mp_read_unsigned_octets(&ghash->H, H_rev, blocksize));
-
-    /* set the irreducible polynomial. Each blocksize has its own polynomial.
-     * for now only blocksize 16 (=128 bits) is defined */
-    switch (blocksize) {
-        case 16: /* 128 bits */
-            ghash->poly = poly_128;
-            break;
-        default:
-            PORT_SetError(SEC_ERROR_INVALID_ARGS);
-            goto cleanup;
-    }
     ghash->cLen = 0;
     ghash->bufLen = 0;
-    ghash->m = 0;
     PORT_Memset(ghash->counterBuf, 0, sizeof(ghash->counterBuf));
-    return SECSuccess;
-cleanup:
-    gcmHash_DestroyContext(ghash, PR_FALSE);
-    return SECFailure;
-}
 
-/* Destroy a HashContext (Note we zero the digits so this function
- * is idempotent if called with freeit == PR_FALSE */
-static void
-gcmHash_DestroyContext(gcmHashContext *ghash, PRBool freeit)
-{
-    mp_clear(&ghash->H);
-    mp_clear(&ghash->X);
-    mp_clear(&ghash->C_i);
-    PORT_Memset(ghash, 0, sizeof(gcmHashContext));
-    if (freeit) {
-        PORT_Free(ghash);
-    }
-}
-
-static SECStatus
-gcm_getX(gcmHashContext *ghash, unsigned char *T, unsigned int blocksize)
-{
-    int len;
-    mp_err err;
-    unsigned char tmp_buf[MAX_BLOCK_SIZE];
-    unsigned char *X;
-
-    len = mp_unsigned_octet_size(&ghash->X);
-    if (len <= 0) {
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-        return SECFailure;
-    }
-    X = tmp_buf;
-    PORT_Assert((unsigned int)len <= blocksize);
-    if ((unsigned int)len > blocksize) {
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-        return SECFailure;
-    }
-    /* zero pad the result */
-    if (len != blocksize) {
-        PORT_Memset(X, 0, blocksize - len);
-        X += blocksize - len;
-    }
-
-    err = mp_to_unsigned_octets(&ghash->X, X, len);
-    if (err < 0) {
+    ghash->h_low = get64(H + 8);
+    ghash->h_high = get64(H);
+    if (clmul_support() && !sw) {
+#ifdef NSS_X86_OR_X64
+        ghash->ghash_mul = gcm_HashMult_hw;
+        ghash->x = _mm_setzero_si128();
+        /* MSVC requires __m64 to load epi64. */
+        ghash->h = _mm_set_epi32(ghash->h_high >> 32, (uint32_t)ghash->h_high,
+                                 ghash->h_low >> 32, (uint32_t)ghash->h_low);
+        ghash->hw = PR_TRUE;
+#else
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
+#endif /* NSS_X86_OR_X64 */
+    } else {
+/* We fall back to the software implementation if we can't use / don't
+         * want to use pclmul. */
+#ifdef HAVE_INT128_SUPPORT
+        ghash->ghash_mul = gcm_HashMult_sftw;
+#else
+        ghash->ghash_mul = gcm_HashMult_sftw32;
+#endif
+        ghash->x_high = ghash->x_low = 0;
+        ghash->hw = PR_FALSE;
     }
-    gcm_reverse(T, tmp_buf, blocksize);
     return SECSuccess;
 }
 
-static SECStatus
-gcm_HashMult(gcmHashContext *ghash, const unsigned char *buf,
-             unsigned int count, unsigned int blocksize)
-{
-    SECStatus rv = SECFailure;
-    mp_err err = MP_OKAY;
-    unsigned char tmp_buf[MAX_BLOCK_SIZE];
-    unsigned int i;
-
-    for (i = 0; i < count; i++, buf += blocksize) {
-        ghash->m++;
-        gcm_reverse(tmp_buf, buf, blocksize);
-        CHECK_MPI_OK(mp_read_unsigned_octets(&ghash->C_i, tmp_buf, blocksize));
-        CHECK_MPI_OK(mp_badd(&ghash->X, &ghash->C_i, &ghash->C_i));
-        /*
-         * Looking to speed up GCM, this the the place to do it.
-         * There are two areas that can be exploited to speed up this code.
-         *
-         * 1) H is a constant in this multiply. We can precompute H * (0 - 255)
-         * at init time and this becomes an blockize xors of our table lookup.
-         *
-         * 2) poly is a constant for each blocksize. We can calculate the
-         * modulo reduction by a series of adds and shifts.
-         *
-         * For now we are after functionality, so we will go ahead and use
-         * the builtin bmulmod from mpi
-         */
-        CHECK_MPI_OK(mp_bmulmod(&ghash->C_i, &ghash->H,
-                                ghash->poly, &ghash->X));
-        GCM_TRACE_X(ghash, "X%d = ")
-    }
-    rv = SECSuccess;
-cleanup:
-    PORT_Memset(tmp_buf, 0, sizeof(tmp_buf));
-    if (rv != SECSuccess) {
-        MP_TO_SEC_ERROR(err);
-    }
-    return rv;
-}
-
-static void
-gcm_zeroX(gcmHashContext *ghash)
+#ifdef HAVE_INT128_SUPPORT
+/* Binary multiplication x * y = r_high << 64 | r_low. */
+void
+bmul(uint64_t x, uint64_t y, uint64_t *r_high, uint64_t *r_low)
 {
-    mp_zero(&ghash->X);
-    ghash->m = 0;
+    uint128_t x1, x2, x3, x4, x5;
+    uint128_t y1, y2, y3, y4, y5;
+    uint128_t r, z;
+
+    uint128_t m1 = (uint128_t)0x2108421084210842 << 64 | 0x1084210842108421;
+    uint128_t m2 = (uint128_t)0x4210842108421084 << 64 | 0x2108421084210842;
+    uint128_t m3 = (uint128_t)0x8421084210842108 << 64 | 0x4210842108421084;
+    uint128_t m4 = (uint128_t)0x0842108421084210 << 64 | 0x8421084210842108;
+    uint128_t m5 = (uint128_t)0x1084210842108421 << 64 | 0x0842108421084210;
+
+    x1 = x & m1;
+    y1 = y & m1;
+    x2 = x & m2;
+    y2 = y & m2;
+    x3 = x & m3;
+    y3 = y & m3;
+    x4 = x & m4;
+    y4 = y & m4;
+    x5 = x & m5;
+    y5 = y & m5;
+
+    z = (x1 * y1) ^ (x2 * y5) ^ (x3 * y4) ^ (x4 * y3) ^ (x5 * y2);
+    r = z & m1;
+    z = (x1 * y2) ^ (x2 * y1) ^ (x3 * y5) ^ (x4 * y4) ^ (x5 * y3);
+    r |= z & m2;
+    z = (x1 * y3) ^ (x2 * y2) ^ (x3 * y1) ^ (x4 * y5) ^ (x5 * y4);
+    r |= z & m3;
+    z = (x1 * y4) ^ (x2 * y3) ^ (x3 * y2) ^ (x4 * y1) ^ (x5 * y5);
+    r |= z & m4;
+    z = (x1 * y5) ^ (x2 * y4) ^ (x3 * y3) ^ (x4 * y2) ^ (x5 * y1);
+    r |= z & m5;
+
+    *r_high = (uint64_t)(r >> 64);
+    *r_low = (uint64_t)r;
 }
 
-#endif
-
-#ifdef GCM_USE_ALGORITHM_1
-/* use algorithm 1 of McGrew & Viega "The Galois/Counter Mode of Operation" */
-
-#define GCM_ARRAY_SIZE (MAX_BLOCK_SIZE / sizeof(unsigned long))
-
-struct gcmHashContextStr {
-    unsigned long H[GCM_ARRAY_SIZE];
-    unsigned long X[GCM_ARRAY_SIZE];
-    unsigned long R;
-    unsigned char buffer[MAX_BLOCK_SIZE];
-    unsigned int bufLen;
-    int m;
-    unsigned char counterBuf[2 * GCM_HASH_LEN_LEN];
-    PRUint64 cLen;
-};
-
-static void
-gcm_bytes_to_longs(unsigned long *l, const unsigned char *c, unsigned int len)
+SECStatus
+gcm_HashMult_sftw(gcmHashContext *ghash, const unsigned char *buf,
+                  unsigned int count)
 {
-    int i, j;
-    int array_size = len / sizeof(unsigned long);
-
-    PORT_Assert(len % sizeof(unsigned long) == 0);
-    for (i = 0; i < array_size; i++) {
-        unsigned long tmp = 0;
-        int byte_offset = i * sizeof(unsigned long);
-        for (j = sizeof(unsigned long) - 1; j >= 0; j--) {
-            tmp = (tmp << PR_BITS_PER_BYTE) | gcm_byte_rev[c[byte_offset + j]];
-        }
-        l[i] = tmp;
-    }
+    uint64_t ci_low, ci_high;
+    size_t i;
+    uint64_t z2_low, z2_high, z0_low, z0_high, z1a_low, z1a_high;
+    uint128_t z_high = 0, z_low = 0;
+
+    ci_low = ghash->x_low;
+    ci_high = ghash->x_high;
+    for (i = 0; i < count; i++, buf += 16) {
+        ci_low ^= get64(buf + 8);
+        ci_high ^= get64(buf);
+
+        /* Do binary mult ghash->X = C * ghash->H (Karatsuba). */
+        bmul(ci_high, ghash->h_high, &z2_high, &z2_low);
+        bmul(ci_low, ghash->h_low, &z0_high, &z0_low);
+        bmul(ci_high ^ ci_low, ghash->h_high ^ ghash->h_low, &z1a_high, &z1a_low);
+        z1a_high ^= z2_high ^ z0_high;
+        z1a_low ^= z2_low ^ z0_low;
+        z_high = ((uint128_t)z2_high << 64) | (z2_low ^ z1a_high);
+        z_low = (((uint128_t)z0_high << 64) | z0_low) ^ (((uint128_t)z1a_low) << 64);
+
+        /* Shift one (multiply by x) as gcm spec is stupid. */
+        z_high = (z_high << 1) | (z_low >> 127);
+        z_low <<= 1;
+
+        /* Reduce */
+        z_low ^= (z_low << 127) ^ (z_low << 126) ^ (z_low << 121);
+        z_high ^= z_low ^ (z_low >> 1) ^ (z_low >> 2) ^ (z_low >> 7);
+        ci_low = (uint64_t)z_high;
+        ci_high = (uint64_t)(z_high >> 64);
+    }
+    ghash->x_low = ci_low;
+    ghash->x_high = ci_high;
+    return SECSuccess;
 }
-
-static void
-gcm_longs_to_bytes(const unsigned long *l, unsigned char *c, unsigned int len)
+#else
+/* Binary multiplication x * y = r_high << 32 | r_low. */
+void
+bmul32(uint32_t x, uint32_t y, uint32_t *r_high, uint32_t *r_low)
 {
-    int i, j;
-    int array_size = len / sizeof(unsigned long);
-
-    PORT_Assert(len % sizeof(unsigned long) == 0);
-    for (i = 0; i < array_size; i++) {
-        unsigned long tmp = l[i];
-        int byte_offset = i * sizeof(unsigned long);
-        for (j = 0; j < sizeof(unsigned long); j++) {
-            c[byte_offset + j] = gcm_byte_rev[tmp & 0xff];
-            tmp = (tmp >> PR_BITS_PER_BYTE);
-        }
-    }
+    uint32_t x0, x1, x2, x3;
+    uint32_t y0, y1, y2, y3;
+    uint32_t m1 = (uint32_t)0x11111111;
+    uint32_t m2 = (uint32_t)0x22222222;
+    uint32_t m4 = (uint32_t)0x44444444;
+    uint32_t m8 = (uint32_t)0x88888888;
+    uint64_t z0, z1, z2, z3;
+    uint64_t z;
+
+    x0 = x & m1;
+    x1 = x & m2;
+    x2 = x & m4;
+    x3 = x & m8;
+    y0 = y & m1;
+    y1 = y & m2;
+    y2 = y & m4;
+    y3 = y & m8;
+    z0 = ((uint64_t)x0 * y0) ^ ((uint64_t)x1 * y3) ^
+         ((uint64_t)x2 * y2) ^ ((uint64_t)x3 * y1);
+    z1 = ((uint64_t)x0 * y1) ^ ((uint64_t)x1 * y0) ^
+         ((uint64_t)x2 * y3) ^ ((uint64_t)x3 * y2);
+    z2 = ((uint64_t)x0 * y2) ^ ((uint64_t)x1 * y1) ^
+         ((uint64_t)x2 * y0) ^ ((uint64_t)x3 * y3);
+    z3 = ((uint64_t)x0 * y3) ^ ((uint64_t)x1 * y2) ^
+         ((uint64_t)x2 * y1) ^ ((uint64_t)x3 * y0);
+    z0 &= ((uint64_t)m1 << 32) | m1;
+    z1 &= ((uint64_t)m2 << 32) | m2;
+    z2 &= ((uint64_t)m4 << 32) | m4;
+    z3 &= ((uint64_t)m8 << 32) | m8;
+    z = z0 | z1 | z2 | z3;
+    *r_high = (uint32_t)(z >> 32);
+    *r_low = (uint32_t)z;
 }
 
-/* Initialize a gcmHashContext */
-static SECStatus
-gcmHash_InitContext(gcmHashContext *ghash, const unsigned char *H,
-                    unsigned int blocksize)
+SECStatus
+gcm_HashMult_sftw32(gcmHashContext *ghash, const unsigned char *buf,
+                    unsigned int count)
 {
-    PORT_Memset(ghash->X, 0, sizeof(ghash->X));
-    PORT_Memset(ghash->H, 0, sizeof(ghash->H));
-    gcm_bytes_to_longs(ghash->H, H, blocksize);
-
-    /* set the irreducible polynomial. Each blocksize has its own polynommial
-     * for now only blocksize 16 (=128 bits) is defined */
-    switch (blocksize) {
-        case 16:                            /* 128 bits */
-            ghash->R = (unsigned long)0x87; /* x^7 + x^2 + x +1 */
-            break;
-        default:
-            PORT_SetError(SEC_ERROR_INVALID_ARGS);
-            goto cleanup;
+    size_t i;
+    uint64_t ci_low, ci_high;
+    uint64_t z_high_h, z_high_l, z_low_h, z_low_l;
+    uint32_t ci_high_h, ci_high_l, ci_low_h, ci_low_l;
+    uint32_t b_a_h, b_a_l, a_a_h, a_a_l, b_b_h, b_b_l;
+    uint32_t a_b_h, a_b_l, b_c_h, b_c_l, a_c_h, a_c_l, c_c_h, c_c_l;
+    uint32_t ci_highXlow_h, ci_highXlow_l, c_a_h, c_a_l, c_b_h, c_b_l;
+
+    uint32_t h_high_h = (uint32_t)(ghash->h_high >> 32);
+    uint32_t h_high_l = (uint32_t)ghash->h_high;
+    uint32_t h_low_h = (uint32_t)(ghash->h_low >> 32);
+    uint32_t h_low_l = (uint32_t)ghash->h_low;
+    uint32_t h_highXlow_h = h_high_h ^ h_low_h;
+    uint32_t h_highXlow_l = h_high_l ^ h_low_l;
+    uint32_t h_highX_xored = h_highXlow_h ^ h_highXlow_l;
+
+    for (i = 0; i < count; i++, buf += 16) {
+        ci_low = ghash->x_low ^ get64(buf + 8);
+        ci_high = ghash->x_high ^ get64(buf);
+        ci_low_h = (uint32_t)(ci_low >> 32);
+        ci_low_l = (uint32_t)ci_low;
+        ci_high_h = (uint32_t)(ci_high >> 32);
+        ci_high_l = (uint32_t)ci_high;
+        ci_highXlow_h = ci_high_h ^ ci_low_h;
+        ci_highXlow_l = ci_high_l ^ ci_low_l;
+
+        /* Do binary mult ghash->X = C * ghash->H (recursive Karatsuba). */
+        bmul32(ci_high_h, h_high_h, &a_a_h, &a_a_l);
+        bmul32(ci_high_l, h_high_l, &a_b_h, &a_b_l);
+        bmul32(ci_high_h ^ ci_high_l, h_high_h ^ h_high_l, &a_c_h, &a_c_l);
+        a_c_h ^= a_a_h ^ a_b_h;
+        a_c_l ^= a_a_l ^ a_b_l;
+        a_a_l ^= a_c_h;
+        a_b_h ^= a_c_l;
+        /* ci_high * h_high = a_a_h:a_a_l:a_b_h:a_b_l */
+
+        bmul32(ci_low_h, h_low_h, &b_a_h, &b_a_l);
+        bmul32(ci_low_l, h_low_l, &b_b_h, &b_b_l);
+        bmul32(ci_low_h ^ ci_low_l, h_low_h ^ h_low_l, &b_c_h, &b_c_l);
+        b_c_h ^= b_a_h ^ b_b_h;
+        b_c_l ^= b_a_l ^ b_b_l;
+        b_a_l ^= b_c_h;
+        b_b_h ^= b_c_l;
+        /* ci_low * h_low = b_a_h:b_a_l:b_b_h:b_b_l */
+
+        bmul32(ci_highXlow_h, h_highXlow_h, &c_a_h, &c_a_l);
+        bmul32(ci_highXlow_l, h_highXlow_l, &c_b_h, &c_b_l);
+        bmul32(ci_highXlow_h ^ ci_highXlow_l, h_highX_xored, &c_c_h, &c_c_l);
+        c_c_h ^= c_a_h ^ c_b_h;
+        c_c_l ^= c_a_l ^ c_b_l;
+        c_a_l ^= c_c_h;
+        c_b_h ^= c_c_l;
+        /* (ci_high ^ ci_low) * (h_high ^ h_low) = c_a_h:c_a_l:c_b_h:c_b_l */
+
+        c_a_h ^= b_a_h ^ a_a_h;
+        c_a_l ^= b_a_l ^ a_a_l;
+        c_b_h ^= b_b_h ^ a_b_h;
+        c_b_l ^= b_b_l ^ a_b_l;
+        z_high_h = ((uint64_t)a_a_h << 32) | a_a_l;
+        z_high_l = (((uint64_t)a_b_h << 32) | a_b_l) ^
+                   (((uint64_t)c_a_h << 32) | c_a_l);
+        z_low_h = (((uint64_t)b_a_h << 32) | b_a_l) ^
+                  (((uint64_t)c_b_h << 32) | c_b_l);
+        z_low_l = ((uint64_t)b_b_h << 32) | b_b_l;
+
+        /* Shift one (multiply by x) as gcm spec is stupid. */
+        z_high_h = z_high_h << 1 | z_high_l >> 63;
+        z_high_l = z_high_l << 1 | z_low_h >> 63;
+        z_low_h = z_low_h << 1 | z_low_l >> 63;
+        z_low_l <<= 1;
+
+        /* Reduce */
+        z_low_h ^= (z_low_l << 63) ^ (z_low_l << 62) ^ (z_low_l << 57);
+        z_high_h ^= z_low_h ^ (z_low_h >> 1) ^ (z_low_h >> 2) ^ (z_low_h >> 7);
+        z_high_l ^= z_low_l ^ (z_low_l >> 1) ^ (z_low_l >> 2) ^ (z_low_l >> 7) ^
+                    (z_low_h << 63) ^ (z_low_h << 62) ^ (z_low_h << 57);
+        ghash->x_high = z_high_h;
+        ghash->x_low = z_high_l;
     }
-    ghash->cLen = 0;
-    ghash->bufLen = 0;
-    ghash->m = 0;
-    PORT_Memset(ghash->counterBuf, 0, sizeof(ghash->counterBuf));
     return SECSuccess;
-cleanup:
-    return SECFailure;
-}
-
-/* Destroy a HashContext (Note we zero the digits so this function
- * is idempotent if called with freeit == PR_FALSE */
-static void
-gcmHash_DestroyContext(gcmHashContext *ghash, PRBool freeit)
-{
-    PORT_Memset(ghash, 0, sizeof(gcmHashContext));
-    if (freeit) {
-        PORT_Free(ghash);
-    }
 }
+#endif /* HAVE_INT128_SUPPORT */
 
-static unsigned long
-gcm_shift_one(unsigned long *t, unsigned int count)
+SECStatus
+gcm_HashMult_hw(gcmHashContext *ghash, const unsigned char *buf,
+                unsigned int count)
 {
-    unsigned long carry = 0;
-    unsigned long nextcarry = 0;
-    unsigned int i;
-    for (i = 0; i < count; i++) {
-        nextcarry = t[i] >> ((sizeof(unsigned long) * PR_BITS_PER_BYTE) - 1);
-        t[i] = (t[i] << 1) | carry;
-        carry = nextcarry;
+#ifdef NSS_X86_OR_X64
+    size_t i;
+    pre_align __m128i z_high post_align;
+    pre_align __m128i z_low post_align;
+    pre_align __m128i C post_align;
+    pre_align __m128i D post_align;
+    pre_align __m128i E post_align;
+    pre_align __m128i F post_align;
+    pre_align __m128i bin post_align;
+    pre_align __m128i Ci post_align;
+    pre_align __m128i tmp post_align;
+
+    for (i = 0; i < count; i++, buf += 16) {
+        bin = _mm_set_epi16(((uint16_t)buf[0] << 8) | buf[1],
+                            ((uint16_t)buf[2] << 8) | buf[3],
+                            ((uint16_t)buf[4] << 8) | buf[5],
+                            ((uint16_t)buf[6] << 8) | buf[7],
+                            ((uint16_t)buf[8] << 8) | buf[9],
+                            ((uint16_t)buf[10] << 8) | buf[11],
+                            ((uint16_t)buf[12] << 8) | buf[13],
+                            ((uint16_t)buf[14] << 8) | buf[15]);
+        Ci = _mm_xor_si128(bin, ghash->x);
+
+        /* Do binary mult ghash->X = Ci * ghash->H. */
+        C = _mm_clmulepi64_si128(Ci, ghash->h, 0x00);
+        D = _mm_clmulepi64_si128(Ci, ghash->h, 0x11);
+        E = _mm_clmulepi64_si128(Ci, ghash->h, 0x01);
+        F = _mm_clmulepi64_si128(Ci, ghash->h, 0x10);
+        tmp = _mm_xor_si128(E, F);
+        z_high = _mm_xor_si128(tmp, _mm_slli_si128(D, 8));
+        z_high = _mm_unpackhi_epi64(z_high, D);
+        z_low = _mm_xor_si128(_mm_slli_si128(tmp, 8), C);
+        z_low = _mm_unpackhi_epi64(_mm_slli_si128(C, 8), z_low);
+
+        /* Shift one to the left (multiply by x) as gcm spec is stupid. */
+        C = _mm_slli_si128(z_low, 8);
+        E = _mm_srli_epi64(C, 63);
+        D = _mm_slli_si128(z_high, 8);
+        F = _mm_srli_epi64(D, 63);
+        /* Carry over */
+        C = _mm_srli_si128(z_low, 8);
+        D = _mm_srli_epi64(C, 63);
+        z_low = _mm_or_si128(_mm_slli_epi64(z_low, 1), E);
+        z_high = _mm_or_si128(_mm_or_si128(_mm_slli_epi64(z_high, 1), F), D);
+
+        /* Reduce */
+        C = _mm_slli_si128(z_low, 8);
+        /* D = z_low << 127 */
+        D = _mm_slli_epi64(C, 63);
+        /* E = z_low << 126 */
+        E = _mm_slli_epi64(C, 62);
+        /* F = z_low << 121 */
+        F = _mm_slli_epi64(C, 57);
+        /* z_low ^= (z_low << 127) ^ (z_low << 126) ^ (z_low << 121); */
+        z_low = _mm_xor_si128(_mm_xor_si128(_mm_xor_si128(z_low, D), E), F);
+        C = _mm_srli_si128(z_low, 8);
+        /* D = z_low >> 1 */
+        D = _mm_slli_epi64(C, 63);
+        D = _mm_or_si128(_mm_srli_epi64(z_low, 1), D);
+        /* E = z_low >> 2 */
+        E = _mm_slli_epi64(C, 62);
+        E = _mm_or_si128(_mm_srli_epi64(z_low, 2), E);
+        /* F = z_low >> 7 */
+        F = _mm_slli_epi64(C, 57);
+        F = _mm_or_si128(_mm_srli_epi64(z_low, 7), F);
+        /* ghash->x ^= z_low ^ (z_low >> 1) ^ (z_low >> 2) ^ (z_low >> 7); */
+        ghash->x = _mm_xor_si128(_mm_xor_si128(
+                                     _mm_xor_si128(_mm_xor_si128(z_high, z_low), D), E),
+                                 F);
     }
-    return carry;
-}
-
-static SECStatus
-gcm_getX(gcmHashContext *ghash, unsigned char *T, unsigned int blocksize)
-{
-    gcm_longs_to_bytes(ghash->X, T, blocksize);
     return SECSuccess;
+#else
+    PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+    return SECFailure;
+#endif /* NSS_X86_OR_X64 */
 }
 
-#define GCM_XOR(t, s, len)    \
-    for (l = 0; l < len; l++) \
-    t[l] ^= s[l]
-
 static SECStatus
-gcm_HashMult(gcmHashContext *ghash, const unsigned char *buf,
-             unsigned int count, unsigned int blocksize)
+gcm_zeroX(gcmHashContext *ghash)
 {
-    unsigned long C_i[GCM_ARRAY_SIZE];
-    unsigned int arraysize = blocksize / sizeof(unsigned long);
-    unsigned int i, j, k, l;
-
-    for (i = 0; i < count; i++, buf += blocksize) {
-        ghash->m++;
-        gcm_bytes_to_longs(C_i, buf, blocksize);
-        GCM_XOR(C_i, ghash->X, arraysize);
-        /* multiply X = C_i * H */
-        PORT_Memset(ghash->X, 0, sizeof(ghash->X));
-        for (j = 0; j < arraysize; j++) {
-            unsigned long H = ghash->H[j];
-            for (k = 0; k < sizeof(unsigned long) * PR_BITS_PER_BYTE; k++) {
-                if (H & 1) {
-                    GCM_XOR(ghash->X, C_i, arraysize);
-                }
-                if (gcm_shift_one(C_i, arraysize)) {
-                    C_i[0] = C_i[0] ^ ghash->R;
-                }
-                H = H >> 1;
-            }
-        }
-        GCM_TRACE_X(ghash, "X%d = ")
+    if (ghash->hw) {
+#ifdef NSS_X86_OR_X64
+        ghash->x = _mm_setzero_si128();
+        return SECSuccess;
+#else
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+        return SECFailure;
+#endif /* NSS_X86_OR_X64 */
     }
-    PORT_Memset(C_i, 0, sizeof(C_i));
-    return SECSuccess;
-}
 
-static void
-gcm_zeroX(gcmHashContext *ghash)
-{
-    PORT_Memset(ghash->X, 0, sizeof(ghash->X));
-    ghash->m = 0;
+    ghash->x_high = ghash->x_low = 0;
+    return SECSuccess;
 }
-#endif
 
 /*
  * implement GCM GHASH using the freebl GHASH function. The gcm_HashMult
- * function always takes blocksize lengths of data. gcmHash_Update will
+ * function always takes AES_BLOCK_SIZE lengths of data. gcmHash_Update will
  * format the data properly.
  */
-static SECStatus
+SECStatus
 gcmHash_Update(gcmHashContext *ghash, const unsigned char *buf,
-               unsigned int len, unsigned int blocksize)
+               unsigned int len)
 {
     unsigned int blocks;
     SECStatus rv;
@@ -458,7 +398,7 @@ gcmHash_Update(gcmHashContext *ghash, const unsigned char *buf,
     /* first deal with the current buffer of data. Try to fill it out so
      * we can hash it */
     if (ghash->bufLen) {
-        unsigned int needed = PR_MIN(len, blocksize - ghash->bufLen);
+        unsigned int needed = PR_MIN(len, AES_BLOCK_SIZE - ghash->bufLen);
         if (needed != 0) {
             PORT_Memcpy(ghash->buffer + ghash->bufLen, buf, needed);
         }
@@ -469,24 +409,24 @@ gcmHash_Update(gcmHashContext *ghash, const unsigned char *buf,
             /* didn't add enough to hash the data, nothing more do do */
             return SECSuccess;
         }
-        PORT_Assert(ghash->bufLen == blocksize);
+        PORT_Assert(ghash->bufLen == AES_BLOCK_SIZE);
         /* hash the buffer and clear it */
-        rv = gcm_HashMult(ghash, ghash->buffer, 1, blocksize);
-        PORT_Memset(ghash->buffer, 0, blocksize);
+        rv = ghash->ghash_mul(ghash, ghash->buffer, 1);
+        PORT_Memset(ghash->buffer, 0, AES_BLOCK_SIZE);
         ghash->bufLen = 0;
         if (rv != SECSuccess) {
             return SECFailure;
         }
     }
     /* now hash any full blocks remaining in the data stream */
-    blocks = len / blocksize;
+    blocks = len / AES_BLOCK_SIZE;
     if (blocks) {
-        rv = gcm_HashMult(ghash, buf, blocks, blocksize);
+        rv = ghash->ghash_mul(ghash, buf, blocks);
         if (rv != SECSuccess) {
             return SECFailure;
         }
-        buf += blocks * blocksize;
-        len -= blocks * blocksize;
+        buf += blocks * AES_BLOCK_SIZE;
+        len -= blocks * AES_BLOCK_SIZE;
     }
 
     /* save any remainder in the buffer to be hashed with the next call */
@@ -502,7 +442,7 @@ gcmHash_Update(gcmHashContext *ghash, const unsigned char *buf,
  * save the lengths for the final completion of the hash
  */
 static SECStatus
-gcmHash_Sync(gcmHashContext *ghash, unsigned int blocksize)
+gcmHash_Sync(gcmHashContext *ghash)
 {
     int i;
     SECStatus rv;
@@ -519,9 +459,9 @@ gcmHash_Sync(gcmHashContext *ghash, unsigned int blocksize)
 
     /* now zero fill the buffer and hash the last block */
     if (ghash->bufLen) {
-        PORT_Memset(ghash->buffer + ghash->bufLen, 0, blocksize - ghash->bufLen);
-        rv = gcm_HashMult(ghash, ghash->buffer, 1, blocksize);
-        PORT_Memset(ghash->buffer, 0, blocksize);
+        PORT_Memset(ghash->buffer + ghash->bufLen, 0, AES_BLOCK_SIZE - ghash->bufLen);
+        rv = ghash->ghash_mul(ghash, ghash->buffer, 1);
+        PORT_Memset(ghash->buffer, 0, AES_BLOCK_SIZE);
         ghash->bufLen = 0;
         if (rv != SECSuccess) {
             return SECFailure;
@@ -530,38 +470,56 @@ gcmHash_Sync(gcmHashContext *ghash, unsigned int blocksize)
     return SECSuccess;
 }
 
+#define WRITE64(x, bytes)   \
+    (bytes)[0] = (x) >> 56; \
+    (bytes)[1] = (x) >> 48; \
+    (bytes)[2] = (x) >> 40; \
+    (bytes)[3] = (x) >> 32; \
+    (bytes)[4] = (x) >> 24; \
+    (bytes)[5] = (x) >> 16; \
+    (bytes)[6] = (x) >> 8;  \
+    (bytes)[7] = (x);
+
 /*
  * This does the final sync, hashes the lengths, then returns
  * "T", the hashed output.
  */
-static SECStatus
+SECStatus
 gcmHash_Final(gcmHashContext *ghash, unsigned char *outbuf,
-              unsigned int *outlen, unsigned int maxout,
-              unsigned int blocksize)
+              unsigned int *outlen, unsigned int maxout)
 {
     unsigned char T[MAX_BLOCK_SIZE];
     SECStatus rv;
 
-    rv = gcmHash_Sync(ghash, blocksize);
+    rv = gcmHash_Sync(ghash);
     if (rv != SECSuccess) {
         goto cleanup;
     }
 
-    rv = gcm_HashMult(ghash, ghash->counterBuf, (GCM_HASH_LEN_LEN * 2) / blocksize,
-                      blocksize);
+    rv = ghash->ghash_mul(ghash, ghash->counterBuf,
+                          (GCM_HASH_LEN_LEN * 2) / AES_BLOCK_SIZE);
     if (rv != SECSuccess) {
         goto cleanup;
     }
 
-    GCM_TRACE_X(ghash, "GHASH(H,A,C) = ")
-
-    rv = gcm_getX(ghash, T, blocksize);
-    if (rv != SECSuccess) {
-        goto cleanup;
+    if (ghash->hw) {
+#ifdef NSS_X86_OR_X64
+        uint64_t tmp_out[2];
+        _mm_storeu_si128((__m128i *)tmp_out, ghash->x);
+        WRITE64(tmp_out[0], T + 8);
+        WRITE64(tmp_out[1], T);
+#else
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+        return SECFailure;
+#endif /* NSS_X86_OR_X64 */
+    } else {
+        WRITE64(ghash->x_low, T + 8);
+        WRITE64(ghash->x_high, T);
     }
 
-    if (maxout > blocksize)
-        maxout = blocksize;
+    if (maxout > AES_BLOCK_SIZE) {
+        maxout = AES_BLOCK_SIZE;
+    }
     PORT_Memcpy(outbuf, T, maxout);
     *outlen = maxout;
     rv = SECSuccess;
@@ -573,22 +531,25 @@ cleanup:
 
 SECStatus
 gcmHash_Reset(gcmHashContext *ghash, const unsigned char *AAD,
-              unsigned int AADLen, unsigned int blocksize)
+              unsigned int AADLen)
 {
     SECStatus rv;
 
     ghash->cLen = 0;
     PORT_Memset(ghash->counterBuf, 0, GCM_HASH_LEN_LEN * 2);
     ghash->bufLen = 0;
-    gcm_zeroX(ghash);
+    rv = gcm_zeroX(ghash);
+    if (rv != SECSuccess) {
+        return rv;
+    }
 
     /* now kick things off by hashing the Additional Authenticated Data */
     if (AADLen != 0) {
-        rv = gcmHash_Update(ghash, AAD, AADLen, blocksize);
+        rv = gcmHash_Update(ghash, AAD, AADLen);
         if (rv != SECSuccess) {
             return SECFailure;
         }
-        rv = gcmHash_Sync(ghash, blocksize);
+        rv = gcmHash_Sync(ghash);
         if (rv != SECSuccess) {
             return SECFailure;
         }
@@ -602,7 +563,7 @@ gcmHash_Reset(gcmHashContext *ghash, const unsigned char *AAD,
 
 /* state to handle the full GCM operation (hash and counter) */
 struct GCMContextStr {
-    gcmHashContext ghash_context;
+    gcmHashContext *ghash_context;
     CTRContext ctr_context;
     unsigned long tagBits;
     unsigned char tagKey[MAX_BLOCK_SIZE];
@@ -610,58 +571,69 @@ struct GCMContextStr {
 
 GCMContext *
 GCM_CreateContext(void *context, freeblCipherFunc cipher,
-                  const unsigned char *params, unsigned int blocksize)
+                  const unsigned char *params)
 {
     GCMContext *gcm = NULL;
-    gcmHashContext *ghash;
+    gcmHashContext *ghash = NULL;
     unsigned char H[MAX_BLOCK_SIZE];
     unsigned int tmp;
     PRBool freeCtr = PR_FALSE;
-    PRBool freeHash = PR_FALSE;
     const CK_GCM_PARAMS *gcmParams = (const CK_GCM_PARAMS *)params;
     CK_AES_CTR_PARAMS ctrParams;
     SECStatus rv;
+#ifdef DISABLE_HW_GCM
+    const PRBool sw = PR_TRUE;
+#else
+    const PRBool sw = PR_FALSE;
+#endif
 
-    if (blocksize > MAX_BLOCK_SIZE || blocksize > sizeof(ctrParams.cb)) {
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+    if (gcmParams->ulIvLen == 0) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return NULL;
     }
     gcm = PORT_ZNew(GCMContext);
     if (gcm == NULL) {
         return NULL;
     }
-    /* first fill in the ghash context */
-    ghash = &gcm->ghash_context;
-    PORT_Memset(H, 0, blocksize);
-    rv = (*cipher)(context, H, &tmp, blocksize, H, blocksize, blocksize);
+    /* aligned_alloc is C11 so we have to do it the old way. */
+    ghash = PORT_ZAlloc(sizeof(gcmHashContext) + 15);
+    if (ghash == NULL) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+    ghash->mem = ghash;
+    ghash = (gcmHashContext *)(((uintptr_t)ghash + 15) & ~(uintptr_t)0x0F);
+
+    /* first plug in the ghash context */
+    gcm->ghash_context = ghash;
+    PORT_Memset(H, 0, AES_BLOCK_SIZE);
+    rv = (*cipher)(context, H, &tmp, AES_BLOCK_SIZE, H, AES_BLOCK_SIZE, AES_BLOCK_SIZE);
     if (rv != SECSuccess) {
         goto loser;
     }
-    rv = gcmHash_InitContext(ghash, H, blocksize);
+    rv = gcmHash_InitContext(ghash, H, sw);
     if (rv != SECSuccess) {
         goto loser;
     }
-    freeHash = PR_TRUE;
 
     /* fill in the Counter context */
     ctrParams.ulCounterBits = 32;
     PORT_Memset(ctrParams.cb, 0, sizeof(ctrParams.cb));
-    if ((blocksize == 16) && (gcmParams->ulIvLen == 12)) {
+    if (gcmParams->ulIvLen == 12) {
         PORT_Memcpy(ctrParams.cb, gcmParams->pIv, gcmParams->ulIvLen);
-        ctrParams.cb[blocksize - 1] = 1;
+        ctrParams.cb[AES_BLOCK_SIZE - 1] = 1;
     } else {
-        rv = gcmHash_Update(ghash, gcmParams->pIv, gcmParams->ulIvLen,
-                            blocksize);
+        rv = gcmHash_Update(ghash, gcmParams->pIv, gcmParams->ulIvLen);
         if (rv != SECSuccess) {
             goto loser;
         }
-        rv = gcmHash_Final(ghash, ctrParams.cb, &tmp, blocksize, blocksize);
+        rv = gcmHash_Final(ghash, ctrParams.cb, &tmp, AES_BLOCK_SIZE);
         if (rv != SECSuccess) {
             goto loser;
         }
     }
     rv = CTR_InitContext(&gcm->ctr_context, context, cipher,
-                         (unsigned char *)&ctrParams, blocksize);
+                         (unsigned char *)&ctrParams);
     if (rv != SECSuccess) {
         goto loser;
     }
@@ -671,14 +643,14 @@ GCM_CreateContext(void *context, freeblCipherFunc cipher,
     gcm->tagBits = gcmParams->ulTagBits; /* save for final step */
     /* calculate the final tag key. NOTE: gcm->tagKey is zero to start with.
      * if this assumption changes, we would need to explicitly clear it here */
-    rv = CTR_Update(&gcm->ctr_context, gcm->tagKey, &tmp, blocksize,
-                    gcm->tagKey, blocksize, blocksize);
+    rv = CTR_Update(&gcm->ctr_context, gcm->tagKey, &tmp, AES_BLOCK_SIZE,
+                    gcm->tagKey, AES_BLOCK_SIZE, AES_BLOCK_SIZE);
     if (rv != SECSuccess) {
         goto loser;
     }
 
     /* finally mix in the AAD data */
-    rv = gcmHash_Reset(ghash, gcmParams->pAAD, gcmParams->ulAADLen, blocksize);
+    rv = gcmHash_Reset(ghash, gcmParams->pAAD, gcmParams->ulAADLen);
     if (rv != SECSuccess) {
         goto loser;
     }
@@ -689,8 +661,8 @@ loser:
     if (freeCtr) {
         CTR_DestroyContext(&gcm->ctr_context, PR_FALSE);
     }
-    if (freeHash) {
-        gcmHash_DestroyContext(&gcm->ghash_context, PR_FALSE);
+    if (ghash && ghash->mem) {
+        PORT_Free(ghash->mem);
     }
     if (gcm) {
         PORT_Free(gcm);
@@ -705,7 +677,7 @@ GCM_DestroyContext(GCMContext *gcm, PRBool freeit)
      * gcm. call their destroy functions to free up any locally
      * allocated data (like mp_int's) */
     CTR_DestroyContext(&gcm->ctr_context, PR_FALSE);
-    gcmHash_DestroyContext(&gcm->ghash_context, PR_FALSE);
+    PORT_Free(gcm->ghash_context->mem);
     PORT_Memset(&gcm->tagBits, 0, sizeof(gcm->tagBits));
     PORT_Memset(gcm->tagKey, 0, sizeof(gcm->tagKey));
     if (freeit) {
@@ -715,8 +687,7 @@ GCM_DestroyContext(GCMContext *gcm, PRBool freeit)
 
 static SECStatus
 gcm_GetTag(GCMContext *gcm, unsigned char *outbuf,
-           unsigned int *outlen, unsigned int maxout,
-           unsigned int blocksize)
+           unsigned int *outlen, unsigned int maxout)
 {
     unsigned int tagBytes;
     unsigned int extra;
@@ -738,18 +709,14 @@ gcm_GetTag(GCMContext *gcm, unsigned char *outbuf,
         return SECFailure;
     }
     maxout = tagBytes;
-    rv = gcmHash_Final(&gcm->ghash_context, outbuf, outlen, maxout, blocksize);
+    rv = gcmHash_Final(gcm->ghash_context, outbuf, outlen, maxout);
     if (rv != SECSuccess) {
         return SECFailure;
     }
 
-    GCM_TRACE_BLOCK("GHASH=", outbuf, blocksize);
-    GCM_TRACE_BLOCK("Y0=", gcm->tagKey, blocksize);
     for (i = 0; i < *outlen; i++) {
         outbuf[i] ^= gcm->tagKey[i];
     }
-    GCM_TRACE_BLOCK("Y0=", gcm->tagKey, blocksize);
-    GCM_TRACE_BLOCK("T=", outbuf, blocksize);
     /* mask off any extra bits we got */
     if (extra) {
         outbuf[tagBytes - 1] &= ~((1 << extra) - 1);
@@ -772,6 +739,12 @@ GCM_EncryptUpdate(GCMContext *gcm, unsigned char *outbuf,
     unsigned int tagBytes;
     unsigned int len;
 
+    PORT_Assert(blocksize == AES_BLOCK_SIZE);
+    if (blocksize != AES_BLOCK_SIZE) {
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+        return SECFailure;
+    }
+
     tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE - 1)) / PR_BITS_PER_BYTE;
     if (UINT_MAX - inlen < tagBytes) {
         PORT_SetError(SEC_ERROR_INPUT_LEN);
@@ -784,17 +757,17 @@ GCM_EncryptUpdate(GCMContext *gcm, unsigned char *outbuf,
     }
 
     rv = CTR_Update(&gcm->ctr_context, outbuf, outlen, maxout,
-                    inbuf, inlen, blocksize);
+                    inbuf, inlen, AES_BLOCK_SIZE);
     if (rv != SECSuccess) {
         return SECFailure;
     }
-    rv = gcmHash_Update(&gcm->ghash_context, outbuf, *outlen, blocksize);
+    rv = gcmHash_Update(gcm->ghash_context, outbuf, *outlen);
     if (rv != SECSuccess) {
         PORT_Memset(outbuf, 0, *outlen); /* clear the output buffer */
         *outlen = 0;
         return SECFailure;
     }
-    rv = gcm_GetTag(gcm, outbuf + *outlen, &len, maxout - *outlen, blocksize);
+    rv = gcm_GetTag(gcm, outbuf + *outlen, &len, maxout - *outlen);
     if (rv != SECSuccess) {
         PORT_Memset(outbuf, 0, *outlen); /* clear the output buffer */
         *outlen = 0;
@@ -824,6 +797,12 @@ GCM_DecryptUpdate(GCMContext *gcm, unsigned char *outbuf,
     const unsigned char *intag;
     unsigned int len;
 
+    PORT_Assert(blocksize == AES_BLOCK_SIZE);
+    if (blocksize != AES_BLOCK_SIZE) {
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+        return SECFailure;
+    }
+
     tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE - 1)) / PR_BITS_PER_BYTE;
 
     /* get the authentication block */
@@ -836,11 +815,11 @@ GCM_DecryptUpdate(GCMContext *gcm, unsigned char *outbuf,
     intag = inbuf + inlen;
 
     /* verify the block */
-    rv = gcmHash_Update(&gcm->ghash_context, inbuf, inlen, blocksize);
+    rv = gcmHash_Update(gcm->ghash_context, inbuf, inlen);
     if (rv != SECSuccess) {
         return SECFailure;
     }
-    rv = gcm_GetTag(gcm, tag, &len, blocksize, blocksize);
+    rv = gcm_GetTag(gcm, tag, &len, AES_BLOCK_SIZE);
     if (rv != SECSuccess) {
         return SECFailure;
     }
@@ -856,5 +835,5 @@ GCM_DecryptUpdate(GCMContext *gcm, unsigned char *outbuf,
     PORT_Memset(tag, 0, sizeof(tag));
     /* finish the decryption */
     return CTR_Update(&gcm->ctr_context, outbuf, outlen, maxout,
-                      inbuf, inlen, blocksize);
+                      inbuf, inlen, AES_BLOCK_SIZE);
 }
diff --git a/security/nss/lib/freebl/gcm.h b/security/nss/lib/freebl/gcm.h
index 1cdba534d..0c707a081 100644
--- a/security/nss/lib/freebl/gcm.h
+++ b/security/nss/lib/freebl/gcm.h
@@ -6,6 +6,17 @@
 #define GCM_H 1
 
 #include "blapii.h"
+#include <stdint.h>
+
+#ifdef NSS_X86_OR_X64
+#include <emmintrin.h> /* __m128i */
+#endif
+
+SEC_BEGIN_PROTOS
+
+#ifdef HAVE_INT128_SUPPORT
+typedef unsigned __int128 uint128_t;
+#endif
 
 typedef struct GCMContextStr GCMContext;
 
@@ -17,7 +28,7 @@ typedef struct GCMContextStr GCMContext;
  * The cipher argument is a block cipher in the ECB encrypt mode.
  */
 GCMContext *GCM_CreateContext(void *context, freeblCipherFunc cipher,
-                              const unsigned char *params, unsigned int blocksize);
+                              const unsigned char *params);
 void GCM_DestroyContext(GCMContext *gcm, PRBool freeit);
 SECStatus GCM_EncryptUpdate(GCMContext *gcm, unsigned char *outbuf,
                             unsigned int *outlen, unsigned int maxout,
@@ -28,4 +39,34 @@ SECStatus GCM_DecryptUpdate(GCMContext *gcm, unsigned char *outbuf,
                             const unsigned char *inbuf, unsigned int inlen,
                             unsigned int blocksize);
 
+/* These functions are here only so we can test them */
+#define GCM_HASH_LEN_LEN 8 /* gcm hash defines lengths to be 64 bits */
+typedef struct gcmHashContextStr gcmHashContext;
+typedef SECStatus (*ghash_t)(gcmHashContext *, const unsigned char *,
+                             unsigned int);
+pre_align struct gcmHashContextStr {
+#ifdef NSS_X86_OR_X64
+    __m128i x, h;
+#endif
+    uint64_t x_low, x_high, h_high, h_low;
+    unsigned char buffer[MAX_BLOCK_SIZE];
+    unsigned int bufLen;
+    uint8_t counterBuf[16];
+    uint64_t cLen;
+    ghash_t ghash_mul;
+    PRBool hw;
+    gcmHashContext *mem;
+} post_align;
+
+SECStatus gcmHash_Update(gcmHashContext *ghash, const unsigned char *buf,
+                         unsigned int len);
+SECStatus gcmHash_InitContext(gcmHashContext *ghash, const unsigned char *H,
+                              PRBool sw);
+SECStatus gcmHash_Reset(gcmHashContext *ghash, const unsigned char *AAD,
+                        unsigned int AADLen);
+SECStatus gcmHash_Final(gcmHashContext *ghash, unsigned char *outbuf,
+                        unsigned int *outlen, unsigned int maxout);
+
+SEC_END_PROTOS
+
 #endif
diff --git a/security/nss/lib/freebl/intel-aes-x64-masm.asm b/security/nss/lib/freebl/intel-aes-x64-masm.asm
index ef5c76ba2..fe183bca0 100644
--- a/security/nss/lib/freebl/intel-aes-x64-masm.asm
+++ b/security/nss/lib/freebl/intel-aes-x64-masm.asm
@@ -91,8 +91,6 @@ LOCAL   bail
         movdqu  [rsp + 1*16], xmm7
         movdqu  [rsp + 2*16], xmm8
 
-        lea     ctx, [48+ctx]
-
 loop8:
         cmp     inputLen, 8*16
         jb      loop1
@@ -555,9 +553,7 @@ LOCAL   bail
         movdqu  [rsp + 1*16], xmm7
         movdqu  [rsp + 2*16], xmm8
 
-        lea     ctx, [48+ctx]
-
-        movdqu  xmm0, [-32+ctx]
+        movdqu  xmm0, [256+ctx]
 
         movdqu  xmm2, [0*16 + ctx]
         movdqu  xmm3, [1*16 + ctx]
@@ -597,7 +593,7 @@ loop1:
         jmp loop1
 
 bail:
-        movdqu  [-32+ctx], xmm0
+        movdqu  [256+ctx], xmm0
 
         xor rax, rax
 
@@ -625,8 +621,6 @@ LOCAL   bail
         movdqu  [rsp + 1*16], xmm7
         movdqu  [rsp + 2*16], xmm8
 
-        lea     ctx, [48+ctx]
-
 loop8:
         cmp     inputLen, 8*16
         jb      dec1
@@ -657,7 +651,7 @@ loop8:
             ENDM
         aes_dec_last_rnd rnds
 
-        movdqu  xmm8, [-32 + ctx]
+        movdqu  xmm8, [256 + ctx]
         pxor    xmm0, xmm8
         movdqu  xmm8, [0*16 + input]
         pxor    xmm1, xmm8
@@ -683,7 +677,7 @@ loop8:
         movdqu  [5*16 + output], xmm5
         movdqu  [6*16 + output], xmm6
         movdqu  [7*16 + output], xmm7
-        movdqu  [-32 + ctx], xmm8
+        movdqu  [256 + ctx], xmm8
 
         lea input, [8*16 + input]
         lea output, [8*16 + output]
@@ -691,7 +685,7 @@ loop8:
         jmp loop8
 dec1:
 
-        movdqu  xmm3, [-32 + ctx]
+        movdqu  xmm3, [256 + ctx]
 
 loop1:
         cmp     inputLen, 1*16
@@ -721,7 +715,7 @@ loop1:
         jmp loop1
 
 bail:
-        movdqu  [-32 + ctx], xmm3
+        movdqu  [256 + ctx], xmm3
         xor rax, rax
 
         movdqu  xmm6, [rsp + 0*16]
@@ -773,7 +767,6 @@ LOCAL   bail
 
         mov     ctrCtx, ctx
         mov     ctx, [8+ctrCtx]
-        lea     ctx, [48+ctx]
 
         sub     rsp, 3*16
         movdqu  [rsp + 0*16], xmm6
diff --git a/security/nss/lib/freebl/intel-aes-x86-masm.asm b/security/nss/lib/freebl/intel-aes-x86-masm.asm
index 7d805e766..790c951e7 100644
--- a/security/nss/lib/freebl/intel-aes-x86-masm.asm
+++ b/security/nss/lib/freebl/intel-aes-x86-masm.asm
@@ -87,8 +87,6 @@ LOCAL   bail
         mov     input,      [esp + 2*4 + 4*4]
         mov     inputLen,   [esp + 2*4 + 5*4]
 
-        lea     ctx, [44+ctx]
-
 loop7:
         cmp     inputLen, 7*16
         jb      loop1
@@ -557,9 +555,7 @@ LOCAL   bail
         mov     input,      [esp + 2*4 + 4*4]
         mov     inputLen,   [esp + 2*4 + 5*4]
 
-        lea     ctx, [44+ctx]
-
-        movdqu  xmm0, [-32+ctx]
+        movdqu  xmm0, [252+ctx]
 
         movdqu  xmm2, [0*16 + ctx]
         movdqu  xmm3, [1*16 + ctx]
@@ -597,7 +593,7 @@ loop1:
         jmp loop1
 
 bail:
-        movdqu  [-32+ctx], xmm0
+        movdqu  [252+ctx], xmm0
 
         xor eax, eax
         pop inputLen
@@ -619,8 +615,6 @@ LOCAL   bail
         mov     input,      [esp + 2*4 + 4*4]
         mov     inputLen,   [esp + 2*4 + 5*4]
 
-        lea     ctx, [44+ctx]
-
 loop7:
         cmp     inputLen, 7*16
         jb      dec1
@@ -649,7 +643,7 @@ loop7:
             ENDM
         aes_dec_last_rnd rnds
 
-        movdqu  xmm7, [-32 + ctx]
+        movdqu  xmm7, [252 + ctx]
         pxor    xmm0, xmm7
         movdqu  xmm7, [0*16 + input]
         pxor    xmm1, xmm7
@@ -672,7 +666,7 @@ loop7:
         movdqu  [4*16 + output], xmm4
         movdqu  [5*16 + output], xmm5
         movdqu  [6*16 + output], xmm6
-        movdqu  [-32 + ctx], xmm7
+        movdqu  [252 + ctx], xmm7
 
         lea input, [7*16 + input]
         lea output, [7*16 + output]
@@ -680,7 +674,7 @@ loop7:
         jmp loop7
 dec1:
 
-        movdqu  xmm3, [-32 + ctx]
+        movdqu  xmm3, [252 + ctx]
 
 loop1:
         cmp     inputLen, 1*16
@@ -710,7 +704,7 @@ loop1:
         jmp loop1
 
 bail:
-        movdqu  [-32 + ctx], xmm3
+        movdqu  [252 + ctx], xmm3
         xor eax, eax
         pop     inputLen
         ret
@@ -769,7 +763,6 @@ LOCAL   bail
         mov     inputLen, [esp + 4*5 + 5*4]
 
         mov     ctx, [4+ctrCtx]
-        lea     ctx, [44+ctx]
 
         mov     ebp, esp
         sub     esp, 7*16
diff --git a/security/nss/lib/freebl/intel-aes.s b/security/nss/lib/freebl/intel-aes.s
index 2dfcfa15b..b242d233f 100644
--- a/security/nss/lib/freebl/intel-aes.s
+++ b/security/nss/lib/freebl/intel-aes.s
@@ -4,8 +4,7 @@
 
 	.text
 
-#define IV_OFFSET 16
-#define EXPANDED_KEY_OFFSET 48
+#define IV_OFFSET 256
 
 /*
  * Warning: the length values used in this module are "unsigned int"
@@ -144,9 +143,6 @@ key_expansion128:
 	.globl intel_aes_encrypt_ecb_128
 	.align	16
 intel_aes_encrypt_ecb_128:
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	48(%rdi), %rdi
-
 	movdqu	(%rdi), %xmm2
 	movdqu	160(%rdi), %xmm12
 	xor	%eax, %eax
@@ -328,9 +324,6 @@ intel_aes_encrypt_ecb_128:
 	.globl intel_aes_decrypt_ecb_128
 	.align	16
 intel_aes_decrypt_ecb_128:
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	48(%rdi), %rdi
-
 	movdqu	(%rdi), %xmm2
 	movdqu	160(%rdi), %xmm12
 	xorl	%eax, %eax
@@ -516,9 +509,7 @@ intel_aes_encrypt_cbc_128:
 	je	2f
 
 //	leaq	IV_OFFSET(%rdi), %rdx
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	16(%rdi), %rdx
-	leaq	48(%rdi), %rdi
+	leaq	256(%rdi), %rdx
 
 	movdqu	(%rdx), %xmm0
 	movdqu	(%rdi), %xmm2
@@ -575,9 +566,7 @@ intel_aes_encrypt_cbc_128:
 	.align	16
 intel_aes_decrypt_cbc_128:
 //	leaq	IV_OFFSET(%rdi), %rdx
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	16(%rdi), %rdx
-	leaq	48(%rdi), %rdi
+	leaq	256(%rdi), %rdx
 
 	movdqu	(%rdx), %xmm0   /* iv */
 	movdqu	(%rdi), %xmm2   /* first key block */
@@ -902,9 +891,6 @@ key_expansion192:
 	.globl intel_aes_encrypt_ecb_192
 	.align	16
 intel_aes_encrypt_ecb_192:
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	48(%rdi), %rdi
-
 	movdqu	(%rdi), %xmm2
 	movdqu	192(%rdi), %xmm14
 	xorl	%eax, %eax
@@ -1109,9 +1095,6 @@ intel_aes_encrypt_ecb_192:
 	.globl intel_aes_decrypt_ecb_192
 	.align	16
 intel_aes_decrypt_ecb_192:
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	48(%rdi), %rdi
-
 	movdqu	(%rdi), %xmm2
 	movdqu	192(%rdi), %xmm14
 	xorl	%eax, %eax
@@ -1320,9 +1303,7 @@ intel_aes_encrypt_cbc_192:
 	je	2f
 
 //	leaq	IV_OFFSET(%rdi), %rdx
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	16(%rdi), %rdx
-	leaq	48(%rdi), %rdi
+	leaq	256(%rdi), %rdx
 
 	movdqu	(%rdx), %xmm0
 	movdqu	(%rdi), %xmm2
@@ -1382,8 +1363,8 @@ intel_aes_encrypt_cbc_192:
 	.globl intel_aes_decrypt_cbc_192
 	.align	16
 intel_aes_decrypt_cbc_192:
-	leaq	16(%rdi), %rdx
-	leaq	48(%rdi), %rdi
+//	leaq	IV_OFFSET(%rdi), %rdx
+	leaq	256(%rdi), %rdx
 
 	movdqu	(%rdx), %xmm0
 	movdqu	(%rdi), %xmm2
@@ -1738,9 +1719,6 @@ key_expansion256:
 	.globl intel_aes_encrypt_ecb_256
 	.align	16
 intel_aes_encrypt_ecb_256:
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	48(%rdi), %rdi
-
 	movdqu	(%rdi), %xmm2
 	movdqu	224(%rdi), %xmm15
 	xorl	%eax, %eax
@@ -1970,9 +1948,6 @@ intel_aes_encrypt_ecb_256:
 	.globl intel_aes_decrypt_ecb_256
 	.align	16
 intel_aes_decrypt_ecb_256:
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	48(%rdi), %rdi
-
 	movdqu	(%rdi), %xmm2
 	movdqu	224(%rdi), %xmm15
 	xorl	%eax, %eax
@@ -2206,9 +2181,7 @@ intel_aes_encrypt_cbc_256:
 	je	2f
 
 //	leaq	IV_OFFSET(%rdi), %rdx
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	16(%rdi), %rdx
-	leaq	48(%rdi), %rdi
+	leaq	256(%rdi), %rdx
 
 	movdqu	(%rdx), %xmm0
 	movdqu	(%rdi), %xmm8
@@ -2274,9 +2247,7 @@ intel_aes_encrypt_cbc_256:
 	.align	16
 intel_aes_decrypt_cbc_256:
 //	leaq	IV_OFFSET(%rdi), %rdx
-//	leaq	EXPANDED_KEY_OFFSET(%rdi), %rdi
-	leaq	16(%rdi), %rdx
-	leaq	48(%rdi), %rdi
+	leaq	256(%rdi), %rdx
 
 	movdqu	(%rdx), %xmm0
 	movdqu	(%rdi), %xmm2
diff --git a/security/nss/lib/freebl/intel-gcm-wrap.c b/security/nss/lib/freebl/intel-gcm-wrap.c
index 8c5eaf021..37a1af765 100644
--- a/security/nss/lib/freebl/intel-gcm-wrap.c
+++ b/security/nss/lib/freebl/intel-gcm-wrap.c
@@ -41,8 +41,7 @@ struct intel_AES_GCMContextStr {
 intel_AES_GCMContext *
 intel_AES_GCM_CreateContext(void *context,
                             freeblCipherFunc cipher,
-                            const unsigned char *params,
-                            unsigned int blocksize)
+                            const unsigned char *params)
 {
     intel_AES_GCMContext *gcm = NULL;
     AESContext *aes = (AESContext *)context;
@@ -59,12 +58,11 @@ intel_AES_GCM_CreateContext(void *context,
     unsigned int j;
     SECStatus rv;
 
-    if (blocksize != AES_BLOCK_SIZE) {
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+    if (gcmParams->ulIvLen == 0) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return NULL;
     }
     gcm = PORT_ZNew(intel_AES_GCMContext);
-
     if (gcm == NULL) {
         return NULL;
     }
diff --git a/security/nss/lib/freebl/intel-gcm-x64-masm.asm b/security/nss/lib/freebl/intel-gcm-x64-masm.asm
index 8b68b76e5..07ddefbc1 100644
--- a/security/nss/lib/freebl/intel-gcm-x64-masm.asm
+++ b/security/nss/lib/freebl/intel-gcm-x64-masm.asm
@@ -496,8 +496,8 @@ LbeginENC:
     vmovdqu CTR0, XMMWORD PTR[16*16 + 2*16 + Gctx]
     vmovdqu BSWAPMASK, XMMWORD PTR[Lbswap_mask]
     mov     KS, [16*16 + 3*16 + Gctx]
-    mov     NR, [4 + KS]
-    lea     KS, [48 + KS]
+    mov     NR, [244 + KS]
+    lea     KS, [KS]
 
     vpshufb CTR0, CTR0, BSWAPMASK
 
@@ -994,8 +994,7 @@ LbeginDEC:
     vmovdqu CTR0, XMMWORD PTR[16*16 + 2*16 + Gctx]
     vmovdqu BSWAPMASK, XMMWORD PTR[Lbswap_mask]
     mov     KS, [16*16 + 3*16 + Gctx]
-    mov     NR, [4 + KS]
-    lea     KS, [48 + KS]
+    mov     NR, [244 + KS]
 
     vpshufb CTR0, CTR0, BSWAPMASK
 
diff --git a/security/nss/lib/freebl/intel-gcm-x86-masm.asm b/security/nss/lib/freebl/intel-gcm-x86-masm.asm
index 6362ad859..32f425788 100644
--- a/security/nss/lib/freebl/intel-gcm-x86-masm.asm
+++ b/security/nss/lib/freebl/intel-gcm-x86-masm.asm
@@ -390,7 +390,7 @@ Htbl    textequ <edx>
 Gctx    textequ <edx>
 len     textequ <DWORD PTR[ebp + 5*4 + 3*4]>
 KS      textequ <esi>
-NR      textequ <DWORD PTR[-40 + KS]>
+NR      textequ <DWORD PTR[244+KS]>
 
 aluCTR  textequ <ebx>
 aluTMP  textequ <edi>
@@ -463,7 +463,6 @@ LbeginENC:
     mov Gctx, [ebp + 5*4 + 2*4]
 
     mov     KS, [16*16 + 3*16 + Gctx]
-    lea     KS, [44 + KS]
 
     mov     aluCTR, [16*16 + 2*16 + 3*4 + Gctx]
     bswap   aluCTR
@@ -931,7 +930,6 @@ LbeginDEC:
     mov Gctx, [ebp + 5*4 + 2*4]
 
     mov     KS, [16*16 + 3*16 + Gctx]
-    lea     KS, [44 + KS]
 
     mov     aluCTR, [16*16 + 2*16 + 3*4 + Gctx]
     bswap   aluCTR
diff --git a/security/nss/lib/freebl/intel-gcm.h b/security/nss/lib/freebl/intel-gcm.h
index 566e544d8..05f52f297 100644
--- a/security/nss/lib/freebl/intel-gcm.h
+++ b/security/nss/lib/freebl/intel-gcm.h
@@ -27,7 +27,7 @@
 typedef struct intel_AES_GCMContextStr intel_AES_GCMContext;
 
 intel_AES_GCMContext *intel_AES_GCM_CreateContext(void *context, freeblCipherFunc cipher,
-                                                  const unsigned char *params, unsigned int blocksize);
+                                                  const unsigned char *params);
 
 void intel_AES_GCM_DestroyContext(intel_AES_GCMContext *gcm, PRBool freeit);
 
diff --git a/security/nss/lib/freebl/intel-gcm.s b/security/nss/lib/freebl/intel-gcm.s
index 1a3106091..5b5cf5d4b 100644
--- a/security/nss/lib/freebl/intel-gcm.s
+++ b/security/nss/lib/freebl/intel-gcm.s
@@ -467,8 +467,8 @@ intel_aes_gcmENC:
     vmovdqu  288(Gctx), CTR
     vmovdqu  272(Gctx), T
     mov  304(Gctx), KS
-    mov  4(KS), NR
-    lea  48(KS), KS
+# AESContext->Nr
+    mov  244(KS), NR
 
     vpshufb  .Lbswap_mask(%rip), CTR, CTR
     vpshufb  .Lbswap_mask(%rip), T, T
@@ -1001,8 +1001,8 @@ intel_aes_gcmDEC:
     vmovdqu 288(Gctx), CTR
     vmovdqu 272(Gctx), T
     mov     304(Gctx), KS
-    mov     4(KS), NR
-    lea     48(KS), KS
+# AESContext->Nr
+    mov     244(KS), NR
 
     vpshufb .Lbswap_mask(%rip), CTR, CTR
     vpshufb .Lbswap_mask(%rip), T, T
diff --git a/security/nss/lib/freebl/mpi/README b/security/nss/lib/freebl/mpi/README
index f1c66dff1..776ba713a 100644
--- a/security/nss/lib/freebl/mpi/README
+++ b/security/nss/lib/freebl/mpi/README
@@ -67,14 +67,6 @@ assumptions about the sizes of things, but there is little if any
 reason to change the other parameters, so I would recommend you leave
 them as you found them.
 
-The library comes with a Perl script, 'types.pl', which will scan your
-current Makefile settings, and attempt to find good definitions for
-these types.  It relies on a Unix sort of build environment, so it
-probably won't work under MacOS or Windows, but it can be convenient
-if you're porting to a new flavour of Unix.  Just run 'types.pl' at
-the command line, and it will spit out its results to the standard
-output.
-
 
 Conventions
 -----------
@@ -630,92 +622,6 @@ Most of these can be built from the Makefile that comes with the
 library.  Try 'make tools', if your environment supports it.
 
 
-Testing the Library
--------------------
-
-Automatic test vectors are included, in the form of a program called
-'mpi-test'.  To build this program and run all the tests, simply
-invoke the shell script 'all-tests'.  If all the tests pass, you
-should see a message:
-
-        All tests passed
-
-If something went wrong, you'll get:
-
-        One or more tests failed.
-
-If this happens, scan back through the preceding lines, to see which
-test failed.  Any failure indicates a bug in the library, which needs
-to be fixed before it will give accurate results.  If you get any such
-thing, please let me know, and I'll try to fix it.  Please let me know
-what platform and compiler you were using, as well as which test
-failed.  If a reason for failure was given, please send me that text
-as well.
-
-If you're on a system where the standard Unix build tools don't work,
-you can build the 'mpi-test' program manually, and run it by hand.
-This is tedious and obnoxious, sorry.
-
-Further manual testing can be performed by building the manual testing
-programs, whose source is found in the 'tests' subdirectory.  Each
-test is in a source file called 'mptest-X.c'.  The Makefile contains a
-target to build all of them at once:
-
-        make tests
-
-Read the comments at the top of each source file to see what the
-driver is supposed to test.  You probably don't need to do this; these
-programs were only written to help me as I was developing the library.
-
-The relevant files are:
-
-mpi-test.c              The source for the test driver
-
-make-test-arrays        A Perl script to generate some of the internal
-                        data structures used by mpi-test.c
-
-test-arrays.txt         The source file for make-test-arrays
-
-all-tests               A Bourne shell script which runs all the
-                        tests in the mpi-test suite
-
-Running 'make mpi-test' should build the mpi-test program.  If you
-cannot use make, here is what needs to be done:
-
-(1) Use 'make-test-arrays' to generate the file 'test-info.c' from
-    the 'test-arrays.txt' file.  Since Perl can be found everywhere,
-    this should be no trouble.  Under Unix, this looks like:
-
-        make-test-arrays test-arrays.txt > test-info.c
-
-(2) Build the MPI library:
-
-        gcc -ansi -pedantic -Wall -c mpi.c
-
-(3) Build the mpi-test program:
-
-        gcc -ansi -pedantic -Wall -o mpi-test mpi.o mpi-test.c
-
-When you've got mpi-test, you can use 'all-tests' to run all the tests
-made available by mpi-test.  If any of them fail, there should be a
-diagnostic indicating what went wrong.  These are fairly high-level
-diagnostics, and won't really help you debug the problem; they're
-simply intended to help you isolate which function caused the problem.
-If you encounter a problem of this sort, feel free to e-mail me, and I
-will certainly attempt to help you debug it.
-
-Note:   Several of the tests hard-wired into 'mpi-test' operate under
-----    the assumption that you are using at least a 16-bit mp_digit 
-        type.  If that is not true, several tests might fail, because 
-        of range problems with the maximum digit value.
-
-        If you are using an 8-bit digit, you will also need to 
-        modify the code for mp_read_raw(), which assumes that
-        multiplication by 256 can be done with mp_mul_d(), a
-        fact that fails when DIGIT_MAX is 255.  You can replace
-        the call with s_mp_lshd(), which will give you the same
-        effect, and without doing as much work. :)
-
 Acknowledgements:
 ----------------
 
diff --git a/security/nss/lib/freebl/mpi/mpcpucache.c b/security/nss/lib/freebl/mpi/mpcpucache.c
index 6fed35239..336b4cc55 100644
--- a/security/nss/lib/freebl/mpi/mpcpucache.c
+++ b/security/nss/lib/freebl/mpi/mpcpucache.c
@@ -17,7 +17,7 @@
  *
  * Currently the file returns good data for most modern x86 processors, and
  * reasonable data on 64-bit ppc processors. All other processors are assumed
- * to have a cache line size of 32 bytes unless modified by target.mk.
+ * to have a cache line size of 32 bytes.
  *
  */
 
@@ -775,18 +775,6 @@ s_mpi_getProcessorLineSize()
  *
  */
 
-/* target.mk can define MPI_CACHE_LINE_SIZE if it's common for the family or
- * OS */
-#if defined(MPI_CACHE_LINE_SIZE) && !defined(MPI_GET_PROCESSOR_LINE_SIZE_DEFINED)
-
-unsigned long
-s_mpi_getProcessorLineSize()
-{
-    return MPI_CACHE_LINE_SIZE;
-}
-#define MPI_GET_PROCESSOR_LINE_SIZE_DEFINED 1
-#endif
-
 /* If no way to get the processor cache line size has been defined, assume
  * it's 32 bytes (most common value, does not significantly impact performance)
  */
@@ -797,12 +785,3 @@ s_mpi_getProcessorLineSize()
     return 32;
 }
 #endif
-
-#ifdef TEST_IT
-#include <stdio.h>
-
-main()
-{
-    printf("line size = %d\n", s_mpi_getProcessorLineSize());
-}
-#endif
diff --git a/security/nss/lib/freebl/mpi/mpmontg.c b/security/nss/lib/freebl/mpi/mpmontg.c
index 06fd41b3a..3acdc9fef 100644
--- a/security/nss/lib/freebl/mpi/mpmontg.c
+++ b/security/nss/lib/freebl/mpi/mpmontg.c
@@ -205,7 +205,11 @@ mp_exptmod_f(const mp_int *montBase,
     dTmpSize = 2 * oddPowSize;
     dSize = sizeof(double) * (nLen * 4 + 1 +
                               ((odd_ints + 1) * oddPowSize) + dTmpSize);
-    dBuf = (double *)malloc(dSize);
+    dBuf = malloc(dSize);
+    if (!dBuf) {
+        res = MP_MEM;
+        goto CLEANUP;
+    }
     dm1 = dBuf;           /* array of d32 */
     dn = dBuf + nLen;     /* array of d32 */
     dSqr = dn + nLen;     /* array of d32 */
diff --git a/security/nss/lib/freebl/rijndael.c b/security/nss/lib/freebl/rijndael.c
index 0c3ab58de..e4ad60388 100644
--- a/security/nss/lib/freebl/rijndael.c
+++ b/security/nss/lib/freebl/rijndael.c
@@ -18,21 +18,14 @@
 #include "cts.h"
 #include "ctr.h"
 #include "gcm.h"
+#include "mpi.h"
 
 #ifdef USE_HW_AES
 #include "intel-aes.h"
 #endif
-
-#include "mpi.h"
-
-#ifdef USE_HW_AES
-static PRBool use_hw_aes = PR_FALSE;
-
 #ifdef INTEL_GCM
 #include "intel-gcm.h"
-static PRBool use_hw_gcm = PR_FALSE;
-#endif
-#endif /* USE_HW_AES */
+#endif /* INTEL_GCM */
 
 /*
  * There are currently five ways to build this code, varying in performance
@@ -373,7 +366,7 @@ init_rijndael_tables(void)
  * Nk == 8 where it happens twice in every key word, in the same positions).
  * For now, I'm implementing this case "dumbly", w/o any unrolling.
  */
-static SECStatus
+static void
 rijndael_key_expansion7(AESContext *cx, const unsigned char *key, unsigned int Nk)
 {
     unsigned int i;
@@ -394,14 +387,169 @@ rijndael_key_expansion7(AESContext *cx, const unsigned char *key, unsigned int N
             tmp = SUBBYTE(tmp);
         *pW = W[i - Nk] ^ tmp;
     }
-    return SECSuccess;
+}
+
+#if defined(NSS_X86_OR_X64)
+#define EXPAND_KEY128(k, rcon, res)                   \
+    tmp_key = _mm_aeskeygenassist_si128(k, rcon);     \
+    tmp_key = _mm_shuffle_epi32(tmp_key, 0xFF);       \
+    tmp = _mm_xor_si128(k, _mm_slli_si128(k, 4));     \
+    tmp = _mm_xor_si128(tmp, _mm_slli_si128(tmp, 4)); \
+    tmp = _mm_xor_si128(tmp, _mm_slli_si128(tmp, 4)); \
+    res = _mm_xor_si128(tmp, tmp_key)
+
+static void
+native_key_expansion128(AESContext *cx, const unsigned char *key)
+{
+    __m128i *keySchedule = cx->keySchedule;
+    pre_align __m128i tmp_key post_align;
+    pre_align __m128i tmp post_align;
+    keySchedule[0] = _mm_loadu_si128((__m128i *)key);
+    EXPAND_KEY128(keySchedule[0], 0x01, keySchedule[1]);
+    EXPAND_KEY128(keySchedule[1], 0x02, keySchedule[2]);
+    EXPAND_KEY128(keySchedule[2], 0x04, keySchedule[3]);
+    EXPAND_KEY128(keySchedule[3], 0x08, keySchedule[4]);
+    EXPAND_KEY128(keySchedule[4], 0x10, keySchedule[5]);
+    EXPAND_KEY128(keySchedule[5], 0x20, keySchedule[6]);
+    EXPAND_KEY128(keySchedule[6], 0x40, keySchedule[7]);
+    EXPAND_KEY128(keySchedule[7], 0x80, keySchedule[8]);
+    EXPAND_KEY128(keySchedule[8], 0x1B, keySchedule[9]);
+    EXPAND_KEY128(keySchedule[9], 0x36, keySchedule[10]);
+}
+
+#define EXPAND_KEY192_PART1(res, k0, kt, rcon)                                \
+    tmp2 = _mm_slli_si128(k0, 4);                                             \
+    tmp1 = _mm_xor_si128(k0, tmp2);                                           \
+    tmp2 = _mm_slli_si128(tmp2, 4);                                           \
+    tmp1 = _mm_xor_si128(_mm_xor_si128(tmp1, tmp2), _mm_slli_si128(tmp2, 4)); \
+    tmp2 = _mm_aeskeygenassist_si128(kt, rcon);                               \
+    res = _mm_xor_si128(tmp1, _mm_shuffle_epi32(tmp2, 0x55))
+
+#define EXPAND_KEY192_PART2(res, k1, k2)             \
+    tmp2 = _mm_xor_si128(k1, _mm_slli_si128(k1, 4)); \
+    res = _mm_xor_si128(tmp2, _mm_shuffle_epi32(k2, 0xFF))
+
+#define EXPAND_KEY192(k0, res1, res2, res3, carry, rcon1, rcon2)         \
+    EXPAND_KEY192_PART1(tmp3, k0, res1, rcon1);                          \
+    EXPAND_KEY192_PART2(carry, res1, tmp3);                              \
+    res1 = _mm_castpd_si128(_mm_shuffle_pd(_mm_castsi128_pd(res1),       \
+                                           _mm_castsi128_pd(tmp3), 0));  \
+    res2 = _mm_castpd_si128(_mm_shuffle_pd(_mm_castsi128_pd(tmp3),       \
+                                           _mm_castsi128_pd(carry), 1)); \
+    EXPAND_KEY192_PART1(res3, tmp3, carry, rcon2)
+
+static void
+native_key_expansion192(AESContext *cx, const unsigned char *key)
+{
+    __m128i *keySchedule = cx->keySchedule;
+    pre_align __m128i tmp1 post_align;
+    pre_align __m128i tmp2 post_align;
+    pre_align __m128i tmp3 post_align;
+    pre_align __m128i carry post_align;
+    keySchedule[0] = _mm_loadu_si128((__m128i *)key);
+    keySchedule[1] = _mm_loadu_si128((__m128i *)(key + 16));
+    EXPAND_KEY192(keySchedule[0], keySchedule[1], keySchedule[2],
+                  keySchedule[3], carry, 0x1, 0x2);
+    EXPAND_KEY192_PART2(keySchedule[4], carry, keySchedule[3]);
+    EXPAND_KEY192(keySchedule[3], keySchedule[4], keySchedule[5],
+                  keySchedule[6], carry, 0x4, 0x8);
+    EXPAND_KEY192_PART2(keySchedule[7], carry, keySchedule[6]);
+    EXPAND_KEY192(keySchedule[6], keySchedule[7], keySchedule[8],
+                  keySchedule[9], carry, 0x10, 0x20);
+    EXPAND_KEY192_PART2(keySchedule[10], carry, keySchedule[9]);
+    EXPAND_KEY192(keySchedule[9], keySchedule[10], keySchedule[11],
+                  keySchedule[12], carry, 0x40, 0x80);
+}
+
+#define EXPAND_KEY256_PART(res, rconx, k1x, k2x, X)                           \
+    tmp_key = _mm_shuffle_epi32(_mm_aeskeygenassist_si128(k2x, rconx), X);    \
+    tmp2 = _mm_slli_si128(k1x, 4);                                            \
+    tmp1 = _mm_xor_si128(k1x, tmp2);                                          \
+    tmp2 = _mm_slli_si128(tmp2, 4);                                           \
+    tmp1 = _mm_xor_si128(_mm_xor_si128(tmp1, tmp2), _mm_slli_si128(tmp2, 4)); \
+    res = _mm_xor_si128(tmp1, tmp_key);
+
+#define EXPAND_KEY256(res1, res2, k1, k2, rcon)   \
+    EXPAND_KEY256_PART(res1, rcon, k1, k2, 0xFF); \
+    EXPAND_KEY256_PART(res2, 0x00, k2, res1, 0xAA)
+
+static void
+native_key_expansion256(AESContext *cx, const unsigned char *key)
+{
+    __m128i *keySchedule = cx->keySchedule;
+    pre_align __m128i tmp_key post_align;
+    pre_align __m128i tmp1 post_align;
+    pre_align __m128i tmp2 post_align;
+    keySchedule[0] = _mm_loadu_si128((__m128i *)key);
+    keySchedule[1] = _mm_loadu_si128((__m128i *)(key + 16));
+    EXPAND_KEY256(keySchedule[2], keySchedule[3], keySchedule[0],
+                  keySchedule[1], 0x01);
+    EXPAND_KEY256(keySchedule[4], keySchedule[5], keySchedule[2],
+                  keySchedule[3], 0x02);
+    EXPAND_KEY256(keySchedule[6], keySchedule[7], keySchedule[4],
+                  keySchedule[5], 0x04);
+    EXPAND_KEY256(keySchedule[8], keySchedule[9], keySchedule[6],
+                  keySchedule[7], 0x08);
+    EXPAND_KEY256(keySchedule[10], keySchedule[11], keySchedule[8],
+                  keySchedule[9], 0x10);
+    EXPAND_KEY256(keySchedule[12], keySchedule[13], keySchedule[10],
+                  keySchedule[11], 0x20);
+    EXPAND_KEY256_PART(keySchedule[14], 0x40, keySchedule[12],
+                       keySchedule[13], 0xFF);
+}
+
+#endif /* NSS_X86_OR_X64 */
+
+/*
+ * AES key expansion using aes-ni instructions.
+ */
+static void
+native_key_expansion(AESContext *cx, const unsigned char *key, unsigned int Nk)
+{
+#ifdef NSS_X86_OR_X64
+    switch (Nk) {
+        case 4:
+            native_key_expansion128(cx, key);
+            return;
+        case 6:
+            native_key_expansion192(cx, key);
+            return;
+        case 8:
+            native_key_expansion256(cx, key);
+            return;
+        default:
+            /* This shouldn't happen. */
+            PORT_Assert(0);
+    }
+#else
+    PORT_Assert(0);
+#endif /* NSS_X86_OR_X64 */
+}
+
+static void
+native_encryptBlock(AESContext *cx,
+                    unsigned char *output,
+                    const unsigned char *input)
+{
+#ifdef NSS_X86_OR_X64
+    int i;
+    pre_align __m128i m post_align = _mm_loadu_si128((__m128i *)input);
+    m = _mm_xor_si128(m, cx->keySchedule[0]);
+    for (i = 1; i < cx->Nr; ++i) {
+        m = _mm_aesenc_si128(m, cx->keySchedule[i]);
+    }
+    m = _mm_aesenclast_si128(m, cx->keySchedule[cx->Nr]);
+    _mm_storeu_si128((__m128i *)output, m);
+#else
+    PORT_Assert(0);
+#endif /* NSS_X86_OR_X64 */
 }
 
 /* rijndael_key_expansion
  *
  * Generate the expanded key from the key input by the user.
  */
-static SECStatus
+static void
 rijndael_key_expansion(AESContext *cx, const unsigned char *key, unsigned int Nk)
 {
     unsigned int i;
@@ -409,8 +557,10 @@ rijndael_key_expansion(AESContext *cx, const unsigned char *key, unsigned int Nk
     PRUint32 *pW;
     PRUint32 tmp;
     unsigned int round_key_words = cx->Nb * (cx->Nr + 1);
-    if (Nk == 7)
-        return rijndael_key_expansion7(cx, key, Nk);
+    if (Nk == 7) {
+        rijndael_key_expansion7(cx, key, Nk);
+        return;
+    }
     W = cx->expandedKey;
     /* The first Nk words contain the input cipher key */
     memcpy(W, key, Nk * 4);
@@ -469,7 +619,6 @@ rijndael_key_expansion(AESContext *cx, const unsigned char *key, unsigned int Nk
             *pW = W[i - Nk] ^ tmp;
         }
     }
-    return SECSuccess;
 }
 
 /* rijndael_invkey_expansion
@@ -477,7 +626,7 @@ rijndael_key_expansion(AESContext *cx, const unsigned char *key, unsigned int Nk
  * Generate the expanded key for the inverse cipher from the key input by
  * the user.
  */
-static SECStatus
+static void
 rijndael_invkey_expansion(AESContext *cx, const unsigned char *key, unsigned int Nk)
 {
     unsigned int r;
@@ -485,8 +634,7 @@ rijndael_invkey_expansion(AESContext *cx, const unsigned char *key, unsigned int
     PRUint8 *b;
     int Nb = cx->Nb;
     /* begins like usual key expansion ... */
-    if (rijndael_key_expansion(cx, key, Nk) != SECSuccess)
-        return SECFailure;
+    rijndael_key_expansion(cx, key, Nk);
     /* ... but has the additional step of InvMixColumn,
      * excepting the first and last round keys.
      */
@@ -528,12 +676,11 @@ rijndael_invkey_expansion(AESContext *cx, const unsigned char *key, unsigned int
                                IMXC2(b[2]) ^ IMXC3(b[3]);
         }
     }
-    return SECSuccess;
 }
+
 /**************************************************************************
  *
- * Stuff related to Rijndael encryption/decryption, optimized for
- * a 128-bit blocksize.
+ * Stuff related to Rijndael encryption/decryption.
  *
  *************************************************************************/
 
@@ -561,7 +708,7 @@ typedef union {
 
 #define STATE_BYTE(i) state.b[i]
 
-static SECStatus NO_SANITIZE_ALIGNMENT
+static void NO_SANITIZE_ALIGNMENT
 rijndael_encryptBlock128(AESContext *cx,
                          unsigned char *output,
                          const unsigned char *input)
@@ -654,7 +801,6 @@ rijndael_encryptBlock128(AESContext *cx,
         memcpy(output, outBuf, sizeof outBuf);
     }
 #endif
-    return SECSuccess;
 }
 
 static SECStatus NO_SANITIZE_ALIGNMENT
@@ -749,104 +895,6 @@ rijndael_decryptBlock128(AESContext *cx,
     return SECSuccess;
 }
 
-/**************************************************************************
- *
- * Stuff related to general Rijndael encryption/decryption, for blocksizes
- * greater than 128 bits.
- *
- * XXX This code is currently untested!  So far, AES specs have only been
- *     released for 128 bit blocksizes.  This will be tested, but for now
- *     only the code above has been tested using known values.
- *
- *************************************************************************/
-
-#define COLUMN(array, j) *((PRUint32 *)(array + j))
-
-SECStatus
-rijndael_encryptBlock(AESContext *cx,
-                      unsigned char *output,
-                      const unsigned char *input)
-{
-    return SECFailure;
-#ifdef rijndael_large_blocks_fixed
-    unsigned int j, r, Nb;
-    unsigned int c2 = 0, c3 = 0;
-    PRUint32 *roundkeyw;
-    PRUint8 clone[RIJNDAEL_MAX_STATE_SIZE];
-    Nb = cx->Nb;
-    roundkeyw = cx->expandedKey;
-    /* Step 1: Add Round Key 0 to initial state */
-    for (j = 0; j < 4 * Nb; j += 4) {
-        COLUMN(clone, j) = COLUMN(input, j) ^ *roundkeyw++;
-    }
-    /* Step 2: Loop over rounds [1..NR-1] */
-    for (r = 1; r < cx->Nr; ++r) {
-        for (j = 0; j < Nb; ++j) {
-            COLUMN(output, j) = T0(STATE_BYTE(4 * j)) ^
-                                T1(STATE_BYTE(4 * ((j + 1) % Nb) + 1)) ^
-                                T2(STATE_BYTE(4 * ((j + c2) % Nb) + 2)) ^
-                                T3(STATE_BYTE(4 * ((j + c3) % Nb) + 3));
-        }
-        for (j = 0; j < 4 * Nb; j += 4) {
-            COLUMN(clone, j) = COLUMN(output, j) ^ *roundkeyw++;
-        }
-    }
-    /* Step 3: Do the last round */
-    /* Final round does not employ MixColumn */
-    for (j = 0; j < Nb; ++j) {
-        COLUMN(output, j) = ((BYTE0WORD(T2(STATE_BYTE(4 * j)))) |
-                             (BYTE1WORD(T3(STATE_BYTE(4 * (j + 1) % Nb) + 1))) |
-                             (BYTE2WORD(T0(STATE_BYTE(4 * (j + c2) % Nb) + 2))) |
-                             (BYTE3WORD(T1(STATE_BYTE(4 * (j + c3) % Nb) + 3)))) ^
-                            *roundkeyw++;
-    }
-    return SECSuccess;
-#endif
-}
-
-SECStatus
-rijndael_decryptBlock(AESContext *cx,
-                      unsigned char *output,
-                      const unsigned char *input)
-{
-    return SECFailure;
-#ifdef rijndael_large_blocks_fixed
-    int j, r, Nb;
-    int c2 = 0, c3 = 0;
-    PRUint32 *roundkeyw;
-    PRUint8 clone[RIJNDAEL_MAX_STATE_SIZE];
-    Nb = cx->Nb;
-    roundkeyw = cx->expandedKey + cx->Nb * cx->Nr + 3;
-    /* reverse key addition */
-    for (j = 4 * Nb; j >= 0; j -= 4) {
-        COLUMN(clone, j) = COLUMN(input, j) ^ *roundkeyw--;
-    }
-    /* Loop over rounds in reverse [NR..1] */
-    for (r = cx->Nr; r > 1; --r) {
-        /* Invert the (InvByteSub*InvMixColumn)(InvShiftRow(state)) */
-        for (j = 0; j < Nb; ++j) {
-            COLUMN(output, 4 * j) = TInv0(STATE_BYTE(4 * j)) ^
-                                    TInv1(STATE_BYTE(4 * (j + Nb - 1) % Nb) + 1) ^
-                                    TInv2(STATE_BYTE(4 * (j + Nb - c2) % Nb) + 2) ^
-                                    TInv3(STATE_BYTE(4 * (j + Nb - c3) % Nb) + 3);
-        }
-        /* Invert the key addition step */
-        for (j = 4 * Nb; j >= 0; j -= 4) {
-            COLUMN(clone, j) = COLUMN(output, j) ^ *roundkeyw--;
-        }
-    }
-    /* inverse sub */
-    for (j = 0; j < 4 * Nb; ++j) {
-        output[j] = SINV(clone[j]);
-    }
-    /* final key addition */
-    for (j = 4 * Nb; j >= 0; j -= 4) {
-        COLUMN(output, j) ^= *roundkeyw--;
-    }
-    return SECSuccess;
-#endif
-}
-
 /**************************************************************************
  *
  *  Rijndael modes of operation (ECB and CBC)
@@ -856,22 +904,21 @@ rijndael_decryptBlock(AESContext *cx,
 static SECStatus
 rijndael_encryptECB(AESContext *cx, unsigned char *output,
                     unsigned int *outputLen, unsigned int maxOutputLen,
-                    const unsigned char *input, unsigned int inputLen,
-                    unsigned int blocksize)
+                    const unsigned char *input, unsigned int inputLen)
 {
-    SECStatus rv;
     AESBlockFunc *encryptor;
 
-    encryptor = (blocksize == RIJNDAEL_MIN_BLOCKSIZE)
-                    ? &rijndael_encryptBlock128
-                    : &rijndael_encryptBlock;
+    if (aesni_support()) {
+        /* Use hardware acceleration for normal AES parameters. */
+        encryptor = &native_encryptBlock;
+    } else {
+        encryptor = &rijndael_encryptBlock128;
+    }
     while (inputLen > 0) {
-        rv = (*encryptor)(cx, output, input);
-        if (rv != SECSuccess)
-            return rv;
-        output += blocksize;
-        input += blocksize;
-        inputLen -= blocksize;
+        (*encryptor)(cx, output, input);
+        output += AES_BLOCK_SIZE;
+        input += AES_BLOCK_SIZE;
+        inputLen -= AES_BLOCK_SIZE;
     }
     return SECSuccess;
 }
@@ -879,58 +926,44 @@ rijndael_encryptECB(AESContext *cx, unsigned char *output,
 static SECStatus
 rijndael_encryptCBC(AESContext *cx, unsigned char *output,
                     unsigned int *outputLen, unsigned int maxOutputLen,
-                    const unsigned char *input, unsigned int inputLen,
-                    unsigned int blocksize)
+                    const unsigned char *input, unsigned int inputLen)
 {
     unsigned int j;
-    SECStatus rv;
-    AESBlockFunc *encryptor;
     unsigned char *lastblock;
-    unsigned char inblock[RIJNDAEL_MAX_STATE_SIZE * 8];
+    unsigned char inblock[AES_BLOCK_SIZE * 8];
 
     if (!inputLen)
         return SECSuccess;
     lastblock = cx->iv;
-    encryptor = (blocksize == RIJNDAEL_MIN_BLOCKSIZE)
-                    ? &rijndael_encryptBlock128
-                    : &rijndael_encryptBlock;
     while (inputLen > 0) {
         /* XOR with the last block (IV if first block) */
-        for (j = 0; j < blocksize; ++j)
+        for (j = 0; j < AES_BLOCK_SIZE; ++j) {
             inblock[j] = input[j] ^ lastblock[j];
+        }
         /* encrypt */
-        rv = (*encryptor)(cx, output, inblock);
-        if (rv != SECSuccess)
-            return rv;
+        rijndael_encryptBlock128(cx, output, inblock);
         /* move to the next block */
         lastblock = output;
-        output += blocksize;
-        input += blocksize;
-        inputLen -= blocksize;
+        output += AES_BLOCK_SIZE;
+        input += AES_BLOCK_SIZE;
+        inputLen -= AES_BLOCK_SIZE;
     }
-    memcpy(cx->iv, lastblock, blocksize);
+    memcpy(cx->iv, lastblock, AES_BLOCK_SIZE);
     return SECSuccess;
 }
 
 static SECStatus
 rijndael_decryptECB(AESContext *cx, unsigned char *output,
                     unsigned int *outputLen, unsigned int maxOutputLen,
-                    const unsigned char *input, unsigned int inputLen,
-                    unsigned int blocksize)
+                    const unsigned char *input, unsigned int inputLen)
 {
-    SECStatus rv;
-    AESBlockFunc *decryptor;
-
-    decryptor = (blocksize == RIJNDAEL_MIN_BLOCKSIZE)
-                    ? &rijndael_decryptBlock128
-                    : &rijndael_decryptBlock;
     while (inputLen > 0) {
-        rv = (*decryptor)(cx, output, input);
-        if (rv != SECSuccess)
-            return rv;
-        output += blocksize;
-        input += blocksize;
-        inputLen -= blocksize;
+        if (rijndael_decryptBlock128(cx, output, input) != SECSuccess) {
+            return SECFailure;
+        }
+        output += AES_BLOCK_SIZE;
+        input += AES_BLOCK_SIZE;
+        inputLen -= AES_BLOCK_SIZE;
     }
     return SECSuccess;
 }
@@ -938,43 +971,37 @@ rijndael_decryptECB(AESContext *cx, unsigned char *output,
 static SECStatus
 rijndael_decryptCBC(AESContext *cx, unsigned char *output,
                     unsigned int *outputLen, unsigned int maxOutputLen,
-                    const unsigned char *input, unsigned int inputLen,
-                    unsigned int blocksize)
+                    const unsigned char *input, unsigned int inputLen)
 {
-    SECStatus rv;
-    AESBlockFunc *decryptor;
     const unsigned char *in;
     unsigned char *out;
     unsigned int j;
-    unsigned char newIV[RIJNDAEL_MAX_BLOCKSIZE];
+    unsigned char newIV[AES_BLOCK_SIZE];
 
     if (!inputLen)
         return SECSuccess;
     PORT_Assert(output - input >= 0 || input - output >= (int)inputLen);
-    decryptor = (blocksize == RIJNDAEL_MIN_BLOCKSIZE)
-                    ? &rijndael_decryptBlock128
-                    : &rijndael_decryptBlock;
-    in = input + (inputLen - blocksize);
-    memcpy(newIV, in, blocksize);
-    out = output + (inputLen - blocksize);
-    while (inputLen > blocksize) {
-        rv = (*decryptor)(cx, out, in);
-        if (rv != SECSuccess)
-            return rv;
-        for (j = 0; j < blocksize; ++j)
-            out[j] ^= in[(int)(j - blocksize)];
-        out -= blocksize;
-        in -= blocksize;
-        inputLen -= blocksize;
+    in = input + (inputLen - AES_BLOCK_SIZE);
+    memcpy(newIV, in, AES_BLOCK_SIZE);
+    out = output + (inputLen - AES_BLOCK_SIZE);
+    while (inputLen > AES_BLOCK_SIZE) {
+        if (rijndael_decryptBlock128(cx, out, in) != SECSuccess) {
+            return SECFailure;
+        }
+        for (j = 0; j < AES_BLOCK_SIZE; ++j)
+            out[j] ^= in[(int)(j - AES_BLOCK_SIZE)];
+        out -= AES_BLOCK_SIZE;
+        in -= AES_BLOCK_SIZE;
+        inputLen -= AES_BLOCK_SIZE;
     }
     if (in == input) {
-        rv = (*decryptor)(cx, out, in);
-        if (rv != SECSuccess)
-            return rv;
-        for (j = 0; j < blocksize; ++j)
+        if (rijndael_decryptBlock128(cx, out, in) != SECSuccess) {
+            return SECFailure;
+        }
+        for (j = 0; j < AES_BLOCK_SIZE; ++j)
             out[j] ^= cx->iv[j];
     }
-    memcpy(cx->iv, newIV, blocksize);
+    memcpy(cx->iv, newIV, AES_BLOCK_SIZE);
     return SECSuccess;
 }
 
@@ -990,7 +1017,14 @@ rijndael_decryptCBC(AESContext *cx, unsigned char *output,
 AESContext *
 AES_AllocateContext(void)
 {
-    return PORT_ZNew(AESContext);
+    /* aligned_alloc is C11 so we have to do it the old way. */
+    AESContext *ctx = PORT_ZAlloc(sizeof(AESContext) + 15);
+    if (ctx == NULL) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
+    ctx->mem = ctx;
+    return (AESContext *)(((uintptr_t)ctx + 15) & ~(uintptr_t)0x0F);
 }
 
 /*
@@ -1000,21 +1034,19 @@ AES_AllocateContext(void)
 */
 static SECStatus
 aes_InitContext(AESContext *cx, const unsigned char *key, unsigned int keysize,
-                const unsigned char *iv, int mode, unsigned int encrypt,
-                unsigned int blocksize)
+                const unsigned char *iv, int mode, unsigned int encrypt)
 {
     unsigned int Nk;
-    /* According to Rijndael AES Proposal, section 12.1, block and key
-     * lengths between 128 and 256 bits are supported, as long as the
+    PRBool use_hw_aes;
+    /* According to AES, block lengths are 128 and key lengths are 128, 192, or
+     * 256 bits. We support other key sizes as well [128, 256] as long as the
      * length in bytes is divisible by 4.
      */
+
     if (key == NULL ||
-        keysize < RIJNDAEL_MIN_BLOCKSIZE ||
-        keysize > RIJNDAEL_MAX_BLOCKSIZE ||
-        keysize % 4 != 0 ||
-        blocksize < RIJNDAEL_MIN_BLOCKSIZE ||
-        blocksize > RIJNDAEL_MAX_BLOCKSIZE ||
-        blocksize % 4 != 0) {
+        keysize < AES_BLOCK_SIZE ||
+        keysize > 32 ||
+        keysize % 4 != 0) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
@@ -1030,21 +1062,16 @@ aes_InitContext(AESContext *cx, const unsigned char *key, unsigned int keysize,
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
-#ifdef USE_HW_AES
-    use_hw_aes = aesni_support() && (keysize % 8) == 0 && blocksize == 16;
-#ifdef INTEL_GCM
-    use_hw_gcm = use_hw_aes && avx_support() && clmul_support();
-#endif
-#endif /* USE_HW_AES */
+    use_hw_aes = aesni_support() && (keysize % 8) == 0;
     /* Nb = (block size in bits) / 32 */
-    cx->Nb = blocksize / 4;
+    cx->Nb = AES_BLOCK_SIZE / 4;
     /* Nk = (key size in bits) / 32 */
     Nk = keysize / 4;
     /* Obtain number of rounds from "table" */
     cx->Nr = RIJNDAEL_NUM_ROUNDS(Nk, cx->Nb);
     /* copy in the iv, if neccessary */
     if (mode == NSS_AES_CBC) {
-        memcpy(cx->iv, iv, blocksize);
+        memcpy(cx->iv, iv, AES_BLOCK_SIZE);
 #ifdef USE_HW_AES
         if (use_hw_aes) {
             cx->worker = (freeblCipherFunc)
@@ -1072,7 +1099,7 @@ aes_InitContext(AESContext *cx, const unsigned char *key, unsigned int keysize,
     PORT_Assert((cx->Nb * (cx->Nr + 1)) <= RIJNDAEL_MAX_EXP_KEY_SIZE);
     if ((cx->Nb * (cx->Nr + 1)) > RIJNDAEL_MAX_EXP_KEY_SIZE) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-        goto cleanup;
+        return SECFailure;
     }
 #ifdef USE_HW_AES
     if (use_hw_aes) {
@@ -1085,25 +1112,28 @@ aes_InitContext(AESContext *cx, const unsigned char *key, unsigned int keysize,
     defined(RIJNDAEL_GENERATE_TABLES_MACRO)
         if (rijndaelTables == NULL) {
             if (PR_CallOnce(&coRTInit, init_rijndael_tables) != PR_SUCCESS) {
-                return SecFailure;
+                return SECFailure;
             }
         }
 #endif
         /* Generate expanded key */
         if (encrypt) {
-            if (rijndael_key_expansion(cx, key, Nk) != SECSuccess)
-                goto cleanup;
+            if (use_hw_aes && (cx->mode == NSS_AES_GCM || cx->mode == NSS_AES ||
+                               cx->mode == NSS_AES_CTR)) {
+                PORT_Assert(keysize == 16 || keysize == 24 || keysize == 32);
+                /* Prepare hardware key for normal AES parameters. */
+                native_key_expansion(cx, key, Nk);
+            } else {
+                rijndael_key_expansion(cx, key, Nk);
+            }
         } else {
-            if (rijndael_invkey_expansion(cx, key, Nk) != SECSuccess)
-                goto cleanup;
+            rijndael_invkey_expansion(cx, key, Nk);
         }
     }
     cx->worker_cx = cx;
     cx->destroy = NULL;
     cx->isBlock = PR_TRUE;
     return SECSuccess;
-cleanup:
-    return SECFailure;
 }
 
 SECStatus
@@ -1115,6 +1145,11 @@ AES_InitContext(AESContext *cx, const unsigned char *key, unsigned int keysize,
     PRBool baseencrypt = encrypt;
     SECStatus rv;
 
+    if (blocksize != AES_BLOCK_SIZE) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return SECFailure;
+    }
+
     switch (mode) {
         case NSS_AES_CTS:
             basemode = NSS_AES_CBC;
@@ -1125,45 +1160,47 @@ AES_InitContext(AESContext *cx, const unsigned char *key, unsigned int keysize,
             baseencrypt = PR_TRUE;
             break;
     }
-    /* make sure enough is initializes so we can safely call Destroy */
+    /* Make sure enough is initialized so we can safely call Destroy. */
     cx->worker_cx = NULL;
     cx->destroy = NULL;
-    rv = aes_InitContext(cx, key, keysize, iv, basemode,
-                         baseencrypt, blocksize);
+    cx->mode = mode;
+    rv = aes_InitContext(cx, key, keysize, iv, basemode, baseencrypt);
     if (rv != SECSuccess) {
         AES_DestroyContext(cx, PR_FALSE);
         return rv;
     }
-    cx->mode = mode;
 
     /* finally, set up any mode specific contexts */
     switch (mode) {
         case NSS_AES_CTS:
-            cx->worker_cx = CTS_CreateContext(cx, cx->worker, iv, blocksize);
+            cx->worker_cx = CTS_CreateContext(cx, cx->worker, iv);
             cx->worker = (freeblCipherFunc)(encrypt ? CTS_EncryptUpdate : CTS_DecryptUpdate);
             cx->destroy = (freeblDestroyFunc)CTS_DestroyContext;
             cx->isBlock = PR_FALSE;
             break;
         case NSS_AES_GCM:
-#ifdef INTEL_GCM
-            if (use_hw_gcm) {
-                cx->worker_cx = intel_AES_GCM_CreateContext(cx, cx->worker, iv, blocksize);
-                cx->worker = (freeblCipherFunc)(encrypt ? intel_AES_GCM_EncryptUpdate : intel_AES_GCM_DecryptUpdate);
+#if defined(INTEL_GCM) && defined(USE_HW_AES)
+            if (aesni_support() && (keysize % 8) == 0 && avx_support() &&
+                clmul_support()) {
+                cx->worker_cx = intel_AES_GCM_CreateContext(cx, cx->worker, iv);
+                cx->worker = (freeblCipherFunc)(encrypt ? intel_AES_GCM_EncryptUpdate
+                                                        : intel_AES_GCM_DecryptUpdate);
                 cx->destroy = (freeblDestroyFunc)intel_AES_GCM_DestroyContext;
                 cx->isBlock = PR_FALSE;
             } else
 #endif
             {
-                cx->worker_cx = GCM_CreateContext(cx, cx->worker, iv, blocksize);
-                cx->worker = (freeblCipherFunc)(encrypt ? GCM_EncryptUpdate : GCM_DecryptUpdate);
+                cx->worker_cx = GCM_CreateContext(cx, cx->worker, iv);
+                cx->worker = (freeblCipherFunc)(encrypt ? GCM_EncryptUpdate
+                                                        : GCM_DecryptUpdate);
                 cx->destroy = (freeblDestroyFunc)GCM_DestroyContext;
                 cx->isBlock = PR_FALSE;
             }
             break;
         case NSS_AES_CTR:
-            cx->worker_cx = CTR_CreateContext(cx, cx->worker, iv, blocksize);
+            cx->worker_cx = CTR_CreateContext(cx, cx->worker, iv);
 #if defined(USE_HW_AES) && defined(_MSC_VER)
-            if (use_hw_aes) {
+            if (aesni_support() && (keysize % 8) == 0) {
                 cx->worker = (freeblCipherFunc)CTR_Update_HW_AES;
             } else
 #endif
@@ -1175,7 +1212,7 @@ AES_InitContext(AESContext *cx, const unsigned char *key, unsigned int keysize,
             break;
         default:
             /* everything has already been set up by aes_InitContext, just
-     * return */
+             * return */
             return SECSuccess;
     }
     /* check to see if we succeeded in getting the worker context */
@@ -1224,8 +1261,9 @@ AES_DestroyContext(AESContext *cx, PRBool freeit)
         cx->worker_cx = NULL;
         cx->destroy = NULL;
     }
-    if (freeit)
-        PORT_Free(cx);
+    if (freeit) {
+        PORT_Free(cx->mem);
+    }
 }
 
 /*
@@ -1239,14 +1277,12 @@ AES_Encrypt(AESContext *cx, unsigned char *output,
             unsigned int *outputLen, unsigned int maxOutputLen,
             const unsigned char *input, unsigned int inputLen)
 {
-    int blocksize;
     /* Check args */
     if (cx == NULL || output == NULL || (input == NULL && inputLen != 0)) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
-    blocksize = 4 * cx->Nb;
-    if (cx->isBlock && (inputLen % blocksize != 0)) {
+    if (cx->isBlock && (inputLen % AES_BLOCK_SIZE != 0)) {
         PORT_SetError(SEC_ERROR_INPUT_LEN);
         return SECFailure;
     }
@@ -1277,7 +1313,7 @@ AES_Encrypt(AESContext *cx, unsigned char *output,
 #endif
 
     return (*cx->worker)(cx->worker_cx, output, outputLen, maxOutputLen,
-                         input, inputLen, blocksize);
+                         input, inputLen, AES_BLOCK_SIZE);
 }
 
 /*
@@ -1291,14 +1327,12 @@ AES_Decrypt(AESContext *cx, unsigned char *output,
             unsigned int *outputLen, unsigned int maxOutputLen,
             const unsigned char *input, unsigned int inputLen)
 {
-    int blocksize;
     /* Check args */
     if (cx == NULL || output == NULL || (input == NULL && inputLen != 0)) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
-    blocksize = 4 * cx->Nb;
-    if (cx->isBlock && (inputLen % blocksize != 0)) {
+    if (cx->isBlock && (inputLen % AES_BLOCK_SIZE != 0)) {
         PORT_SetError(SEC_ERROR_INPUT_LEN);
         return SECFailure;
     }
@@ -1308,5 +1342,5 @@ AES_Decrypt(AESContext *cx, unsigned char *output,
     }
     *outputLen = inputLen;
     return (*cx->worker)(cx->worker_cx, output, outputLen, maxOutputLen,
-                         input, inputLen, blocksize);
+                         input, inputLen, AES_BLOCK_SIZE);
 }
diff --git a/security/nss/lib/freebl/rijndael.h b/security/nss/lib/freebl/rijndael.h
index 0e14ec2fc..1f4a8a9f7 100644
--- a/security/nss/lib/freebl/rijndael.h
+++ b/security/nss/lib/freebl/rijndael.h
@@ -6,13 +6,15 @@
 #define _RIJNDAEL_H_ 1
 
 #include "blapii.h"
+#include <stdint.h>
 
-#define RIJNDAEL_MIN_BLOCKSIZE 16 /* bytes */
-#define RIJNDAEL_MAX_BLOCKSIZE 32 /* bytes */
+#ifdef NSS_X86_OR_X64
+#include <wmmintrin.h> /* aes-ni */
+#endif
 
-typedef SECStatus AESBlockFunc(AESContext *cx,
-                               unsigned char *output,
-                               const unsigned char *input);
+typedef void AESBlockFunc(AESContext *cx,
+                          unsigned char *output,
+                          const unsigned char *input);
 
 /* RIJNDAEL_NUM_ROUNDS
  *
@@ -23,24 +25,18 @@ typedef SECStatus AESBlockFunc(AESContext *cx,
 #define RIJNDAEL_NUM_ROUNDS(Nk, Nb) \
     (PR_MAX(Nk, Nb) + 6)
 
-/* RIJNDAEL_MAX_STATE_SIZE
- *
- * Maximum number of bytes in the state (spec includes up to 256-bit block
- * size)
- */
-#define RIJNDAEL_MAX_STATE_SIZE 32
-
 /*
  * This magic number is (Nb_max * (Nr_max + 1))
  * where Nb_max is the maximum block size in 32-bit words,
  *       Nr_max is the maximum number of rounds, which is Nb_max + 6
  */
-#define RIJNDAEL_MAX_EXP_KEY_SIZE (8 * 15)
+#define RIJNDAEL_MAX_EXP_KEY_SIZE (4 * 15)
 
 /* AESContextStr
  *
  * Values which maintain the state for Rijndael encryption/decryption.
  *
+ * keySchedule - 128-bit registers for the key-schedule
  * iv          - initialization vector for CBC mode
  * Nb          - the number of bytes in a block, specified by user
  * Nr          - the number of rounds, specified by a table
@@ -51,17 +47,23 @@ typedef SECStatus AESBlockFunc(AESContext *cx,
  * isBlock     - is the mode of operation a block cipher or a stream cipher?
  */
 struct AESContextStr {
+    /* NOTE: Offsets to members in this struct are hardcoded in assembly.
+     * Don't change the struct without updating intel-aes.s and intel-gcm.s. */
+    union {
+#if defined(NSS_X86_OR_X64)
+        __m128i keySchedule[15];
+#endif
+        PRUint32 expandedKey[RIJNDAEL_MAX_EXP_KEY_SIZE];
+    };
     unsigned int Nb;
     unsigned int Nr;
     freeblCipherFunc worker;
-    /* NOTE: The offsets of iv and expandedKey are hardcoded in intel-aes.s.
-     * Don't add new members before them without updating intel-aes.s. */
-    unsigned char iv[RIJNDAEL_MAX_BLOCKSIZE];
-    PRUint32 expandedKey[RIJNDAEL_MAX_EXP_KEY_SIZE];
+    unsigned char iv[AES_BLOCK_SIZE];
     freeblDestroyFunc destroy;
     void *worker_cx;
     PRBool isBlock;
     int mode;
+    void *mem; /* Start of the allocated memory to free. */
 };
 
 #endif /* _RIJNDAEL_H_ */
diff --git a/security/nss/lib/freebl/rsa.c b/security/nss/lib/freebl/rsa.c
index 17d1d871e..7354d9317 100644
--- a/security/nss/lib/freebl/rsa.c
+++ b/security/nss/lib/freebl/rsa.c
@@ -321,7 +321,6 @@ RSA_NewKey(int keySizeInBits, SECItem *publicExponent)
     kiter = 0;
     max_attempts = 5 * (keySizeInBits / 2); /* FIPS 186-4 B.3.3 steps 4.7 and 5.8 */
     do {
-        prerr = 0;
         PORT_SetError(0);
         CHECK_SEC_OK(generate_prime(&p, primeLen));
         CHECK_SEC_OK(generate_prime(&q, primeLen));
@@ -348,8 +347,7 @@ RSA_NewKey(int keySizeInBits, SECItem *publicExponent)
         kiter++;
         /* loop until have primes */
     } while (prerr == SEC_ERROR_NEED_RANDOM && kiter < max_attempts);
-    if (prerr)
-        goto cleanup;
+
 cleanup:
     mp_clear(&p);
     mp_clear(&q);
diff --git a/security/nss/lib/freebl/rsapkcs.c b/security/nss/lib/freebl/rsapkcs.c
index c8a15daec..ad18c8b73 100644
--- a/security/nss/lib/freebl/rsapkcs.c
+++ b/security/nss/lib/freebl/rsapkcs.c
@@ -290,10 +290,12 @@ MGF1(HASH_HashType hashAlg,
     const SECHashObject *hash;
     void *hashContext;
     unsigned char C[4];
+    SECStatus rv = SECSuccess;
 
     hash = HASH_GetRawHashObject(hashAlg);
-    if (hash == NULL)
+    if (hash == NULL) {
         return SECFailure;
+    }
 
     hashContext = (*hash->create)();
     rounds = (maskLen + hash->length - 1) / hash->length;
@@ -314,14 +316,19 @@ MGF1(HASH_HashType hashAlg,
             (*hash->end)(hashContext, tempHash, &digestLen, hash->length);
         } else { /* we're in the last round and need to cut the hash */
             temp = (unsigned char *)PORT_Alloc(hash->length);
+            if (!temp) {
+                rv = SECFailure;
+                goto done;
+            }
             (*hash->end)(hashContext, temp, &digestLen, hash->length);
             PORT_Memcpy(tempHash, temp, maskLen - counter * hash->length);
             PORT_Free(temp);
         }
     }
-    (*hash->destroy)(hashContext, PR_TRUE);
 
-    return SECSuccess;
+done:
+    (*hash->destroy)(hashContext, PR_TRUE);
+    return rv;
 }
 
 /* XXX Doesn't set error code */
diff --git a/security/nss/lib/freebl/shvfy.c b/security/nss/lib/freebl/shvfy.c
index af4a34fb0..bd9cd1c94 100644
--- a/security/nss/lib/freebl/shvfy.c
+++ b/security/nss/lib/freebl/shvfy.c
@@ -12,6 +12,7 @@
 #include "prio.h"
 #include "blapi.h"
 #include "seccomon.h"
+#include "secerr.h"
 #include "stdio.h"
 #include "prmem.h"
 #include "hasht.h"
@@ -233,8 +234,12 @@ static char *
 mkCheckFileName(const char *libName)
 {
     int ln_len = PORT_Strlen(libName);
-    char *output = PORT_Alloc(ln_len + sizeof(SGN_SUFFIX));
     int index = ln_len + 1 - sizeof("." SHLIB_SUFFIX);
+    char *output = PORT_Alloc(ln_len + sizeof(SGN_SUFFIX));
+    if (!output) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        return NULL;
+    }
 
     if ((index > 0) &&
         (PORT_Strncmp(&libName[index],
diff --git a/security/nss/lib/freebl/unix_rand.c b/security/nss/lib/freebl/unix_rand.c
index 20c76ec66..24381cb26 100644
--- a/security/nss/lib/freebl/unix_rand.c
+++ b/security/nss/lib/freebl/unix_rand.c
@@ -163,8 +163,6 @@ RNG_kstat(PRUint32 *fed)
 #if defined(SCO) || defined(UNIXWARE) || defined(BSDI) || defined(FREEBSD) || defined(NETBSD) || defined(DARWIN) || defined(OPENBSD) || defined(NTO) || defined(__riscos__) || defined(__GNU__) || defined(__FreeBSD_kernel__) || defined(__NetBSD_kernel__)
 #include <sys/times.h>
 
-#define getdtablesize() sysconf(_SC_OPEN_MAX)
-
 static size_t
 GetHighResClock(void *buf, size_t maxbytes)
 {
@@ -198,8 +196,6 @@ GiveSystemInfo(void)
 #if defined(__svr4) || defined(SVR4)
 #include <sys/systeminfo.h>
 
-#define getdtablesize() sysconf(_SC_OPEN_MAX)
-
 static void
 GiveSystemInfo(void)
 {
@@ -255,8 +251,6 @@ GiveSystemInfo(void)
 #if defined(__hpux)
 #include <sys/unistd.h>
 
-#define getdtablesize() sysconf(_SC_OPEN_MAX)
-
 #if defined(__ia64)
 #include <ia64/sys/inline.h>
 
@@ -376,8 +370,6 @@ GiveSystemInfo(void)
 #include <sys/utsname.h>
 #include <sys/systeminfo.h>
 
-#define getdtablesize() sysconf(_SC_OPEN_MAX)
-
 static size_t
 GetHighResClock(void *buf, size_t maxbytes)
 {
@@ -529,8 +521,6 @@ GetHighResClock(void *buf, size_t maxbuf)
 #if defined(sony)
 #include <sys/systeminfo.h>
 
-#define getdtablesize() sysconf(_SC_OPEN_MAX)
-
 static size_t
 GetHighResClock(void *buf, size_t maxbytes)
 {
@@ -565,8 +555,6 @@ GiveSystemInfo(void)
 int gettimeofday(struct timeval *, struct timezone *);
 int gethostname(char *, int);
 
-#define getdtablesize() sysconf(_SC_OPEN_MAX)
-
 static size_t
 GetHighResClock(void *buf, size_t maxbytes)
 {
@@ -634,8 +622,6 @@ GiveSystemInfo(void)
 #if defined(nec_ews)
 #include <sys/systeminfo.h>
 
-#define getdtablesize() sysconf(_SC_OPEN_MAX)
-
 static size_t
 GetHighResClock(void *buf, size_t maxbytes)
 {
diff --git a/security/nss/lib/nss/nss.gyp b/security/nss/lib/nss/nss.gyp
index 56984d9f1..8f4415701 100644
--- a/security/nss/lib/nss/nss.gyp
+++ b/security/nss/lib/nss/nss.gyp
@@ -33,24 +33,8 @@
         '<(DEPTH)/lib/pki/pki.gyp:nsspki',
         '<(DEPTH)/lib/dev/dev.gyp:nssdev',
         '<(DEPTH)/lib/base/base.gyp:nssb',
+        '<(DEPTH)/lib/libpkix/libpkix.gyp:libpkix',
       ],
-      'conditions': [
-        [ 'disable_libpkix==0', {
-          'dependencies': [
-            '<(DEPTH)/lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
-            '<(DEPTH)/lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
-            '<(DEPTH)/lib/libpkix/pkix/params/params.gyp:pkixparams',
-            '<(DEPTH)/lib/libpkix/pkix/results/results.gyp:pkixresults',
-            '<(DEPTH)/lib/libpkix/pkix/top/top.gyp:pkixtop',
-            '<(DEPTH)/lib/libpkix/pkix/util/util.gyp:pkixutil',
-            '<(DEPTH)/lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
-            '<(DEPTH)/lib/libpkix/pkix/store/store.gyp:pkixstore',
-            '<(DEPTH)/lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
-            '<(DEPTH)/lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
-            '<(DEPTH)/lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule'
-          ],
-          }],
-        ],
     },
     {
       'target_name': 'nss3',
diff --git a/security/nss/lib/nss/nss.h b/security/nss/lib/nss/nss.h
index 002c59e21..61c50054e 100644
--- a/security/nss/lib/nss/nss.h
+++ b/security/nss/lib/nss/nss.h
@@ -22,10 +22,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define NSS_VERSION "3.31.1" _NSS_CUSTOMIZED
+#define NSS_VERSION "3.32" _NSS_CUSTOMIZED
 #define NSS_VMAJOR 3
-#define NSS_VMINOR 31
-#define NSS_VPATCH 1
+#define NSS_VMINOR 32
+#define NSS_VPATCH 0
 #define NSS_VBUILD 0
 #define NSS_BETA PR_FALSE
 
diff --git a/security/nss/lib/pk11wrap/pk11auth.c b/security/nss/lib/pk11wrap/pk11auth.c
index 4ccfad6f1..625fa2dc6 100644
--- a/security/nss/lib/pk11wrap/pk11auth.c
+++ b/security/nss/lib/pk11wrap/pk11auth.c
@@ -704,9 +704,11 @@ PRBool
 PK11_NeedPWInit()
 {
     PK11SlotInfo *slot = PK11_GetInternalKeySlot();
-    PRBool ret = PK11_NeedPWInitForSlot(slot);
-
-    PK11_FreeSlot(slot);
+    PRBool ret = PR_FALSE;
+    if (slot) {
+        ret = PK11_NeedPWInitForSlot(slot);
+        PK11_FreeSlot(slot);
+    }
     return ret;
 }
 
diff --git a/security/nss/lib/pk11wrap/pk11obj.c b/security/nss/lib/pk11wrap/pk11obj.c
index 4046c1f53..47c56154d 100644
--- a/security/nss/lib/pk11wrap/pk11obj.c
+++ b/security/nss/lib/pk11wrap/pk11obj.c
@@ -2028,6 +2028,9 @@ PK11_FindObjectsFromNickname(char *nickname, PK11SlotInfo **slotptr,
     if ((delimit = PORT_Strchr(nickname, ':')) != NULL) {
         int len = delimit - nickname;
         tokenName = (char *)PORT_Alloc(len + 1);
+        if (!tokenName) {
+            return CK_INVALID_HANDLE;
+        }
         PORT_Memcpy(tokenName, nickname, len);
         tokenName[len] = 0;
 
diff --git a/security/nss/lib/pk11wrap/pk11slot.c b/security/nss/lib/pk11wrap/pk11slot.c
index db805c14c..0a6ed6c08 100644
--- a/security/nss/lib/pk11wrap/pk11slot.c
+++ b/security/nss/lib/pk11wrap/pk11slot.c
@@ -2484,7 +2484,11 @@ PK11_RandomUpdate(void *data, size_t bytes)
 
     if (!bestIsInternal) {
         /* do internal slot, too. */
-        slot = PK11_GetInternalSlot(); /* can't fail */
+        slot = PK11_GetInternalSlot();
+        PORT_Assert(slot);
+        if (!slot) {
+            return SECFailure;
+        }
         status = PK11_SeedRandom(slot, data, bytes);
         PK11_FreeSlot(slot);
     }
diff --git a/security/nss/lib/softoken/fipstokn.c b/security/nss/lib/softoken/fipstokn.c
index 12ff77cf8..fd4fd4207 100644
--- a/security/nss/lib/softoken/fipstokn.c
+++ b/security/nss/lib/softoken/fipstokn.c
@@ -36,7 +36,7 @@
 #ifdef LINUX
 #include <pthread.h>
 #include <dlfcn.h>
-#define LIBAUDIT_NAME "libaudit.so.0"
+#define LIBAUDIT_NAME "libaudit.so.1"
 #ifndef AUDIT_CRYPTO_TEST_USER
 #define AUDIT_CRYPTO_TEST_USER 2400         /* Crypto test results */
 #define AUDIT_CRYPTO_PARAM_CHANGE_USER 2401 /* Crypto attribute change */
diff --git a/security/nss/lib/softoken/pkcs11c.c b/security/nss/lib/softoken/pkcs11c.c
index e2904953b..0234aa431 100644
--- a/security/nss/lib/softoken/pkcs11c.c
+++ b/security/nss/lib/softoken/pkcs11c.c
@@ -2639,6 +2639,11 @@ NSC_SignInit(CK_SESSION_HANDLE hSession,
 
 #define INIT_HMAC_MECH(mmm)                                               \
     case CKM_##mmm##_HMAC_GENERAL:                                        \
+        PORT_Assert(pMechanism->pParameter);                              \
+        if (!pMechanism->pParameter) {                                    \
+            crv = CKR_MECHANISM_PARAM_INVALID;                            \
+            break;                                                        \
+        }                                                                 \
         crv = sftk_doHMACInit(context, HASH_Alg##mmm, key,                \
                               *(CK_ULONG *)pMechanism->pParameter);       \
         break;                                                            \
@@ -2654,6 +2659,11 @@ NSC_SignInit(CK_SESSION_HANDLE hSession,
             INIT_HMAC_MECH(SHA512)
 
         case CKM_SHA_1_HMAC_GENERAL:
+            PORT_Assert(pMechanism->pParameter);
+            if (!pMechanism->pParameter) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
             crv = sftk_doHMACInit(context, HASH_AlgSHA1, key,
                                   *(CK_ULONG *)pMechanism->pParameter);
             break;
@@ -2662,10 +2672,20 @@ NSC_SignInit(CK_SESSION_HANDLE hSession,
             break;
 
         case CKM_SSL3_MD5_MAC:
+            PORT_Assert(pMechanism->pParameter);
+            if (!pMechanism->pParameter) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
             crv = sftk_doSSLMACInit(context, SEC_OID_MD5, key,
                                     *(CK_ULONG *)pMechanism->pParameter);
             break;
         case CKM_SSL3_SHA1_MAC:
+            PORT_Assert(pMechanism->pParameter);
+            if (!pMechanism->pParameter) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
             crv = sftk_doSSLMACInit(context, SEC_OID_SHA1, key,
                                     *(CK_ULONG *)pMechanism->pParameter);
             break;
@@ -3314,6 +3334,11 @@ NSC_VerifyInit(CK_SESSION_HANDLE hSession,
             INIT_HMAC_MECH(SHA512)
 
         case CKM_SHA_1_HMAC_GENERAL:
+            PORT_Assert(pMechanism->pParameter);
+            if (!pMechanism->pParameter) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
             crv = sftk_doHMACInit(context, HASH_AlgSHA1, key,
                                   *(CK_ULONG *)pMechanism->pParameter);
             break;
@@ -3322,10 +3347,20 @@ NSC_VerifyInit(CK_SESSION_HANDLE hSession,
             break;
 
         case CKM_SSL3_MD5_MAC:
+            PORT_Assert(pMechanism->pParameter);
+            if (!pMechanism->pParameter) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
             crv = sftk_doSSLMACInit(context, SEC_OID_MD5, key,
                                     *(CK_ULONG *)pMechanism->pParameter);
             break;
         case CKM_SSL3_SHA1_MAC:
+            PORT_Assert(pMechanism->pParameter);
+            if (!pMechanism->pParameter) {
+                crv = CKR_MECHANISM_PARAM_INVALID;
+                break;
+            }
             crv = sftk_doSSLMACInit(context, SEC_OID_SHA1, key,
                                     *(CK_ULONG *)pMechanism->pParameter);
             break;
diff --git a/security/nss/lib/softoken/softkver.h b/security/nss/lib/softoken/softkver.h
index c3d461e39..bfc16afb2 100644
--- a/security/nss/lib/softoken/softkver.h
+++ b/security/nss/lib/softoken/softkver.h
@@ -21,10 +21,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
  */
-#define SOFTOKEN_VERSION "3.31.1" SOFTOKEN_ECC_STRING
+#define SOFTOKEN_VERSION "3.32" SOFTOKEN_ECC_STRING
 #define SOFTOKEN_VMAJOR 3
-#define SOFTOKEN_VMINOR 31
-#define SOFTOKEN_VPATCH 1
+#define SOFTOKEN_VMINOR 32
+#define SOFTOKEN_VPATCH 0
 #define SOFTOKEN_VBUILD 0
 #define SOFTOKEN_BETA PR_FALSE
 
diff --git a/security/nss/lib/ssl/dtlscon.c b/security/nss/lib/ssl/dtlscon.c
index b33dc2a77..fbd1779db 100644
--- a/security/nss/lib/ssl/dtlscon.c
+++ b/security/nss/lib/ssl/dtlscon.c
@@ -236,7 +236,7 @@ dtls_RetransmitDetected(sslSocket *ss)
 }
 
 static SECStatus
-dtls_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *data, PRBool last)
+dtls_HandleHandshakeMessage(sslSocket *ss, PRUint8 *data, PRBool last)
 {
 
     /* At this point we are advancing our state machine, so we can free our last
@@ -482,7 +482,7 @@ dtls_HandleHandshake(sslSocket *ss, sslBuffer *origBuf)
  */
 SECStatus
 dtls_QueueMessage(sslSocket *ss, SSL3ContentType type,
-                  const SSL3Opaque *pIn, PRInt32 nIn)
+                  const PRUint8 *pIn, PRInt32 nIn)
 {
     SECStatus rv = SECSuccess;
     DTLSQueuedMessage *msg = NULL;
@@ -941,7 +941,7 @@ dtls_SetMTU(sslSocket *ss, PRUint16 advertised)
  * Caller must hold Handshake and RecvBuf locks.
  */
 SECStatus
-dtls_HandleHelloVerifyRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+dtls_HandleHelloVerifyRequest(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     int errCode = SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST;
     SECStatus rv;
diff --git a/security/nss/lib/ssl/manifest.mn b/security/nss/lib/ssl/manifest.mn
index e7564edb2..fbb88baff 100644
--- a/security/nss/lib/ssl/manifest.mn
+++ b/security/nss/lib/ssl/manifest.mn
@@ -25,6 +25,7 @@ CSRCS = \
         sslauth.c \
         sslcon.c \
         ssldef.c \
+        ssl3encode.c \
         sslenum.c \
         sslerr.c \
         sslerrstrs.c \
@@ -41,6 +42,7 @@ CSRCS = \
         sslver.c \
         authcert.c \
         cmpcert.c \
+        selfencrypt.c \
         sslinfo.c \
         ssl3ecc.c \
         tls13con.c \
diff --git a/security/nss/lib/ssl/ssl.gyp b/security/nss/lib/ssl/ssl.gyp
index 175d1cecf..03b2d6014 100644
--- a/security/nss/lib/ssl/ssl.gyp
+++ b/security/nss/lib/ssl/ssl.gyp
@@ -14,8 +14,10 @@
         'cmpcert.c',
         'dtlscon.c',
         'prelib.c',
+        'selfencrypt.c',
         'ssl3con.c',
         'ssl3ecc.c',
+        'ssl3encode.c',
         'ssl3ext.c',
         'ssl3exthandle.c',
         'ssl3gthr.c',
diff --git a/security/nss/lib/ssl/ssl.h b/security/nss/lib/ssl/ssl.h
index f19c2defb..7e538ac1f 100644
--- a/security/nss/lib/ssl/ssl.h
+++ b/security/nss/lib/ssl/ssl.h
@@ -394,7 +394,7 @@ SSL_IMPORT SECStatus SSL_SignaturePrefGet(
 ** can be set or retrieved using SSL_SignatureSchemePrefSet or
 ** SSL_SignatureSchemePrefGet.
 */
-SSL_IMPORT unsigned int SSL_SignatureMaxCount();
+SSL_IMPORT unsigned int SSL_SignatureMaxCount(void);
 
 /*
 ** Define custom priorities for EC and FF groups used in DH key exchange and EC
@@ -942,6 +942,9 @@ SSL_ConfigSecureServerWithCertChain(PRFileDesc *fd, CERTCertificate *cert,
 ** associated with a configured certificate to perform session ticket
 ** encryption.  If this function isn't used, the keys provided with a configured
 ** RSA certificate are used for wrapping session ticket keys.
+**
+** NOTE: This key is used for all self-encryption but is named for
+** session tickets for historical reasons.
 */
 SSL_IMPORT SECStatus
 SSL_SetSessionTicketKeyPair(SECKEYPublicKey *pubKey, SECKEYPrivateKey *privKey);
diff --git a/security/nss/lib/ssl/ssl3con.c b/security/nss/lib/ssl/ssl3con.c
index 5d3bd0761..686ac5514 100644
--- a/security/nss/lib/ssl/ssl3con.c
+++ b/security/nss/lib/ssl/ssl3con.c
@@ -57,7 +57,7 @@ static SECStatus ssl3_HandleServerHelloPart2(sslSocket *ss,
                                              const SECItem *sidBytes,
                                              int *retErrCode);
 static SECStatus ssl3_HandlePostHelloHandshakeMessage(sslSocket *ss,
-                                                      SSL3Opaque *b,
+                                                      PRUint8 *b,
                                                       PRUint32 length,
                                                       SSL3Hashes *hashesPtr);
 static SECStatus ssl3_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags);
@@ -1072,7 +1072,7 @@ ssl3_NegotiateVersion(sslSocket *ss, SSL3ProtocolVersion peerVersion,
 /* Used by the client when the server produces a version number.
  * This reads, validates, and normalizes the value. */
 SECStatus
-ssl_ClientReadVersion(sslSocket *ss, SSL3Opaque **b, unsigned int *len,
+ssl_ClientReadVersion(sslSocket *ss, PRUint8 **b, unsigned int *len,
                       SSL3ProtocolVersion *version)
 {
     SSL3ProtocolVersion v;
@@ -2216,7 +2216,7 @@ ssl3_ComputeRecordMAC(
     PRBool useServerMacKey,
     const unsigned char *header,
     unsigned int headerLen,
-    const SSL3Opaque *input,
+    const PRUint8 *input,
     int inputLength,
     unsigned char *outbuf,
     unsigned int *outLength)
@@ -2263,7 +2263,7 @@ ssl3_ComputeRecordMACConstantTime(
     PRBool useServerMacKey,
     const unsigned char *header,
     unsigned int headerLen,
-    const SSL3Opaque *input,
+    const PRUint8 *input,
     int inputLen,
     int originalLen,
     unsigned char *outbuf,
@@ -2368,7 +2368,7 @@ ssl3_CompressMACEncryptRecord(ssl3CipherSpec *cwSpec,
                               PRBool isDTLS,
                               PRBool capRecordVersion,
                               SSL3ContentType type,
-                              const SSL3Opaque *pIn,
+                              const PRUint8 *pIn,
                               PRUint32 contentLen,
                               sslBuffer *wrBuf)
 {
@@ -2537,7 +2537,7 @@ ssl3_CompressMACEncryptRecord(ssl3CipherSpec *cwSpec,
 SECStatus
 ssl_ProtectRecord(sslSocket *ss, ssl3CipherSpec *cwSpec,
                   PRBool capRecordVersion, SSL3ContentType type,
-                  const SSL3Opaque *pIn, PRUint32 contentLen, sslBuffer *wrBuf)
+                  const PRUint8 *pIn, PRUint32 contentLen, sslBuffer *wrBuf)
 {
     const ssl3BulkCipherDef *cipher_def = cwSpec->cipher_def;
     PRUint16 headerLen;
@@ -2654,8 +2654,8 @@ PRInt32
 ssl3_SendRecord(sslSocket *ss,
                 ssl3CipherSpec *cwSpec, /* non-NULL for DTLS retransmits */
                 SSL3ContentType type,
-                const SSL3Opaque *pIn, /* input buffer */
-                PRInt32 nIn,           /* bytes of input */
+                const PRUint8 *pIn, /* input buffer */
+                PRInt32 nIn,        /* bytes of input */
                 PRInt32 flags)
 {
     sslBuffer *wrBuf = &ss->sec.writeBuf;
@@ -4219,7 +4219,7 @@ ssl3_AppendHandshakeNumber(sslSocket *ss, PRInt32 num, PRInt32 lenSize)
 
 SECStatus
 ssl3_AppendHandshakeVariable(
-    sslSocket *ss, const SSL3Opaque *src, PRInt32 bytes, PRInt32 lenSize)
+    sslSocket *ss, const PRUint8 *src, PRInt32 bytes, PRInt32 lenSize)
 {
     SECStatus rv;
 
@@ -4306,7 +4306,7 @@ ssl3_AppendHandshakeHeader(sslSocket *ss, SSL3HandshakeType t, PRUint32 length)
  * override the generic error code by setting another.
  */
 SECStatus
-ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRUint32 bytes, SSL3Opaque **b,
+ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRUint32 bytes, PRUint8 **b,
                       PRUint32 *length)
 {
     PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
@@ -4331,7 +4331,7 @@ ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRUint32 bytes, SSL3Opaque **b,
  */
 SECStatus
 ssl3_ConsumeHandshakeNumber(sslSocket *ss, PRUint32 *num, PRUint32 bytes,
-                            SSL3Opaque **b, PRUint32 *length)
+                            PRUint8 **b, PRUint32 *length)
 {
     PRUint8 *buf = *b;
     int i;
@@ -4369,7 +4369,7 @@ ssl3_ConsumeHandshakeNumber(sslSocket *ss, PRUint32 *num, PRUint32 bytes,
  */
 SECStatus
 ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i, PRUint32 bytes,
-                              SSL3Opaque **b, PRUint32 *length)
+                              PRUint8 **b, PRUint32 *length)
 {
     PRUint32 count;
     SECStatus rv;
@@ -4394,19 +4394,6 @@ ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i, PRUint32 bytes,
     return SECSuccess;
 }
 
-/* Helper function to encode an unsigned integer into a buffer. */
-PRUint8 *
-ssl_EncodeUintX(PRUint64 value, unsigned int bytes, PRUint8 *to)
-{
-    PRUint64 encoded;
-
-    PORT_Assert(bytes > 0 && bytes <= sizeof(encoded));
-
-    encoded = PR_htonll(value);
-    memcpy(to, ((unsigned char *)(&encoded)) + (sizeof(encoded) - bytes), bytes);
-    return to + bytes;
-}
-
 /* ssl3_TLSHashAlgorithmToOID converts a TLS hash identifier into an OID value.
  * If the hash is not recognised, SEC_OID_UNKNOWN is returned.
  *
@@ -4651,7 +4638,7 @@ ssl_IsRsaPssSignatureScheme(SSLSignatureScheme scheme)
  *
  * See https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */
 SECStatus
-ssl_ConsumeSignatureScheme(sslSocket *ss, SSL3Opaque **b,
+ssl_ConsumeSignatureScheme(sslSocket *ss, PRUint8 **b,
                            PRUint32 *length, SSLSignatureScheme *out)
 {
     PRUint32 tmp;
@@ -4717,8 +4704,8 @@ ssl3_ComputeHandshakeHashes(sslSocket *ss,
     SECStatus rv = SECSuccess;
     PRBool isTLS = (PRBool)(spec->version > SSL_LIBRARY_VERSION_3_0);
     unsigned int outLength;
-    SSL3Opaque md5_inner[MAX_MAC_LENGTH];
-    SSL3Opaque sha_inner[MAX_MAC_LENGTH];
+    PRUint8 md5_inner[MAX_MAC_LENGTH];
+    PRUint8 sha_inner[MAX_MAC_LENGTH];
 
     PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
     if (ss->ssl3.hs.hashType == handshake_hash_unknown) {
@@ -6603,7 +6590,7 @@ ssl3_SetCipherSuite(sslSocket *ss, ssl3CipherSuite chosenSuite,
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_HandleServerHello(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     PRUint32 temp;
     PRBool suite_found = PR_FALSE;
@@ -7084,7 +7071,7 @@ loser:
 }
 
 static SECStatus
-ssl_HandleDHServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl_HandleDHServerKeyExchange(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SECStatus rv;
     int errCode = SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH;
@@ -7244,7 +7231,7 @@ loser:
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-ssl3_HandleServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_HandleServerKeyExchange(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SECStatus rv;
 
@@ -7295,7 +7282,7 @@ typedef struct dnameNode {
  * tls13_HandleCertificateRequest
  */
 SECStatus
-ssl3_ParseCertificateRequestCAs(sslSocket *ss, SSL3Opaque **b, PRUint32 *length,
+ssl3_ParseCertificateRequestCAs(sslSocket *ss, PRUint8 **b, PRUint32 *length,
                                 PLArenaPool *arena, CERTDistNames *ca_list)
 {
     PRUint32 remaining;
@@ -7439,7 +7426,7 @@ done:
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-ssl3_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_HandleCertificateRequest(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     PLArenaPool *arena = NULL;
     PRBool isTLS = PR_FALSE;
@@ -8285,7 +8272,7 @@ ssl3_SelectServerCert(sslSocket *ss)
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-ssl3_HandleClientHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_HandleClientHello(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     sslSessionID *sid = NULL;
     PRUint32 tmp;
@@ -8532,7 +8519,7 @@ ssl3_HandleClientHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
         for (i = 0; i + 1 < suites.len; i += 2) {
             PRUint16 suite_i = (suites.data[i] << 8) | suites.data[i + 1];
             if (suite_i == TLS_EMPTY_RENEGOTIATION_INFO_SCSV) {
-                SSL3Opaque *b2 = (SSL3Opaque *)emptyRIext;
+                PRUint8 *b2 = (PRUint8 *)emptyRIext;
                 PRUint32 L2 = sizeof emptyRIext;
                 (void)ssl3_HandleExtensions(ss, &b2, &L2, client_hello);
                 break;
@@ -9220,7 +9207,7 @@ suite_found:
     for (i = 0; i + 2 < suite_length; i += 3) {
         PRUint32 suite_i = (suites[i] << 16) | (suites[i + 1] << 8) | suites[i + 2];
         if (suite_i == TLS_EMPTY_RENEGOTIATION_INFO_SCSV) {
-            SSL3Opaque *b2 = (SSL3Opaque *)emptyRIext;
+            PRUint8 *b2 = (PRUint8 *)emptyRIext;
             PRUint32 L2 = sizeof emptyRIext;
             (void)ssl3_HandleExtensions(ss, &b2, &L2, client_hello);
             break;
@@ -9716,7 +9703,7 @@ ssl3_SendServerHelloDone(sslSocket *ss)
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-ssl3_HandleCertificateVerify(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+ssl3_HandleCertificateVerify(sslSocket *ss, PRUint8 *b, PRUint32 length,
                              SSL3Hashes *hashes)
 {
     SECItem signed_hash = { siBuffer, NULL, 0 };
@@ -9904,7 +9891,7 @@ ssl3_GenerateRSAPMS(sslSocket *ss, ssl3CipherSpec *spec,
  */
 static SECStatus
 ssl3_HandleRSAClientKeyExchange(sslSocket *ss,
-                                SSL3Opaque *b,
+                                PRUint8 *b,
                                 PRUint32 length,
                                 sslKeyPair *serverKeyPair)
 {
@@ -10031,7 +10018,7 @@ ssl3_HandleRSAClientKeyExchange(sslSocket *ss,
 
 static SECStatus
 ssl3_HandleDHClientKeyExchange(sslSocket *ss,
-                               SSL3Opaque *b,
+                               PRUint8 *b,
                                PRUint32 length,
                                sslKeyPair *serverKeyPair)
 {
@@ -10089,7 +10076,7 @@ ssl3_HandleDHClientKeyExchange(sslSocket *ss,
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-ssl3_HandleClientKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_HandleClientKeyExchange(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     sslKeyPair *serverKeyPair = NULL;
     SECStatus rv;
@@ -10240,7 +10227,7 @@ loser:
 }
 
 static SECStatus
-ssl3_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_HandleNewSessionTicket(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SECStatus rv;
     SECItem ticketData;
@@ -10551,7 +10538,7 @@ ssl3_CleanupPeerCerts(sslSocket *ss)
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-ssl3_HandleCertificateStatus(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_HandleCertificateStatus(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SECStatus rv;
 
@@ -10570,7 +10557,7 @@ ssl3_HandleCertificateStatus(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
 }
 
 SECStatus
-ssl_ReadCertificateStatus(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl_ReadCertificateStatus(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     PRUint32 status, len;
     SECStatus rv;
@@ -10618,7 +10605,7 @@ ssl_ReadCertificateStatus(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-ssl3_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_HandleCertificate(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SSL_TRC(3, ("%d: SSL3[%d]: handle certificate handshake",
                 SSL_GETPID(), ss->fd));
@@ -10638,7 +10625,7 @@ ssl3_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
 /* Called from ssl3_HandleCertificate
  */
 SECStatus
-ssl3_CompleteHandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_CompleteHandleCertificate(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     ssl3CertNode *c;
     ssl3CertNode *lastCert = NULL;
@@ -11377,7 +11364,7 @@ ssl3_CacheWrappedMasterSecret(sslSocket *ss, sslSessionID *sid,
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+ssl3_HandleFinished(sslSocket *ss, PRUint8 *b, PRUint32 length,
                     const SSL3Hashes *hashes)
 {
     sslSessionID *sid = ss->sec.ci.sid;
@@ -11638,7 +11625,7 @@ ssl3_FinishHandshake(sslSocket *ss)
  * Caller must hold Handshake and RecvBuf locks.
  */
 SECStatus
-ssl3_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+ssl3_HandleHandshakeMessage(sslSocket *ss, PRUint8 *b, PRUint32 length,
                             PRBool endOfRecord)
 {
     SECStatus rv = SECSuccess;
@@ -11824,7 +11811,7 @@ ssl3_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
 }
 
 static SECStatus
-ssl3_HandlePostHelloHandshakeMessage(sslSocket *ss, SSL3Opaque *b,
+ssl3_HandlePostHelloHandshakeMessage(sslSocket *ss, PRUint8 *b,
                                      PRUint32 length, SSL3Hashes *hashesPtr)
 {
     SECStatus rv;
@@ -12192,7 +12179,7 @@ ssl_RemoveTLSCBCPadding(sslBuffer *plaintext, unsigned int macSize)
 static void
 ssl_CBCExtractMAC(sslBuffer *plaintext,
                   unsigned int originalLength,
-                  SSL3Opaque *out,
+                  PRUint8 *out,
                   unsigned int macSize)
 {
     unsigned char rotatedMac[MAX_MAC_LENGTH];
@@ -12303,9 +12290,9 @@ ssl3_UnprotectRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *plaintext,
     unsigned int originalLen = 0;
     unsigned char header[13];
     unsigned int headerLen;
-    SSL3Opaque hash[MAX_MAC_LENGTH];
-    SSL3Opaque givenHashBuf[MAX_MAC_LENGTH];
-    SSL3Opaque *givenHash;
+    PRUint8 hash[MAX_MAC_LENGTH];
+    PRUint8 givenHashBuf[MAX_MAC_LENGTH];
+    PRUint8 *givenHash;
     unsigned int hashBytes = MAX_MAC_LENGTH + 1;
     SECStatus rv;
 
@@ -12336,7 +12323,7 @@ ssl3_UnprotectRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *plaintext,
          * component." Instead, we decrypt the first cipher block and then
          * discard it before decrypting the rest.
          */
-        SSL3Opaque iv[MAX_IV_LENGTH];
+        PRUint8 iv[MAX_IV_LENGTH];
         int decoded;
 
         ivLen = cipher_def->iv_size;
@@ -13120,7 +13107,7 @@ SSL_SignaturePrefGet(PRFileDesc *fd, SSLSignatureAndHashAlg *algorithms,
 }
 
 unsigned int
-SSL_SignatureMaxCount()
+SSL_SignatureMaxCount(void)
 {
     return MAX_SIGNATURE_SCHEMES;
 }
diff --git a/security/nss/lib/ssl/ssl3ecc.c b/security/nss/lib/ssl/ssl3ecc.c
index 2b2a61116..b440b4b02 100644
--- a/security/nss/lib/ssl/ssl3ecc.c
+++ b/security/nss/lib/ssl/ssl3ecc.c
@@ -267,7 +267,7 @@ tls13_EncodeECDHEKeyShareKEX(const sslSocket *ss, const SECKEYPublicKey *pubKey)
 ** Called from ssl3_HandleClientKeyExchange()
 */
 SECStatus
-ssl3_HandleECDHClientKeyExchange(sslSocket *ss, SSL3Opaque *b,
+ssl3_HandleECDHClientKeyExchange(sslSocket *ss, PRUint8 *b,
                                  PRUint32 length,
                                  sslKeyPair *serverKeyPair)
 {
@@ -341,7 +341,7 @@ ssl3_HandleECDHClientKeyExchange(sslSocket *ss, SSL3Opaque *b,
 */
 SECStatus
 ssl_ImportECDHKeyShare(sslSocket *ss, SECKEYPublicKey *peerKey,
-                       SSL3Opaque *b, PRUint32 length,
+                       PRUint8 *b, PRUint32 length,
                        const sslNamedGroupDef *ecGroup)
 {
     SECStatus rv;
@@ -498,7 +498,7 @@ ssl_CreateECDHEphemeralKeyPair(const sslSocket *ss,
 }
 
 SECStatus
-ssl3_HandleECDHServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+ssl3_HandleECDHServerKeyExchange(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     PLArenaPool *arena = NULL;
     SECKEYPublicKey *peerKey = NULL;
diff --git a/security/nss/lib/ssl/ssl3ext.c b/security/nss/lib/ssl/ssl3ext.c
index 7700be2e8..271084cf7 100644
--- a/security/nss/lib/ssl/ssl3ext.c
+++ b/security/nss/lib/ssl/ssl3ext.c
@@ -172,7 +172,7 @@ ssl3_ClientExtensionAdvertised(const sslSocket *ss, PRUint16 ex_type)
  * buffer so they can only be used during ClientHello processing.
  */
 SECStatus
-ssl3_ParseExtensions(sslSocket *ss, SSL3Opaque **b, PRUint32 *length)
+ssl3_ParseExtensions(sslSocket *ss, PRUint8 **b, PRUint32 *length)
 {
     /* Clean out the extensions list. */
     ssl3_DestroyRemoteExtensions(&ss->ssl3.hs.remoteExtensions);
@@ -360,7 +360,7 @@ ssl3_HandleParsedExtensions(sslSocket *ss,
  * ssl3_HandleParsedExtensions. */
 SECStatus
 ssl3_HandleExtensions(sslSocket *ss,
-                      SSL3Opaque **b, PRUint32 *length,
+                      PRUint8 **b, PRUint32 *length,
                       SSL3HandshakeType handshakeMessage)
 {
     SECStatus rv;
@@ -500,7 +500,7 @@ ssl3_ExtAppendHandshakeNumber(const sslSocket *ss, PRInt32 num,
 
 SECStatus
 ssl3_ExtAppendHandshakeVariable(const sslSocket *ss,
-                                const SSL3Opaque *src, PRInt32 bytes,
+                                const PRUint8 *src, PRInt32 bytes,
                                 PRInt32 lenSize)
 {
     return ssl3_AppendHandshakeVariable((sslSocket *)ss, src, bytes, lenSize);
@@ -521,21 +521,21 @@ ssl3_ExtDecodeError(const sslSocket *ss)
 
 SECStatus
 ssl3_ExtConsumeHandshake(const sslSocket *ss, void *v, PRUint32 bytes,
-                         SSL3Opaque **b, PRUint32 *length)
+                         PRUint8 **b, PRUint32 *length)
 {
     return ssl3_ConsumeHandshake((sslSocket *)ss, v, bytes, b, length);
 }
 
 SECStatus
 ssl3_ExtConsumeHandshakeNumber(const sslSocket *ss, PRUint32 *num,
-                               PRUint32 bytes, SSL3Opaque **b, PRUint32 *length)
+                               PRUint32 bytes, PRUint8 **b, PRUint32 *length)
 {
     return ssl3_ConsumeHandshakeNumber((sslSocket *)ss, num, bytes, b, length);
 }
 
 SECStatus
 ssl3_ExtConsumeHandshakeVariable(const sslSocket *ss, SECItem *i,
-                                 PRUint32 bytes, SSL3Opaque **b,
+                                 PRUint32 bytes, PRUint8 **b,
                                  PRUint32 *length)
 {
     return ssl3_ConsumeHandshakeVariable((sslSocket *)ss, i, bytes, b, length);
diff --git a/security/nss/lib/ssl/ssl3ext.h b/security/nss/lib/ssl/ssl3ext.h
index 0aff52399..90407375a 100644
--- a/security/nss/lib/ssl/ssl3ext.h
+++ b/security/nss/lib/ssl/ssl3ext.h
@@ -111,10 +111,10 @@ typedef struct TLSExtensionStr {
 } TLSExtension;
 
 SECStatus ssl3_HandleExtensions(sslSocket *ss,
-                                SSL3Opaque **b, PRUint32 *length,
+                                PRUint8 **b, PRUint32 *length,
                                 SSL3HandshakeType handshakeMessage);
 SECStatus ssl3_ParseExtensions(sslSocket *ss,
-                               SSL3Opaque **b, PRUint32 *length);
+                               PRUint8 **b, PRUint32 *length);
 SECStatus ssl3_HandleParsedExtensions(sslSocket *ss,
                                       SSL3HandshakeType handshakeMessage);
 TLSExtension *ssl3_FindExtension(sslSocket *ss,
@@ -142,18 +142,18 @@ SECStatus ssl3_ExtAppendHandshake(const sslSocket *ss, const void *void_src,
 SECStatus ssl3_ExtAppendHandshakeNumber(const sslSocket *ss, PRInt32 num,
                                         PRInt32 lenSize);
 SECStatus ssl3_ExtAppendHandshakeVariable(const sslSocket *ss,
-                                          const SSL3Opaque *src, PRInt32 bytes,
+                                          const PRUint8 *src, PRInt32 bytes,
                                           PRInt32 lenSize);
 void ssl3_ExtSendAlert(const sslSocket *ss, SSL3AlertLevel level,
                        SSL3AlertDescription desc);
 void ssl3_ExtDecodeError(const sslSocket *ss);
 SECStatus ssl3_ExtConsumeHandshake(const sslSocket *ss, void *v, PRUint32 bytes,
-                                   SSL3Opaque **b, PRUint32 *length);
+                                   PRUint8 **b, PRUint32 *length);
 SECStatus ssl3_ExtConsumeHandshakeNumber(const sslSocket *ss, PRUint32 *num,
-                                         PRUint32 bytes, SSL3Opaque **b,
+                                         PRUint32 bytes, PRUint8 **b,
                                          PRUint32 *length);
 SECStatus ssl3_ExtConsumeHandshakeVariable(const sslSocket *ss, SECItem *i,
-                                           PRUint32 bytes, SSL3Opaque **b,
+                                           PRUint32 bytes, PRUint8 **b,
                                            PRUint32 *length);
 
 #endif
diff --git a/security/nss/lib/ssl/ssl3exthandle.c b/security/nss/lib/ssl/ssl3exthandle.c
index c9c99aba9..370bd8b3e 100644
--- a/security/nss/lib/ssl/ssl3exthandle.c
+++ b/security/nss/lib/ssl/ssl3exthandle.c
@@ -12,64 +12,12 @@
 #include "pk11pub.h"
 #include "blapit.h"
 #include "prinit.h"
+#include "selfencrypt.h"
+#include "ssl3encode.h"
 #include "ssl3ext.h"
 #include "ssl3exthandle.h"
 #include "tls13exthandle.h" /* For tls13_ServerSendStatusRequestXtn. */
 
-static SECStatus ssl3_AppendToItem(SECItem *item, const unsigned char *buf,
-                                   PRUint32 bytes);
-static SECStatus ssl3_ConsumeFromItem(SECItem *item, unsigned char **buf,
-                                      PRUint32 bytes);
-static SECStatus ssl3_AppendNumberToItem(SECItem *item, PRUint32 num,
-                                         PRInt32 lenSize);
-
-PRUint32 ssl_ticket_lifetime = 2 * 24 * 60 * 60; /* 2 days in seconds */
-#define TLS_EX_SESS_TICKET_VERSION (0x0105)
-#define TLS_EX_SESS_TICKET_MAC_LENGTH 32
-
-/*
- * Write bytes.  Using this function means the SECItem structure
- * cannot be freed.  The caller is expected to call this function
- * on a shallow copy of the structure.
- */
-static SECStatus
-ssl3_AppendToItem(SECItem *item, const unsigned char *buf, PRUint32 bytes)
-{
-    if (bytes > item->len)
-        return SECFailure;
-
-    PORT_Memcpy(item->data, buf, bytes);
-    item->data += bytes;
-    item->len -= bytes;
-    return SECSuccess;
-}
-
-/*
- * Write a number in network byte order. Using this function means the
- * SECItem structure cannot be freed.  The caller is expected to call
- * this function on a shallow copy of the structure.
- */
-static SECStatus
-ssl3_AppendNumberToItem(SECItem *item, PRUint32 num, PRInt32 lenSize)
-{
-    SECStatus rv;
-    PRUint8 b[4];
-    PRUint8 *p = b;
-
-    switch (lenSize) {
-        case 4:
-            *p++ = (PRUint8)(num >> 24);
-        case 3:
-            *p++ = (PRUint8)(num >> 16);
-        case 2:
-            *p++ = (PRUint8)(num >> 8);
-        case 1:
-            *p = (PRUint8)num;
-    }
-    rv = ssl3_AppendToItem(item, &b[0], lenSize);
-    return rv;
-}
-
 /* Format an SNI extension, using the name from the socket's URL,
  * unless that name is a dotted decimal string.
  * Used by client and server.
@@ -330,34 +278,6 @@ loser:
     return -1;
 }
 
-static SECStatus
-ssl3_ParseEncryptedSessionTicket(sslSocket *ss, const SECItem *data,
-                                 EncryptedSessionTicket *encryptedTicket)
-{
-    SECItem copy = *data;
-
-    if (ssl3_ConsumeFromItem(&copy, &encryptedTicket->key_name,
-                             SESS_TICKET_KEY_NAME_LEN) !=
-        SECSuccess)
-        return SECFailure;
-    if (ssl3_ConsumeFromItem(&copy, &encryptedTicket->iv,
-                             AES_BLOCK_SIZE) !=
-        SECSuccess)
-        return SECFailure;
-    if (ssl3_ConsumeHandshakeVariable(ss, &encryptedTicket->encrypted_state,
-                                      2, &copy.data, &copy.len) !=
-        SECSuccess)
-        return SECFailure;
-    if (ssl3_ConsumeFromItem(&copy, &encryptedTicket->mac,
-                             TLS_EX_SESS_TICKET_MAC_LENGTH) !=
-        SECSuccess)
-        return SECFailure;
-    if (copy.len != 0) /* Make sure that we have consumed all bytes. */
-        return SECFailure;
-
-    return SECSuccess;
-}
-
 PRBool
 ssl_AlpnTagAllowed(const sslSocket *ss, const SECItem *tag)
 {
@@ -881,6 +801,9 @@ ssl3_ClientHandleStatusRequestXtn(const sslSocket *ss, TLSExtensionData *xtnData
     return SECSuccess;
 }
 
+PRUint32 ssl_ticket_lifetime = 2 * 24 * 60 * 60; /* 2 days in seconds */
+#define TLS_EX_SESS_TICKET_VERSION (0x0105)
+
 /*
  * Called from ssl3_SendNewSessionTicket, tls13_SendNewSessionTicket
  */
@@ -889,32 +812,16 @@ ssl3_EncodeSessionTicket(sslSocket *ss,
                          const NewSessionTicket *ticket,
                          SECItem *ticket_data)
 {
-    PRUint32 i;
     SECStatus rv;
     SECItem plaintext;
     SECItem plaintext_item = { 0, NULL, 0 };
-    SECItem ciphertext = { 0, NULL, 0 };
-    PRUint32 ciphertext_length;
+    PRUint32 plaintext_length;
     SECItem ticket_buf = { 0, NULL, 0 };
-    SECItem ticket_tmp = { 0, NULL, 0 };
-    SECItem macParam = { 0, NULL, 0 };
     PRBool ms_is_wrapped;
     unsigned char wrapped_ms[SSL3_MASTER_SECRET_LENGTH];
     SECItem ms_item = { 0, NULL, 0 };
-    PRUint32 padding_length;
-    PRUint32 ticket_length;
     PRUint32 cert_length = 0;
-    PRUint8 length_buf[4];
     PRUint32 now;
-    unsigned char key_name[SESS_TICKET_KEY_NAME_LEN];
-    PK11SymKey *aes_key = NULL;
-    PK11SymKey *mac_key = NULL;
-    PK11Context *aes_ctx;
-    PK11Context *hmac_ctx = NULL;
-    unsigned char computed_mac[TLS_EX_SESS_TICKET_MAC_LENGTH];
-    unsigned int computed_mac_length;
-    unsigned char iv[AES_BLOCK_SIZE];
-    SECItem ivItem;
     SECItem *srvName = NULL;
     CK_MECHANISM_TYPE msWrapMech = 0; /* dummy default value,
                                           * must be >= 0 */
@@ -931,17 +838,6 @@ ssl3_EncodeSessionTicket(sslSocket *ss,
         cert_length = 2 + ss->sec.ci.sid->peerCert->derCert.len;
     }
 
-    /* Get IV and encryption keys */
-    ivItem.data = iv;
-    ivItem.len = sizeof(iv);
-    rv = PK11_GenerateRandom(iv, sizeof(iv));
-    if (rv != SECSuccess)
-        goto loser;
-
-    rv = ssl_GetSessionTicketKeys(ss, key_name, &aes_key, &mac_key);
-    if (rv != SECSuccess)
-        goto loser;
-
     if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3) {
         spec = ss->ssl3.cwSpec;
     } else {
@@ -980,7 +876,7 @@ ssl3_EncodeSessionTicket(sslSocket *ss,
                 ss->xtnData.nextProto.len == 0);
     alpnSelection = &ss->xtnData.nextProto;
 
-    ciphertext_length =
+    plaintext_length =
         sizeof(PRUint16)                       /* ticket version */
         + sizeof(SSL3ProtocolVersion)          /* ssl_version */
         + sizeof(ssl3CipherSuite)              /* ciphersuite */
@@ -999,16 +895,8 @@ ssl3_EncodeSessionTicket(sslSocket *ss,
         + sizeof(ticket->flags)                /* ticket flags */
         + 1 + alpnSelection->len               /* alpn value + length field */
         + 4;                                   /* maxEarlyData */
-#ifdef UNSAFE_FUZZER_MODE
-    padding_length = 0;
-#else
-    padding_length = AES_BLOCK_SIZE -
-                     (ciphertext_length %
-                      AES_BLOCK_SIZE);
-#endif
-    ciphertext_length += padding_length;
 
-    if (SECITEM_AllocItem(NULL, &plaintext_item, ciphertext_length) == NULL)
+    if (SECITEM_AllocItem(NULL, &plaintext_item, plaintext_length) == NULL)
         goto loser;
 
     plaintext = plaintext_item;
@@ -1143,117 +1031,36 @@ ssl3_EncodeSessionTicket(sslSocket *ss,
     if (rv != SECSuccess)
         goto loser;
 
-    PORT_Assert(plaintext.len == padding_length);
-    for (i = 0; i < padding_length; i++)
-        plaintext.data[i] = (unsigned char)padding_length;
+    /* Check that we are totally full. */
+    PORT_Assert(plaintext.len == 0);
 
-    if (SECITEM_AllocItem(NULL, &ciphertext, ciphertext_length) == NULL) {
-        rv = SECFailure;
+    /* 128 just gives us enough room for overhead. */
+    if (SECITEM_AllocItem(NULL, &ticket_buf, plaintext_length + 128) == NULL) {
         goto loser;
     }
 
-    /* Generate encrypted portion of ticket. */
-    PORT_Assert(aes_key);
-#ifdef UNSAFE_FUZZER_MODE
-    ciphertext.len = plaintext_item.len;
-    PORT_Memcpy(ciphertext.data, plaintext_item.data, plaintext_item.len);
-#else
-    aes_ctx = PK11_CreateContextBySymKey(CKM_AES_CBC, CKA_ENCRYPT, aes_key, &ivItem);
-    if (!aes_ctx)
-        goto loser;
-
-    rv = PK11_CipherOp(aes_ctx, ciphertext.data,
-                       (int *)&ciphertext.len, ciphertext.len,
-                       plaintext_item.data, plaintext_item.len);
-    PK11_Finalize(aes_ctx);
-    PK11_DestroyContext(aes_ctx, PR_TRUE);
-    if (rv != SECSuccess)
-        goto loser;
-#endif
-
-    /* Convert ciphertext length to network order. */
-    (void)ssl_EncodeUintX(ciphertext.len, 2, length_buf);
-
-    /* Compute MAC. */
-    PORT_Assert(mac_key);
-    hmac_ctx = PK11_CreateContextBySymKey(CKM_SHA256_HMAC, CKA_SIGN, mac_key,
-                                          &macParam);
-    if (!hmac_ctx)
-        goto loser;
-
-    rv = PK11_DigestBegin(hmac_ctx);
-    if (rv != SECSuccess)
-        goto loser;
-    rv = PK11_DigestOp(hmac_ctx, key_name, SESS_TICKET_KEY_NAME_LEN);
-    if (rv != SECSuccess)
-        goto loser;
-    rv = PK11_DigestOp(hmac_ctx, iv, sizeof(iv));
-    if (rv != SECSuccess)
-        goto loser;
-    rv = PK11_DigestOp(hmac_ctx, (unsigned char *)length_buf, 2);
-    if (rv != SECSuccess)
-        goto loser;
-    rv = PK11_DigestOp(hmac_ctx, ciphertext.data, ciphertext.len);
-    if (rv != SECSuccess)
-        goto loser;
-    rv = PK11_DigestFinal(hmac_ctx, computed_mac,
-                          &computed_mac_length, sizeof(computed_mac));
-    if (rv != SECSuccess)
-        goto loser;
-
-    ticket_length =
-        +SESS_TICKET_KEY_NAME_LEN        /* key_name */
-        + AES_BLOCK_SIZE                 /* iv */
-        + 2                              /* length field for NewSessionTicket.ticket.encrypted_state */
-        + ciphertext_length              /* encrypted_state */
-        + TLS_EX_SESS_TICKET_MAC_LENGTH; /* mac */
-
-    if (SECITEM_AllocItem(NULL, &ticket_buf, ticket_length) == NULL) {
-        rv = SECFailure;
+    /* Finally, encrypt the ticket. */
+    rv = ssl_SelfEncryptProtect(ss, plaintext_item.data, plaintext_item.len,
+                                ticket_buf.data, &ticket_buf.len, ticket_buf.len);
+    if (rv != SECSuccess) {
         goto loser;
     }
-    ticket_tmp = ticket_buf; /* Shallow copy because AppendToItem is
-                              * destructive. */
-
-    rv = ssl3_AppendToItem(&ticket_tmp, key_name, SESS_TICKET_KEY_NAME_LEN);
-    if (rv != SECSuccess)
-        goto loser;
-
-    rv = ssl3_AppendToItem(&ticket_tmp, iv, sizeof(iv));
-    if (rv != SECSuccess)
-        goto loser;
-
-    rv = ssl3_AppendNumberToItem(&ticket_tmp, ciphertext.len, 2);
-    if (rv != SECSuccess)
-        goto loser;
-
-    rv = ssl3_AppendToItem(&ticket_tmp, ciphertext.data, ciphertext.len);
-    if (rv != SECSuccess)
-        goto loser;
-
-    rv = ssl3_AppendToItem(&ticket_tmp, computed_mac, computed_mac_length);
-    if (rv != SECSuccess)
-        goto loser;
 
     /* Give ownership of memory to caller. */
     *ticket_data = ticket_buf;
-    ticket_buf.data = NULL;
+
+    SECITEM_FreeItem(&plaintext_item, PR_FALSE);
+    return SECSuccess;
 
 loser:
-    if (hmac_ctx) {
-        PK11_DestroyContext(hmac_ctx, PR_TRUE);
-    }
     if (plaintext_item.data) {
         SECITEM_FreeItem(&plaintext_item, PR_FALSE);
     }
-    if (ciphertext.data) {
-        SECITEM_FreeItem(&ciphertext, PR_FALSE);
-    }
     if (ticket_buf.data) {
         SECITEM_FreeItem(&ticket_buf, PR_FALSE);
     }
 
-    return rv;
+    return SECFailure;
 }
 
 /* When a client receives a SessionTicket extension a NewSessionTicket
@@ -1272,165 +1079,6 @@ ssl3_ClientHandleSessionTicketXtn(const sslSocket *ss, TLSExtensionData *xtnData
     return SECSuccess;
 }
 
-static SECStatus
-ssl_DecryptSessionTicket(sslSocket *ss, const SECItem *rawTicket,
-                         const EncryptedSessionTicket *encryptedTicket,
-                         SECItem *decryptedTicket)
-{
-    SECStatus rv;
-    unsigned char keyName[SESS_TICKET_KEY_NAME_LEN];
-
-    PK11SymKey *macKey = NULL;
-    PK11Context *hmacCtx;
-    unsigned char computedMac[TLS_EX_SESS_TICKET_MAC_LENGTH];
-    unsigned int computedMacLength;
-    SECItem macParam = { siBuffer, NULL, 0 };
-
-    PK11SymKey *aesKey = NULL;
-#ifndef UNSAFE_FUZZER_MODE
-    PK11Context *aesCtx;
-    SECItem ivItem;
-
-    unsigned int i;
-    SSL3Opaque *padding;
-    SSL3Opaque paddingLength;
-#endif
-
-    PORT_Assert(!decryptedTicket->data);
-    PORT_Assert(!decryptedTicket->len);
-    if (rawTicket->len < TLS_EX_SESS_TICKET_MAC_LENGTH) {
-        PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
-        return SECFailure;
-    }
-
-    /* Get session ticket keys. */
-    rv = ssl_GetSessionTicketKeys(ss, keyName, &aesKey, &macKey);
-    if (rv != SECSuccess) {
-        SSL_DBG(("%d: SSL[%d]: Unable to get/generate session ticket keys.",
-                 SSL_GETPID(), ss->fd));
-        return SECFailure; /* code already set */
-    }
-
-    /* If the ticket sent by the client was generated under a key different from
-     * the one we have, bypass ticket processing.  This reports success, meaning
-     * that the handshake completes, but doesn't resume.
-     */
-    if (PORT_Memcmp(encryptedTicket->key_name, keyName,
-                    SESS_TICKET_KEY_NAME_LEN) != 0) {
-#ifndef UNSAFE_FUZZER_MODE
-        SSL_DBG(("%d: SSL[%d]: Session ticket key_name sent mismatch.",
-                 SSL_GETPID(), ss->fd));
-        return SECSuccess;
-#endif
-    }
-
-    /* Verify the MAC on the ticket. */
-    PORT_Assert(macKey);
-    hmacCtx = PK11_CreateContextBySymKey(CKM_SHA256_HMAC, CKA_SIGN, macKey,
-                                         &macParam);
-    if (!hmacCtx) {
-        SSL_DBG(("%d: SSL[%d]: Unable to create HMAC context: %d.",
-                 SSL_GETPID(), ss->fd, PORT_GetError()));
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-        return SECFailure;
-    }
-
-    SSL_DBG(("%d: SSL[%d]: Successfully created HMAC context.",
-             SSL_GETPID(), ss->fd));
-    do {
-        rv = PK11_DigestBegin(hmacCtx);
-        if (rv != SECSuccess) {
-            break;
-        }
-        rv = PK11_DigestOp(hmacCtx, rawTicket->data,
-                           rawTicket->len - TLS_EX_SESS_TICKET_MAC_LENGTH);
-        if (rv != SECSuccess) {
-            break;
-        }
-        rv = PK11_DigestFinal(hmacCtx, computedMac, &computedMacLength,
-                              sizeof(computedMac));
-    } while (0);
-    PK11_DestroyContext(hmacCtx, PR_TRUE);
-    if (rv != SECSuccess) {
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-        return SECFailure;
-    }
-
-    if (NSS_SecureMemcmp(computedMac, encryptedTicket->mac,
-                         computedMacLength) != 0) {
-#ifndef UNSAFE_FUZZER_MODE
-        SSL_DBG(("%d: SSL[%d]: Session ticket MAC mismatch.",
-                 SSL_GETPID(), ss->fd));
-        PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
-        return SECFailure;
-#endif
-    }
-
-    /* Decrypt the ticket. */
-
-    /* Plaintext is shorter than the ciphertext due to padding. */
-    if (!SECITEM_AllocItem(NULL, decryptedTicket,
-                           encryptedTicket->encrypted_state.len)) {
-        return SECFailure; /* code already set */
-    }
-
-    PORT_Assert(aesKey);
-#ifdef UNSAFE_FUZZER_MODE
-    decryptedTicket->len = encryptedTicket->encrypted_state.len;
-    PORT_Memcpy(decryptedTicket->data,
-                encryptedTicket->encrypted_state.data,
-                encryptedTicket->encrypted_state.len);
-#else
-    ivItem.data = encryptedTicket->iv;
-    ivItem.len = AES_BLOCK_SIZE;
-    aesCtx = PK11_CreateContextBySymKey(CKM_AES_CBC, CKA_DECRYPT, aesKey,
-                                        &ivItem);
-    if (!aesCtx) {
-        SSL_DBG(("%d: SSL[%d]: Unable to create AES context.",
-                 SSL_GETPID(), ss->fd));
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-        return SECFailure;
-    }
-
-    do {
-        rv = PK11_CipherOp(aesCtx, decryptedTicket->data,
-                           (int *)&decryptedTicket->len, decryptedTicket->len,
-                           encryptedTicket->encrypted_state.data,
-                           encryptedTicket->encrypted_state.len);
-        if (rv != SECSuccess) {
-            break;
-        }
-        rv = PK11_Finalize(aesCtx);
-        if (rv != SECSuccess) {
-            break;
-        }
-    } while (0);
-    PK11_DestroyContext(aesCtx, PR_TRUE);
-    if (rv != SECSuccess) {
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-        return SECFailure;
-    }
-
-    /* Check padding. */
-    paddingLength = decryptedTicket->data[decryptedTicket->len - 1];
-    if (paddingLength == 0 || paddingLength > AES_BLOCK_SIZE) {
-        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-        return SECFailure;
-    }
-
-    padding = &decryptedTicket->data[decryptedTicket->len - paddingLength];
-    for (i = 0; i < paddingLength; i++, padding++) {
-        if (paddingLength != *padding) {
-            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-            return SECFailure;
-        }
-    }
-    decryptedTicket->len -= paddingLength;
-#endif /* UNSAFE_FUZZER_MODE */
-
-    return SECSuccess;
-}
-
 static SECStatus
 ssl_ParseSessionTicket(sslSocket *ss, const SECItem *decryptedTicket,
                        SessionTicket *parsedTicket)
@@ -1438,7 +1086,7 @@ ssl_ParseSessionTicket(sslSocket *ss, const SECItem *decryptedTicket,
     PRUint32 temp;
     SECStatus rv;
 
-    SSL3Opaque *buffer = decryptedTicket->data;
+    PRUint8 *buffer = decryptedTicket->data;
     unsigned int len = decryptedTicket->len;
 
     PORT_Memset(parsedTicket, 0, sizeof(*parsedTicket));
@@ -1735,7 +1383,6 @@ loser:
 SECStatus
 ssl3_ProcessSessionTicketCommon(sslSocket *ss, SECItem *data)
 {
-    EncryptedSessionTicket encryptedTicket;
     SECItem decryptedTicket = { siBuffer, NULL, 0 };
     SessionTicket parsedTicket;
     SECStatus rv;
@@ -1746,17 +1393,27 @@ ssl3_ProcessSessionTicketCommon(sslSocket *ss, SECItem *data)
         ss->sec.ci.sid = NULL;
     }
 
-    rv = ssl3_ParseEncryptedSessionTicket(ss, data, &encryptedTicket);
-    if (rv != SECSuccess) {
-        PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
+    if (!SECITEM_AllocItem(NULL, &decryptedTicket, data->len)) {
         return SECFailure;
     }
 
-    rv = ssl_DecryptSessionTicket(ss, data, &encryptedTicket,
-                                  &decryptedTicket);
+    /* Decrypt the ticket. */
+    rv = ssl_SelfEncryptUnprotect(ss, data->data, data->len,
+                                  decryptedTicket.data,
+                                  &decryptedTicket.len,
+                                  decryptedTicket.len);
     if (rv != SECSuccess) {
-        PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
-        return SECFailure;
+        SECITEM_ZfreeItem(&decryptedTicket, PR_FALSE);
+
+        /* Fail with no ticket if we're not a recipient. Otherwise
+         * it's a hard failure. */
+        if (PORT_GetError() != SEC_ERROR_NOT_A_RECIPIENT) {
+            SSL3_SendAlert(ss, alert_fatal, illegal_parameter);
+            return SECFailure;
+        }
+
+        /* We didn't have the right key, so pretend we don't have a
+         * ticket. */
     }
 
     rv = ssl_ParseSessionTicket(ss, &decryptedTicket, &parsedTicket);
@@ -1823,23 +1480,6 @@ ssl3_ServerHandleSessionTicketXtn(const sslSocket *ss, TLSExtensionData *xtnData
     return ssl3_ProcessSessionTicketCommon(CONST_CAST(sslSocket, ss), data);
 }
 
-/*
- * Read bytes.  Using this function means the SECItem structure
- * cannot be freed.  The caller is expected to call this function
- * on a shallow copy of the structure.
- */
-static SECStatus
-ssl3_ConsumeFromItem(SECItem *item, unsigned char **buf, PRUint32 bytes)
-{
-    if (bytes > item->len)
-        return SECFailure;
-
-    *buf = item->data;
-    item->data += bytes;
-    item->len -= bytes;
-    return SECSuccess;
-}
-
 /* Extension format:
  * Extension number:   2 bytes
  * Extension length:   2 bytes
@@ -2365,6 +2005,7 @@ ssl3_HandleExtendedMasterSecretXtn(const sslSocket *ss, TLSExtensionData *xtnDat
     if (data->len != 0) {
         SSL_TRC(30, ("%d: SSL3[%d]: Bogus extended master secret extension",
                      SSL_GETPID(), ss->fd));
+        ssl3_ExtSendAlert(ss, alert_fatal, decode_error);
         return SECFailure;
     }
 
@@ -2489,6 +2130,12 @@ ssl3_ServerHandleSignedCertTimestampXtn(const sslSocket *ss,
                                         PRUint16 ex_type,
                                         SECItem *data)
 {
+    if (data->len != 0) {
+        ssl3_ExtSendAlert(ss, alert_fatal, decode_error);
+        PORT_SetError(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
+        return SECFailure;
+    }
+
     xtnData->negotiated[xtnData->numNegotiated++] = ex_type;
     PORT_Assert(ss->sec.isServer);
     return ssl3_RegisterExtensionSender(
diff --git a/security/nss/lib/ssl/ssl3prot.h b/security/nss/lib/ssl/ssl3prot.h
index 60a978bfd..dede24438 100644
--- a/security/nss/lib/ssl/ssl3prot.h
+++ b/security/nss/lib/ssl/ssl3prot.h
@@ -10,8 +10,6 @@
 #ifndef __ssl3proto_h_
 #define __ssl3proto_h_
 
-typedef PRUint8 SSL3Opaque;
-
 typedef PRUint16 SSL3ProtocolVersion;
 /* version numbers are defined in sslproto.h */
 
@@ -62,12 +60,12 @@ typedef struct {
 
 typedef struct {
     SECItem content;
-    SSL3Opaque MAC[MAX_MAC_LENGTH];
+    PRUint8 MAC[MAX_MAC_LENGTH];
 } SSL3GenericStreamCipher;
 
 typedef struct {
     SECItem content;
-    SSL3Opaque MAC[MAX_MAC_LENGTH];
+    PRUint8 MAC[MAX_MAC_LENGTH];
     PRUint8 padding[MAX_PADDING_LENGTH];
     PRUint8 padding_length;
 } SSL3GenericBlockCipher;
@@ -153,11 +151,11 @@ typedef struct {
 } SSL3HelloRequest;
 
 typedef struct {
-    SSL3Opaque rand[SSL3_RANDOM_LENGTH];
+    PRUint8 rand[SSL3_RANDOM_LENGTH];
 } SSL3Random;
 
 typedef struct {
-    SSL3Opaque id[32];
+    PRUint8 id[32];
     PRUint8 length;
 } SSL3SessionID;
 
@@ -243,7 +241,7 @@ typedef struct {
 
 typedef struct {
     union {
-        SSL3Opaque anonymous;
+        PRUint8 anonymous;
         SSL3Hashes certified;
     } u;
 } SSL3ServerKeyExchange;
@@ -262,11 +260,11 @@ typedef enum {
 } SSL3ClientCertificateType;
 
 typedef struct {
-    SSL3Opaque client_version[2];
-    SSL3Opaque random[46];
+    PRUint8 client_version[2];
+    PRUint8 random[46];
 } SSL3RSAPreMasterSecret;
 
-typedef SSL3Opaque SSL3MasterSecret[48];
+typedef PRUint8 SSL3MasterSecret[48];
 
 typedef enum {
     sender_client = 0x434c4e54,
@@ -276,7 +274,7 @@ typedef enum {
 typedef SSL3HashesIndividually SSL3Finished;
 
 typedef struct {
-    SSL3Opaque verify_data[12];
+    PRUint8 verify_data[12];
 } TLSFinished;
 
 /*
@@ -305,16 +303,9 @@ typedef enum {
     CLIENT_AUTH_CERTIFICATE = 1
 } ClientAuthenticationType;
 
-#define SESS_TICKET_KEY_NAME_LEN 16
-#define SESS_TICKET_KEY_NAME_PREFIX "NSS!"
-#define SESS_TICKET_KEY_NAME_PREFIX_LEN 4
-#define SESS_TICKET_KEY_VAR_NAME_LEN 12
-
-typedef struct {
-    unsigned char *key_name;
-    unsigned char *iv;
-    SECItem encrypted_state;
-    unsigned char *mac;
-} EncryptedSessionTicket;
+#define SELF_ENCRYPT_KEY_NAME_LEN 16
+#define SELF_ENCRYPT_KEY_NAME_PREFIX "NSS!"
+#define SELF_ENCRYPT_KEY_NAME_PREFIX_LEN 4
+#define SELF_ENCRYPT_KEY_VAR_NAME_LEN 12
 
 #endif /* __ssl3proto_h_ */
diff --git a/security/nss/lib/ssl/sslcert.c b/security/nss/lib/ssl/sslcert.c
index 388fc0950..cc1d3c683 100644
--- a/security/nss/lib/ssl/sslcert.c
+++ b/security/nss/lib/ssl/sslcert.c
@@ -267,7 +267,7 @@ ssl_PopulateKeyPair(sslServerCert *sc, sslKeyPair *keyPair)
         if (SSL_CERT_IS(sc, ssl_auth_rsa_decrypt)) {
             /* This will update the global session ticket key pair with this
              * key, if a value hasn't been set already. */
-            if (ssl_MaybeSetSessionTicketKeyPair(keyPair) != SECSuccess) {
+            if (ssl_MaybeSetSelfEncryptKeyPair(keyPair) != SECSuccess) {
                 return SECFailure;
             }
         }
diff --git a/security/nss/lib/ssl/sslimpl.h b/security/nss/lib/ssl/sslimpl.h
index 55fb8cbf2..64694b0df 100644
--- a/security/nss/lib/ssl/sslimpl.h
+++ b/security/nss/lib/ssl/sslimpl.h
@@ -416,7 +416,7 @@ typedef PRUint16 DTLSEpoch;
 typedef void (*DTLSTimerCb)(sslSocket *);
 
 typedef struct {
-    SSL3Opaque wrapped_master_secret[48];
+    PRUint8 wrapped_master_secret[48];
     PRUint16 wrapped_master_secret_len;
     PRUint8 msIsWrapped;
     PRUint8 resumable;
@@ -430,7 +430,7 @@ typedef struct {
     SECItem write_key_item;
     SECItem write_iv_item;
     SECItem write_mac_key_item;
-    SSL3Opaque write_iv[MAX_IV_LENGTH];
+    PRUint8 write_iv[MAX_IV_LENGTH];
 } ssl3KeyMaterial;
 
 typedef SECStatus (*SSLCipher)(void *context,
@@ -557,7 +557,7 @@ struct sslSessionIDStr {
         struct {
             /* values that are copied into the server's on-disk SID cache. */
             PRUint8 sessionIDLength;
-            SSL3Opaque sessionID[SSL3_SESSIONID_BYTES];
+            PRUint8 sessionID[SSL3_SESSIONID_BYTES];
 
             ssl3CipherSuite cipherSuite;
             SSLCompressionMethod compression;
@@ -815,7 +815,7 @@ typedef struct SSL3HandshakeStateStr {
     union {
         TLSFinished tFinished[2]; /* client, then server */
         SSL3Finished sFinished[2];
-        SSL3Opaque data[72];
+        PRUint8 data[72];
     } finishedMsgs;
 
     PRBool authCertificatePending;
@@ -980,7 +980,7 @@ struct ssl3DHParamsStr {
 };
 
 typedef struct SSLWrappedSymWrappingKeyStr {
-    SSL3Opaque wrappedSymmetricWrappingkey[512];
+    PRUint8 wrappedSymmetricWrappingkey[512];
     CK_MECHANISM_TYPE symWrapMechanism;
     /* unwrapped symmetric wrapping key uses this mechanism */
     CK_MECHANISM_TYPE asymWrapMechanism;
@@ -1008,7 +1008,7 @@ typedef struct SessionTicketStr {
     PRUint8 ms_is_wrapped;
     CK_MECHANISM_TYPE msWrapMech;
     PRUint16 ms_length;
-    SSL3Opaque master_secret[48];
+    PRUint8 master_secret[48];
     PRBool extendedMasterSecretUsed;
     ClientAuthenticationType client_auth_type;
     SECItem peer_cert;
@@ -1229,6 +1229,14 @@ struct sslSocketStr {
     SSLProtocolVariant protocolVariant;
 };
 
+struct sslSelfEncryptKeysStr {
+    PRCallOnceType setup;
+    PRUint8 keyName[SELF_ENCRYPT_KEY_NAME_LEN];
+    PK11SymKey *encKey;
+    PK11SymKey *macKey;
+};
+typedef struct sslSelfEncryptKeysStr sslSelfEncryptKeys;
+
 extern char ssl_debug;
 extern char ssl_trace;
 extern FILE *ssl_trace_iob;
@@ -1369,7 +1377,7 @@ extern PRBool ssl3_WaitingForServerSecondRound(sslSocket *ss);
 
 extern PRInt32 ssl3_SendRecord(sslSocket *ss, ssl3CipherSpec *cwSpec,
                                SSL3ContentType type,
-                               const SSL3Opaque *pIn, PRInt32 nIn,
+                               const PRUint8 *pIn, PRInt32 nIn,
                                PRInt32 flags);
 
 #ifdef NSS_SSL_ENABLE_ZLIB
@@ -1625,13 +1633,13 @@ extern SECStatus ssl3_GetPolicy(ssl3CipherSuite which, PRInt32 *policy);
 extern void ssl3_InitSocketPolicy(sslSocket *ss);
 
 extern SECStatus ssl3_RedoHandshake(sslSocket *ss, PRBool flushCache);
-extern SECStatus ssl3_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *b,
+extern SECStatus ssl3_HandleHandshakeMessage(sslSocket *ss, PRUint8 *b,
                                              PRUint32 length,
                                              PRBool endOfRecord);
 
 extern void ssl3_DestroySSL3Info(sslSocket *ss);
 
-extern SECStatus ssl_ClientReadVersion(sslSocket *ss, SSL3Opaque **b,
+extern SECStatus ssl_ClientReadVersion(sslSocket *ss, PRUint8 **b,
                                        PRUint32 *length,
                                        SSL3ProtocolVersion *version);
 extern SECStatus ssl3_NegotiateVersion(sslSocket *ss,
@@ -1644,14 +1652,14 @@ extern SECStatus ssl_GetPeerInfo(sslSocket *ss);
 extern SECStatus ssl3_SendECDHClientKeyExchange(sslSocket *ss,
                                                 SECKEYPublicKey *svrPubKey);
 extern SECStatus ssl3_HandleECDHServerKeyExchange(sslSocket *ss,
-                                                  SSL3Opaque *b, PRUint32 length);
+                                                  PRUint8 *b, PRUint32 length);
 extern SECStatus ssl3_HandleECDHClientKeyExchange(sslSocket *ss,
-                                                  SSL3Opaque *b, PRUint32 length,
+                                                  PRUint8 *b, PRUint32 length,
                                                   sslKeyPair *serverKeys);
 extern SECStatus ssl3_SendECDHServerKeyExchange(sslSocket *ss);
 extern SECStatus ssl_ImportECDHKeyShare(
     sslSocket *ss, SECKEYPublicKey *peerKey,
-    SSL3Opaque *b, PRUint32 length, const sslNamedGroupDef *curve);
+    PRUint8 *b, PRUint32 length, const sslNamedGroupDef *curve);
 SECStatus tls13_EncodeECDHEKeyShareKEX(const sslSocket *ss,
                                        const SECKEYPublicKey *pubKey);
 
@@ -1668,16 +1676,16 @@ extern SECStatus ssl3_AppendHandshakeHeader(sslSocket *ss,
 extern SECStatus ssl3_AppendHandshakeNumber(sslSocket *ss, PRInt32 num,
                                             PRInt32 lenSize);
 extern SECStatus ssl3_AppendHandshakeVariable(sslSocket *ss,
-                                              const SSL3Opaque *src, PRInt32 bytes, PRInt32 lenSize);
+                                              const PRUint8 *src, PRInt32 bytes, PRInt32 lenSize);
 extern SECStatus ssl3_AppendSignatureAndHashAlgorithm(
     sslSocket *ss, const SSLSignatureAndHashAlg *sigAndHash);
 extern SECStatus ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRUint32 bytes,
-                                       SSL3Opaque **b, PRUint32 *length);
+                                       PRUint8 **b, PRUint32 *length);
 extern SECStatus ssl3_ConsumeHandshakeNumber(sslSocket *ss, PRUint32 *num,
-                                             PRUint32 bytes, SSL3Opaque **b,
+                                             PRUint32 bytes, PRUint8 **b,
                                              PRUint32 *length);
 extern SECStatus ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i,
-                                               PRUint32 bytes, SSL3Opaque **b,
+                                               PRUint32 bytes, PRUint8 **b,
                                                PRUint32 *length);
 extern PRUint8 *ssl_EncodeUintX(PRUint64 value, unsigned int bytes,
                                 PRUint8 *to);
@@ -1690,7 +1698,7 @@ extern SECStatus ssl_ParseSignatureSchemes(const sslSocket *ss, PLArenaPool *are
                                            unsigned char **b,
                                            unsigned int *len);
 extern SECStatus ssl_ConsumeSignatureScheme(
-    sslSocket *ss, SSL3Opaque **b, PRUint32 *length, SSLSignatureScheme *out);
+    sslSocket *ss, PRUint8 **b, PRUint32 *length, SSLSignatureScheme *out);
 extern SECStatus ssl3_SignHashes(sslSocket *ss, SSL3Hashes *hash,
                                  SECKEYPrivateKey *key, SECItem *buf);
 extern SECStatus ssl3_VerifySignedHashes(sslSocket *ss, SSLSignatureScheme scheme,
@@ -1705,10 +1713,11 @@ extern void ssl3_SetSIDSessionTicket(sslSessionID *sid,
 SECStatus ssl3_EncodeSessionTicket(sslSocket *ss,
                                    const NewSessionTicket *ticket_input,
                                    SECItem *ticket_data);
-SECStatus ssl_MaybeSetSessionTicketKeyPair(const sslKeyPair *keyPair);
-SECStatus ssl_GetSessionTicketKeys(sslSocket *ss, unsigned char *keyName,
-                                   PK11SymKey **encKey, PK11SymKey **macKey);
-void ssl_ResetSessionTicketKeys();
+
+SECStatus ssl_MaybeSetSelfEncryptKeyPair(const sslKeyPair *keyPair);
+SECStatus ssl_GetSelfEncryptKeys(sslSocket *ss, unsigned char *keyName,
+                                 PK11SymKey **encKey, PK11SymKey **macKey);
+void ssl_ResetSelfEncryptKeys();
 
 extern SECStatus ssl3_ValidateNextProtoNego(const unsigned char *data,
                                             unsigned int length);
@@ -1755,10 +1764,10 @@ extern void dtls_FreeHandshakeMessages(PRCList *lst);
 
 extern SECStatus dtls_HandleHandshake(sslSocket *ss, sslBuffer *origBuf);
 extern SECStatus dtls_HandleHelloVerifyRequest(sslSocket *ss,
-                                               SSL3Opaque *b, PRUint32 length);
+                                               PRUint8 *b, PRUint32 length);
 extern SECStatus dtls_StageHandshakeMessage(sslSocket *ss);
 extern SECStatus dtls_QueueMessage(sslSocket *ss, SSL3ContentType type,
-                                   const SSL3Opaque *pIn, PRInt32 nIn);
+                                   const PRUint8 *pIn, PRInt32 nIn);
 extern SECStatus dtls_FlushHandshakeMessages(sslSocket *ss, PRInt32 flags);
 SECStatus ssl3_DisableNonDTLSSuites(sslSocket *ss);
 extern SECStatus dtls_StartHolddownTimer(sslSocket *ss);
@@ -1789,20 +1798,20 @@ SECStatus ssl3_ServerCallSNICallback(sslSocket *ss);
 SECStatus ssl3_SetupPendingCipherSpec(sslSocket *ss);
 SECStatus ssl3_FlushHandshake(sslSocket *ss, PRInt32 flags);
 SECStatus ssl3_CompleteHandleCertificate(sslSocket *ss,
-                                         SSL3Opaque *b, PRUint32 length);
+                                         PRUint8 *b, PRUint32 length);
 void ssl3_SendAlertForCertError(sslSocket *ss, PRErrorCode errCode);
 SECStatus ssl3_HandleNoCertificate(sslSocket *ss);
 SECStatus ssl3_SendEmptyCertificate(sslSocket *ss);
 void ssl3_CleanupPeerCerts(sslSocket *ss);
 SECStatus ssl3_SendCertificateStatus(sslSocket *ss);
 SECStatus ssl3_AuthCertificate(sslSocket *ss);
-SECStatus ssl_ReadCertificateStatus(sslSocket *ss, SSL3Opaque *b,
+SECStatus ssl_ReadCertificateStatus(sslSocket *ss, PRUint8 *b,
                                     PRUint32 length);
 SECStatus ssl3_EncodeSigAlgs(const sslSocket *ss, PRUint8 *buf,
                              unsigned maxLen, PRUint32 *len);
 SECStatus ssl_GetCertificateRequestCAs(sslSocket *ss, unsigned int *calenp,
                                        SECItem **namesp, unsigned int *nnamesp);
-SECStatus ssl3_ParseCertificateRequestCAs(sslSocket *ss, SSL3Opaque **b,
+SECStatus ssl3_ParseCertificateRequestCAs(sslSocket *ss, PRUint8 **b,
                                           PRUint32 *length, PLArenaPool *arena,
                                           CERTDistNames *ca_list);
 SECStatus ssl3_CompleteHandleCertificateRequest(
diff --git a/security/nss/lib/ssl/sslsnce.c b/security/nss/lib/ssl/sslsnce.c
index cf86edcfa..3ef11f7a7 100644
--- a/security/nss/lib/ssl/sslsnce.c
+++ b/security/nss/lib/ssl/sslsnce.c
@@ -35,7 +35,7 @@
  *     sidCacheEntry            sidCacheData[ numSIDCacheEntries];
  *     certCacheEntry           certCacheData[numCertCacheEntries];
  *     SSLWrappedSymWrappingKey keyCacheData[SSL_NUM_WRAP_KEYS][SSL_NUM_WRAP_MECHS];
- *     PRUint8                  keyNameSuffix[SESS_TICKET_KEY_VAR_NAME_LEN]
+ *     PRUint8                  keyNameSuffix[SELF_ENCRYPT_KEY_VAR_NAME_LEN]
  *     encKeyCacheEntry         ticketEncKey; // Wrapped
  *     encKeyCacheEntry         ticketMacKey; // Wrapped
  *     PRBool                   ticketKeysValid;
@@ -57,7 +57,7 @@
 #include "blapit.h"
 #include "nss.h" /* for NSS_RegisterShutdown */
 #include "sechash.h"
-
+#include "selfencrypt.h"
 #include <stdio.h>
 
 #if defined(XP_UNIX) || defined(XP_BEOS)
@@ -983,7 +983,7 @@ InitCache(cacheDesc *cache, int maxCacheEntries, int maxCertCacheEntries,
 
     cache->ticketKeyNameSuffix = (PRUint8 *)ptr;
     ptr = (ptrdiff_t)(cache->ticketKeyNameSuffix +
-                      SESS_TICKET_KEY_VAR_NAME_LEN);
+                      SELF_ENCRYPT_KEY_VAR_NAME_LEN);
     ptr = SID_ROUNDUP(ptr, SID_ALIGNMENT);
 
     cache->ticketEncKey = (encKeyCacheEntry *)ptr;
@@ -1600,7 +1600,7 @@ StopLockPoller(cacheDesc *cache)
  *  Code dealing with shared wrapped symmetric wrapping keys below      *
  ************************************************************************/
 
-/* The asymmetric key we use for wrapping the symmetric ticket keys. This is a
+/* The asymmetric key we use for wrapping the self-encryption keys. This is a
  * global structure that can be initialized without a socket. Access is
  * synchronized on the reader-writer lock. This is setup either by calling
  * SSL_SetSessionTicketKeyPair() or by configuring a certificate of the
@@ -1611,77 +1611,80 @@ static struct {
     SECKEYPublicKey *pubKey;
     SECKEYPrivateKey *privKey;
     PRBool configured;
-} ssl_session_ticket_key_pair;
+} ssl_self_encrypt_key_pair;
 
-/* The symmetric ticket keys. This requires a socket to construct and requires
- * that the global structure be initialized before use. */
-static struct {
-    PRCallOnceType setup;
-    unsigned char keyName[SESS_TICKET_KEY_NAME_LEN];
-    PK11SymKey *encKey;
-    PK11SymKey *macKey;
-} ssl_session_ticket_keys;
+/* The symmetric self-encryption keys. This requires a socket to construct
+ * and requires that the global structure be initialized before use.
+ */
+static sslSelfEncryptKeys ssl_self_encrypt_keys;
+
+/* Externalize the self encrypt keys. Purely used for testing. */
+sslSelfEncryptKeys *
+ssl_GetSelfEncryptKeysInt()
+{
+    return &ssl_self_encrypt_keys;
+}
 
 static void
-ssl_CleanupSessionTicketKeyPair()
+ssl_CleanupSelfEncryptKeyPair()
 {
-    if (ssl_session_ticket_key_pair.pubKey) {
-        PORT_Assert(ssl_session_ticket_key_pair.privKey);
-        SECKEY_DestroyPublicKey(ssl_session_ticket_key_pair.pubKey);
-        SECKEY_DestroyPrivateKey(ssl_session_ticket_key_pair.privKey);
+    if (ssl_self_encrypt_key_pair.pubKey) {
+        PORT_Assert(ssl_self_encrypt_key_pair.privKey);
+        SECKEY_DestroyPublicKey(ssl_self_encrypt_key_pair.pubKey);
+        SECKEY_DestroyPrivateKey(ssl_self_encrypt_key_pair.privKey);
     }
 }
 
 void
-ssl_ResetSessionTicketKeys()
+ssl_ResetSelfEncryptKeys()
 {
-    if (ssl_session_ticket_keys.encKey) {
-        PORT_Assert(ssl_session_ticket_keys.macKey);
-        PK11_FreeSymKey(ssl_session_ticket_keys.encKey);
-        PK11_FreeSymKey(ssl_session_ticket_keys.macKey);
+    if (ssl_self_encrypt_keys.encKey) {
+        PORT_Assert(ssl_self_encrypt_keys.macKey);
+        PK11_FreeSymKey(ssl_self_encrypt_keys.encKey);
+        PK11_FreeSymKey(ssl_self_encrypt_keys.macKey);
     }
-    PORT_Memset(&ssl_session_ticket_keys, 0,
-                sizeof(ssl_session_ticket_keys));
+    PORT_Memset(&ssl_self_encrypt_keys, 0,
+                sizeof(ssl_self_encrypt_keys));
 }
 
 static SECStatus
-ssl_SessionTicketShutdown(void *appData, void *nssData)
+ssl_SelfEncryptShutdown(void *appData, void *nssData)
 {
-    ssl_CleanupSessionTicketKeyPair();
-    PR_DestroyRWLock(ssl_session_ticket_key_pair.lock);
-    PORT_Memset(&ssl_session_ticket_key_pair, 0,
-                sizeof(ssl_session_ticket_key_pair));
+    ssl_CleanupSelfEncryptKeyPair();
+    PR_DestroyRWLock(ssl_self_encrypt_key_pair.lock);
+    PORT_Memset(&ssl_self_encrypt_key_pair, 0,
+                sizeof(ssl_self_encrypt_key_pair));
 
-    ssl_ResetSessionTicketKeys();
+    ssl_ResetSelfEncryptKeys();
     return SECSuccess;
 }
 
 static PRStatus
-ssl_SessionTicketSetup(void)
+ssl_SelfEncryptSetup(void)
 {
-    SECStatus rv = NSS_RegisterShutdown(ssl_SessionTicketShutdown, NULL);
+    SECStatus rv = NSS_RegisterShutdown(ssl_SelfEncryptShutdown, NULL);
     if (rv != SECSuccess) {
         return PR_FAILURE;
     }
-    ssl_session_ticket_key_pair.lock = PR_NewRWLock(PR_RWLOCK_RANK_NONE, NULL);
-    if (!ssl_session_ticket_key_pair.lock) {
+    ssl_self_encrypt_key_pair.lock = PR_NewRWLock(PR_RWLOCK_RANK_NONE, NULL);
+    if (!ssl_self_encrypt_key_pair.lock) {
         return PR_FAILURE;
     }
     return PR_SUCCESS;
 }
 
-/* Configure a session ticket key pair.  |explicitConfig| is set to true for
+/* Configure a self encryption key pair.  |explicitConfig| is set to true for
  * calls to SSL_SetSessionTicketKeyPair(), false for implicit configuration.
  * This assumes that the setup has been run. */
 static SECStatus
-ssl_SetSessionTicketKeyPair(SECKEYPublicKey *pubKey,
-                            SECKEYPrivateKey *privKey,
-                            PRBool explicitConfig)
+ssl_SetSelfEncryptKeyPair(SECKEYPublicKey *pubKey,
+                          SECKEYPrivateKey *privKey,
+                          PRBool explicitConfig)
 {
     SECKEYPublicKey *pubKeyCopy;
     SECKEYPrivateKey *privKeyCopy;
 
-    PORT_Assert(ssl_session_ticket_key_pair.lock);
+    PORT_Assert(ssl_self_encrypt_key_pair.lock);
 
     pubKeyCopy = SECKEY_CopyPublicKey(pubKey);
     if (!pubKeyCopy) {
@@ -1696,15 +1699,17 @@ ssl_SetSessionTicketKeyPair(SECKEYPublicKey *pubKey,
         return SECFailure;
     }
 
-    PR_RWLock_Wlock(ssl_session_ticket_key_pair.lock);
-    ssl_CleanupSessionTicketKeyPair();
-    ssl_session_ticket_key_pair.pubKey = pubKeyCopy;
-    ssl_session_ticket_key_pair.privKey = privKeyCopy;
-    ssl_session_ticket_key_pair.configured = explicitConfig;
-    PR_RWLock_Unlock(ssl_session_ticket_key_pair.lock);
+    PR_RWLock_Wlock(ssl_self_encrypt_key_pair.lock);
+    ssl_CleanupSelfEncryptKeyPair();
+    ssl_self_encrypt_key_pair.pubKey = pubKeyCopy;
+    ssl_self_encrypt_key_pair.privKey = privKeyCopy;
+    ssl_self_encrypt_key_pair.configured = explicitConfig;
+    PR_RWLock_Unlock(ssl_self_encrypt_key_pair.lock);
     return SECSuccess;
 }
 
+/* This is really the self-encryption keys but it has the
+ * wrong name for historical API stability reasons. */
 SECStatus
 SSL_SetSessionTicketKeyPair(SECKEYPublicKey *pubKey,
                             SECKEYPrivateKey *privKey)
@@ -1715,53 +1720,53 @@ SSL_SetSessionTicketKeyPair(SECKEYPublicKey *pubKey,
         return SECFailure;
     }
 
-    if (PR_SUCCESS != PR_CallOnce(&ssl_session_ticket_key_pair.setup,
-                                  &ssl_SessionTicketSetup)) {
+    if (PR_SUCCESS != PR_CallOnce(&ssl_self_encrypt_key_pair.setup,
+                                  &ssl_SelfEncryptSetup)) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
     }
 
-    return ssl_SetSessionTicketKeyPair(pubKey, privKey, PR_TRUE);
+    return ssl_SetSelfEncryptKeyPair(pubKey, privKey, PR_TRUE);
 }
 
 /* When configuring a server cert, we should save the RSA key in case it is
- * needed for ticket encryption. This saves the latest copy, unless there has
+ * needed for self-encryption. This saves the latest copy, unless there has
  * been an explicit call to SSL_SetSessionTicketKeyPair(). */
 SECStatus
-ssl_MaybeSetSessionTicketKeyPair(const sslKeyPair *keyPair)
+ssl_MaybeSetSelfEncryptKeyPair(const sslKeyPair *keyPair)
 {
     PRBool configured;
 
-    if (PR_SUCCESS != PR_CallOnce(&ssl_session_ticket_key_pair.setup,
-                                  &ssl_SessionTicketSetup)) {
+    if (PR_SUCCESS != PR_CallOnce(&ssl_self_encrypt_key_pair.setup,
+                                  &ssl_SelfEncryptSetup)) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
     }
 
-    PR_RWLock_Rlock(ssl_session_ticket_key_pair.lock);
-    configured = ssl_session_ticket_key_pair.configured;
-    PR_RWLock_Unlock(ssl_session_ticket_key_pair.lock);
+    PR_RWLock_Rlock(ssl_self_encrypt_key_pair.lock);
+    configured = ssl_self_encrypt_key_pair.configured;
+    PR_RWLock_Unlock(ssl_self_encrypt_key_pair.lock);
     if (configured) {
         return SECSuccess;
     }
-    return ssl_SetSessionTicketKeyPair(keyPair->pubKey,
-                                       keyPair->privKey, PR_FALSE);
+    return ssl_SetSelfEncryptKeyPair(keyPair->pubKey,
+                                     keyPair->privKey, PR_FALSE);
 }
 
 static SECStatus
-ssl_GetSessionTicketKeyPair(SECKEYPublicKey **pubKey,
-                            SECKEYPrivateKey **privKey)
+ssl_GetSelfEncryptKeyPair(SECKEYPublicKey **pubKey,
+                          SECKEYPrivateKey **privKey)
 {
-    if (PR_SUCCESS != PR_CallOnce(&ssl_session_ticket_key_pair.setup,
-                                  &ssl_SessionTicketSetup)) {
+    if (PR_SUCCESS != PR_CallOnce(&ssl_self_encrypt_key_pair.setup,
+                                  &ssl_SelfEncryptSetup)) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
     }
 
-    PR_RWLock_Rlock(ssl_session_ticket_key_pair.lock);
-    *pubKey = ssl_session_ticket_key_pair.pubKey;
-    *privKey = ssl_session_ticket_key_pair.privKey;
-    PR_RWLock_Unlock(ssl_session_ticket_key_pair.lock);
+    PR_RWLock_Rlock(ssl_self_encrypt_key_pair.lock);
+    *pubKey = ssl_self_encrypt_key_pair.pubKey;
+    *privKey = ssl_self_encrypt_key_pair.privKey;
+    PR_RWLock_Unlock(ssl_self_encrypt_key_pair.lock);
     if (!*pubKey) {
         PORT_Assert(!*privKey);
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
@@ -1772,23 +1777,23 @@ ssl_GetSessionTicketKeyPair(SECKEYPublicKey **pubKey,
 }
 
 static PRBool
-ssl_GenerateSessionTicketKeys(void *pwArg, unsigned char *keyName,
-                              PK11SymKey **aesKey, PK11SymKey **macKey);
+ssl_GenerateSelfEncryptKeys(void *pwArg, PRUint8 *keyName,
+                            PK11SymKey **aesKey, PK11SymKey **macKey);
 
 static PRStatus
-ssl_GenerateSessionTicketKeysOnce(void *arg)
+ssl_GenerateSelfEncryptKeysOnce(void *arg)
 {
     SECStatus rv;
 
     /* Get a copy of the session keys from shared memory. */
-    PORT_Memcpy(ssl_session_ticket_keys.keyName,
-                SESS_TICKET_KEY_NAME_PREFIX,
-                sizeof(SESS_TICKET_KEY_NAME_PREFIX));
-    /* This function calls ssl_GetSessionTicketKeyPair(), which initializes the
+    PORT_Memcpy(ssl_self_encrypt_keys.keyName,
+                SELF_ENCRYPT_KEY_NAME_PREFIX,
+                sizeof(SELF_ENCRYPT_KEY_NAME_PREFIX));
+    /* This function calls ssl_GetSelfEncryptKeyPair(), which initializes the
      * key pair stuff.  That allows this to use the same shutdown function. */
-    rv = ssl_GenerateSessionTicketKeys(arg, ssl_session_ticket_keys.keyName,
-                                       &ssl_session_ticket_keys.encKey,
-                                       &ssl_session_ticket_keys.macKey);
+    rv = ssl_GenerateSelfEncryptKeys(arg, ssl_self_encrypt_keys.keyName,
+                                     &ssl_self_encrypt_keys.encKey,
+                                     &ssl_self_encrypt_keys.macKey);
     if (rv != SECSuccess) {
         return PR_FAILURE;
     }
@@ -1797,25 +1802,25 @@ ssl_GenerateSessionTicketKeysOnce(void *arg)
 }
 
 SECStatus
-ssl_GetSessionTicketKeys(sslSocket *ss, unsigned char *keyName,
-                         PK11SymKey **encKey, PK11SymKey **macKey)
+ssl_GetSelfEncryptKeys(sslSocket *ss, PRUint8 *keyName,
+                       PK11SymKey **encKey, PK11SymKey **macKey)
 {
-    if (PR_SUCCESS != PR_CallOnceWithArg(&ssl_session_ticket_keys.setup,
-                                         &ssl_GenerateSessionTicketKeysOnce,
+    if (PR_SUCCESS != PR_CallOnceWithArg(&ssl_self_encrypt_keys.setup,
+                                         &ssl_GenerateSelfEncryptKeysOnce,
                                          ss->pkcs11PinArg)) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
     }
 
-    if (!ssl_session_ticket_keys.encKey || !ssl_session_ticket_keys.macKey) {
+    if (!ssl_self_encrypt_keys.encKey || !ssl_self_encrypt_keys.macKey) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         return SECFailure;
     }
 
-    PORT_Memcpy(keyName, ssl_session_ticket_keys.keyName,
-                sizeof(ssl_session_ticket_keys.keyName));
-    *encKey = ssl_session_ticket_keys.encKey;
-    *macKey = ssl_session_ticket_keys.macKey;
+    PORT_Memcpy(keyName, ssl_self_encrypt_keys.keyName,
+                sizeof(ssl_self_encrypt_keys.keyName));
+    *encKey = ssl_self_encrypt_keys.encKey;
+    *macKey = ssl_self_encrypt_keys.macKey;
     return SECSuccess;
 }
 
@@ -1875,8 +1880,8 @@ ssl_GetWrappingKey(unsigned int wrapMechIndex,
 
 /* Wrap and cache a session ticket key. */
 static SECStatus
-WrapTicketKey(SECKEYPublicKey *svrPubKey, PK11SymKey *symKey,
-              const char *keyName, encKeyCacheEntry *cacheEntry)
+WrapSelfEncryptKey(SECKEYPublicKey *svrPubKey, PK11SymKey *symKey,
+                   const char *keyName, encKeyCacheEntry *cacheEntry)
 {
     SECItem wrappedKey = { siBuffer, NULL, 0 };
 
@@ -1888,7 +1893,7 @@ WrapTicketKey(SECKEYPublicKey *svrPubKey, PK11SymKey *symKey,
 
     if (PK11_PubWrapSymKey(CKM_RSA_PKCS, svrPubKey, symKey, &wrappedKey) !=
         SECSuccess) {
-        SSL_DBG(("%d: SSL[%s]: Unable to wrap session ticket %s.",
+        SSL_DBG(("%d: SSL[%s]: Unable to wrap self encrypt key %s.",
                  SSL_GETPID(), "unknown", keyName));
         return SECFailure;
     }
@@ -1897,15 +1902,15 @@ WrapTicketKey(SECKEYPublicKey *svrPubKey, PK11SymKey *symKey,
 }
 
 static SECStatus
-GenerateTicketKeys(void *pwArg, unsigned char *keyName, PK11SymKey **aesKey,
-                   PK11SymKey **macKey)
+GenerateSelfEncryptKeys(void *pwArg, PRUint8 *keyName, PK11SymKey **aesKey,
+                        PK11SymKey **macKey)
 {
     PK11SlotInfo *slot;
     CK_MECHANISM_TYPE mechanismArray[2];
     PK11SymKey *aesKeyTmp = NULL;
     PK11SymKey *macKeyTmp = NULL;
     cacheDesc *cache = &globalCache;
-    PRUint8 ticketKeyNameSuffixLocal[SESS_TICKET_KEY_VAR_NAME_LEN];
+    PRUint8 ticketKeyNameSuffixLocal[SELF_ENCRYPT_KEY_VAR_NAME_LEN];
     PRUint8 *ticketKeyNameSuffix;
 
     if (!cache->cacheMem) {
@@ -1916,7 +1921,7 @@ GenerateTicketKeys(void *pwArg, unsigned char *keyName, PK11SymKey **aesKey,
     }
 
     if (PK11_GenerateRandom(ticketKeyNameSuffix,
-                            SESS_TICKET_KEY_VAR_NAME_LEN) !=
+                            SELF_ENCRYPT_KEY_VAR_NAME_LEN) !=
         SECSuccess) {
         SSL_DBG(("%d: SSL[%s]: Unable to generate random key name bytes.",
                  SSL_GETPID(), "unknown"));
@@ -1940,7 +1945,7 @@ GenerateTicketKeys(void *pwArg, unsigned char *keyName, PK11SymKey **aesKey,
                  SSL_GETPID(), "unknown"));
         goto loser;
     }
-    PORT_Memcpy(keyName, ticketKeyNameSuffix, SESS_TICKET_KEY_VAR_NAME_LEN);
+    PORT_Memcpy(keyName, ticketKeyNameSuffix, SELF_ENCRYPT_KEY_VAR_NAME_LEN);
     *aesKey = aesKeyTmp;
     *macKey = macKeyTmp;
     return SECSuccess;
@@ -1954,27 +1959,27 @@ loser:
 }
 
 static SECStatus
-GenerateAndWrapTicketKeys(SECKEYPublicKey *svrPubKey, void *pwArg,
-                          unsigned char *keyName, PK11SymKey **aesKey,
-                          PK11SymKey **macKey)
+GenerateAndWrapSelfEncryptKeys(SECKEYPublicKey *svrPubKey, void *pwArg,
+                               PRUint8 *keyName, PK11SymKey **aesKey,
+                               PK11SymKey **macKey)
 {
     PK11SymKey *aesKeyTmp = NULL;
     PK11SymKey *macKeyTmp = NULL;
     cacheDesc *cache = &globalCache;
     SECStatus rv;
 
-    rv = GenerateTicketKeys(pwArg, keyName, &aesKeyTmp, &macKeyTmp);
+    rv = GenerateSelfEncryptKeys(pwArg, keyName, &aesKeyTmp, &macKeyTmp);
     if (rv != SECSuccess) {
         return SECFailure;
     }
 
     if (cache->cacheMem) {
         /* Export the keys to the shared cache in wrapped form. */
-        rv = WrapTicketKey(svrPubKey, aesKeyTmp, "enc key", cache->ticketEncKey);
+        rv = WrapSelfEncryptKey(svrPubKey, aesKeyTmp, "enc key", cache->ticketEncKey);
         if (rv != SECSuccess) {
             goto loser;
         }
-        rv = WrapTicketKey(svrPubKey, macKeyTmp, "mac key", cache->ticketMacKey);
+        rv = WrapSelfEncryptKey(svrPubKey, macKeyTmp, "mac key", cache->ticketMacKey);
         if (rv != SECSuccess) {
             goto loser;
         }
@@ -1990,8 +1995,8 @@ loser:
 }
 
 static SECStatus
-UnwrapCachedTicketKeys(SECKEYPrivateKey *svrPrivKey, unsigned char *keyName,
-                       PK11SymKey **aesKey, PK11SymKey **macKey)
+UnwrapCachedSelfEncryptKeys(SECKEYPrivateKey *svrPrivKey, PRUint8 *keyName,
+                            PK11SymKey **aesKey, PK11SymKey **macKey)
 {
     SECItem wrappedKey = { siBuffer, NULL, 0 };
     PK11SymKey *aesKeyTmp = NULL;
@@ -2019,7 +2024,7 @@ UnwrapCachedTicketKeys(SECKEYPrivateKey *svrPrivKey, unsigned char *keyName,
              SSL_GETPID(), "unknown"));
 
     PORT_Memcpy(keyName, cache->ticketKeyNameSuffix,
-                SESS_TICKET_KEY_VAR_NAME_LEN);
+                SELF_ENCRYPT_KEY_VAR_NAME_LEN);
     *aesKey = aesKeyTmp;
     *macKey = macKeyTmp;
     return SECSuccess;
@@ -2033,8 +2038,8 @@ loser:
 }
 
 static SECStatus
-ssl_GenerateSessionTicketKeys(void *pwArg, unsigned char *keyName,
-                              PK11SymKey **encKey, PK11SymKey **macKey)
+ssl_GenerateSelfEncryptKeys(void *pwArg, PRUint8 *keyName,
+                            PK11SymKey **encKey, PK11SymKey **macKey)
 {
     SECKEYPrivateKey *svrPrivKey;
     SECKEYPublicKey *svrPubKey;
@@ -2042,11 +2047,11 @@ ssl_GenerateSessionTicketKeys(void *pwArg, unsigned char *keyName,
     SECStatus rv;
     cacheDesc *cache = &globalCache;
 
-    rv = ssl_GetSessionTicketKeyPair(&svrPubKey, &svrPrivKey);
+    rv = ssl_GetSelfEncryptKeyPair(&svrPubKey, &svrPrivKey);
     if (rv != SECSuccess || !cache->cacheMem) {
         /* No key pair for wrapping, or the cache is uninitialized. Generate
          * keys and return them without caching. */
-        return GenerateTicketKeys(pwArg, keyName, encKey, macKey);
+        return GenerateSelfEncryptKeys(pwArg, keyName, encKey, macKey);
     }
 
     now = LockSidCacheLock(cache->keyCacheLock, 0);
@@ -2054,11 +2059,11 @@ ssl_GenerateSessionTicketKeys(void *pwArg, unsigned char *keyName,
         return SECFailure;
 
     if (*(cache->ticketKeysValid)) {
-        rv = UnwrapCachedTicketKeys(svrPrivKey, keyName, encKey, macKey);
+        rv = UnwrapCachedSelfEncryptKeys(svrPrivKey, keyName, encKey, macKey);
     } else {
         /* Keys do not exist, create them. */
-        rv = GenerateAndWrapTicketKeys(svrPubKey, pwArg, keyName,
-                                       encKey, macKey);
+        rv = GenerateAndWrapSelfEncryptKeys(svrPubKey, pwArg, keyName,
+                                            encKey, macKey);
         if (rv == SECSuccess) {
             *(cache->ticketKeysValid) = 1;
         }
diff --git a/security/nss/lib/ssl/tls13con.c b/security/nss/lib/ssl/tls13con.c
index 37b7e810a..560493848 100644
--- a/security/nss/lib/ssl/tls13con.c
+++ b/security/nss/lib/ssl/tls13con.c
@@ -57,17 +57,17 @@ static SECStatus tls13_SendHelloRetryRequest(sslSocket *ss,
                                              const sslNamedGroupDef *selectedGroup);
 
 static SECStatus tls13_HandleServerKeyShare(sslSocket *ss);
-static SECStatus tls13_HandleEncryptedExtensions(sslSocket *ss, SSL3Opaque *b,
+static SECStatus tls13_HandleEncryptedExtensions(sslSocket *ss, PRUint8 *b,
                                                  PRUint32 length);
 static SECStatus tls13_SendCertificate(sslSocket *ss);
 static SECStatus tls13_HandleCertificate(
-    sslSocket *ss, SSL3Opaque *b, PRUint32 length);
-static SECStatus tls13_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b,
+    sslSocket *ss, PRUint8 *b, PRUint32 length);
+static SECStatus tls13_HandleCertificateRequest(sslSocket *ss, PRUint8 *b,
                                                 PRUint32 length);
 static SECStatus
 tls13_SendCertificateVerify(sslSocket *ss, SECKEYPrivateKey *privKey);
 static SECStatus tls13_HandleCertificateVerify(
-    sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+    sslSocket *ss, PRUint8 *b, PRUint32 length,
     SSL3Hashes *hashes);
 static SECStatus tls13_RecoverWrappedSharedSecret(sslSocket *ss,
                                                   sslSessionID *sid);
@@ -84,15 +84,15 @@ static SECStatus tls13_ComputePskBinderHash(sslSocket *ss,
                                             SSL3Hashes *hashes);
 static SECStatus tls13_VerifyFinished(sslSocket *ss, SSL3HandshakeType message,
                                       PK11SymKey *secret,
-                                      SSL3Opaque *b, PRUint32 length,
+                                      PRUint8 *b, PRUint32 length,
                                       const SSL3Hashes *hashes);
 static SECStatus tls13_ClientHandleFinished(sslSocket *ss,
-                                            SSL3Opaque *b, PRUint32 length,
+                                            PRUint8 *b, PRUint32 length,
                                             const SSL3Hashes *hashes);
 static SECStatus tls13_ServerHandleFinished(sslSocket *ss,
-                                            SSL3Opaque *b, PRUint32 length,
+                                            PRUint8 *b, PRUint32 length,
                                             const SSL3Hashes *hashes);
-static SECStatus tls13_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b,
+static SECStatus tls13_HandleNewSessionTicket(sslSocket *ss, PRUint8 *b,
                                               PRUint32 length);
 static SECStatus tls13_ComputeHandshakeHashes(sslSocket *ss,
                                               SSL3Hashes *hashes);
@@ -468,7 +468,7 @@ tls13_SetupClientHello(sslSocket *ss)
 
 static SECStatus
 tls13_ImportDHEKeyShare(sslSocket *ss, SECKEYPublicKey *peerKey,
-                        SSL3Opaque *b, PRUint32 length,
+                        PRUint8 *b, PRUint32 length,
                         SECKEYPublicKey *pubKey)
 {
     SECStatus rv;
@@ -559,7 +559,7 @@ loser:
 }
 
 SECStatus
-tls13_HandlePostHelloHandshakeMessage(sslSocket *ss, SSL3Opaque *b,
+tls13_HandlePostHelloHandshakeMessage(sslSocket *ss, PRUint8 *b,
                                       PRUint32 length, SSL3Hashes *hashesPtr)
 {
     if (ss->sec.isServer && ss->ssl3.hs.zeroRttIgnore != ssl_0rtt_ignore_none) {
@@ -1662,7 +1662,7 @@ tls13_SendCertificateRequest(sslSocket *ss)
 }
 
 SECStatus
-tls13_HandleHelloRetryRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+tls13_HandleHelloRetryRequest(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SECStatus rv;
     PRUint32 tmp;
@@ -1751,7 +1751,7 @@ tls13_HandleHelloRetryRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
 }
 
 static SECStatus
-tls13_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+tls13_HandleCertificateRequest(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SECStatus rv;
     TLS13CertificateRequest *certRequest = NULL;
@@ -2328,7 +2328,7 @@ tls13_HandleCertificateEntry(sslSocket *ss, SECItem *data, PRBool first,
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
-tls13_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+tls13_HandleCertificate(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SECStatus rv;
     SECItem context = { siBuffer, NULL, 0 };
@@ -3026,7 +3026,7 @@ tls13_ChaCha20Poly1305(ssl3KeyMaterial *keys, PRBool doDecrypt,
 }
 
 static SECStatus
-tls13_HandleEncryptedExtensions(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+tls13_HandleEncryptedExtensions(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SECStatus rv;
     PRUint32 innerLength;
@@ -3238,7 +3238,7 @@ done:
  * Caller must hold Handshake and RecvBuf locks.
  */
 SECStatus
-tls13_HandleCertificateVerify(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+tls13_HandleCertificateVerify(sslSocket *ss, PRUint8 *b, PRUint32 length,
                               SSL3Hashes *hashes)
 {
     SECItem signed_hash = { siBuffer, NULL, 0 };
@@ -3479,7 +3479,7 @@ tls13_SendFinished(sslSocket *ss, PK11SymKey *baseKey)
 static SECStatus
 tls13_VerifyFinished(sslSocket *ss, SSL3HandshakeType message,
                      PK11SymKey *secret,
-                     SSL3Opaque *b, PRUint32 length,
+                     PRUint8 *b, PRUint32 length,
                      const SSL3Hashes *hashes)
 {
     SECStatus rv;
@@ -3517,7 +3517,7 @@ tls13_VerifyFinished(sslSocket *ss, SSL3HandshakeType message,
 }
 
 static SECStatus
-tls13_ClientHandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+tls13_ClientHandleFinished(sslSocket *ss, PRUint8 *b, PRUint32 length,
                            const SSL3Hashes *hashes)
 {
     SECStatus rv;
@@ -3544,7 +3544,7 @@ tls13_ClientHandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
 }
 
 static SECStatus
-tls13_ServerHandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+tls13_ServerHandleFinished(sslSocket *ss, PRUint8 *b, PRUint32 length,
                            const SSL3Hashes *hashes)
 {
     SECStatus rv;
@@ -3868,7 +3868,7 @@ loser:
 }
 
 static SECStatus
-tls13_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+tls13_HandleNewSessionTicket(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     SECStatus rv;
     PRUint32 utmp;
@@ -4123,7 +4123,7 @@ SECStatus
 tls13_ProtectRecord(sslSocket *ss,
                     ssl3CipherSpec *cwSpec,
                     SSL3ContentType type,
-                    const SSL3Opaque *pIn,
+                    const PRUint8 *pIn,
                     PRUint32 contentLen,
                     sslBuffer *wrBuf)
 {
diff --git a/security/nss/lib/ssl/tls13con.h b/security/nss/lib/ssl/tls13con.h
index 189da0aed..92eb545b0 100644
--- a/security/nss/lib/ssl/tls13con.h
+++ b/security/nss/lib/ssl/tls13con.h
@@ -57,10 +57,10 @@ SECStatus tls13_HandleClientHelloPart2(sslSocket *ss,
                                        const SECItem *suites,
                                        sslSessionID *sid);
 SECStatus tls13_HandleServerHelloPart2(sslSocket *ss);
-SECStatus tls13_HandlePostHelloHandshakeMessage(sslSocket *ss, SSL3Opaque *b,
+SECStatus tls13_HandlePostHelloHandshakeMessage(sslSocket *ss, PRUint8 *b,
                                                 PRUint32 length,
                                                 SSL3Hashes *hashesPtr);
-SECStatus tls13_HandleHelloRetryRequest(sslSocket *ss, SSL3Opaque *b,
+SECStatus tls13_HandleHelloRetryRequest(sslSocket *ss, PRUint8 *b,
                                         PRUint32 length);
 void tls13_DestroyKeyShareEntry(TLS13KeyShareEntry *entry);
 void tls13_DestroyKeyShares(PRCList *list);
@@ -73,7 +73,7 @@ PRBool tls13_ExtensionAllowed(PRUint16 extension, SSL3HandshakeType message);
 SECStatus tls13_ProtectRecord(sslSocket *ss,
                               ssl3CipherSpec *cwSpec,
                               SSL3ContentType type,
-                              const SSL3Opaque *pIn,
+                              const PRUint8 *pIn,
                               PRUint32 contentLen,
                               sslBuffer *wrBuf);
 PRInt32 tls13_Read0RttData(sslSocket *ss, void *buf, PRInt32 len);
diff --git a/security/nss/lib/util/nssutil.h b/security/nss/lib/util/nssutil.h
index b3eaa3a7a..5d7f22f35 100644
--- a/security/nss/lib/util/nssutil.h
+++ b/security/nss/lib/util/nssutil.h
@@ -19,10 +19,10 @@
  * The format of the version string should be
  *     "<major version>.<minor version>[.<patch level>[.<build number>]][ <Beta>]"
  */
-#define NSSUTIL_VERSION "3.31.1"
+#define NSSUTIL_VERSION "3.32"
 #define NSSUTIL_VMAJOR 3
-#define NSSUTIL_VMINOR 31
-#define NSSUTIL_VPATCH 1
+#define NSSUTIL_VMINOR 32
+#define NSSUTIL_VPATCH 0
 #define NSSUTIL_VBUILD 0
 #define NSSUTIL_BETA PR_FALSE
 
diff --git a/security/nss/lib/util/quickder.c b/security/nss/lib/util/quickder.c
index 49ff14d55..1b474822e 100644
--- a/security/nss/lib/util/quickder.c
+++ b/security/nss/lib/util/quickder.c
@@ -408,6 +408,10 @@ DecodePointer(void* dest,
 {
     const SEC_ASN1Template* ptrTemplate =
         SEC_ASN1GetSubtemplate(templateEntry, dest, PR_FALSE);
+    if (!ptrTemplate) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        return SECFailure;
+    }
     void* subdata = PORT_ArenaZAlloc(arena, ptrTemplate->size);
     *(void**)((char*)dest + templateEntry->offset) = subdata;
     if (subdata) {
diff --git a/security/nss/lib/util/secport.c b/security/nss/lib/util/secport.c
index 0eea0cda0..01a7d0834 100644
--- a/security/nss/lib/util/secport.c
+++ b/security/nss/lib/util/secport.c
@@ -699,6 +699,9 @@ NSS_PutEnv(const char *envVarName, const char *envValue)
 #endif
 
     encoded = (char *)PORT_ZAlloc(strlen(envVarName) + 2 + strlen(envValue));
+    if (!encoded) {
+        return SECFailure;
+    }
     strcpy(encoded, envVarName);
     strcat(encoded, "=");
     strcat(encoded, envValue);
diff --git a/security/nss/manifest.mn b/security/nss/manifest.mn
index 32086bf44..500a5ad64 100644
--- a/security/nss/manifest.mn
+++ b/security/nss/manifest.mn
@@ -10,4 +10,4 @@ IMPORTS =	nspr20/v4.8 \
 
 RELEASE = nss
 
-DIRS = coreconf lib cmd gtests
+DIRS = coreconf lib cmd cpputil gtests
diff --git a/security/nss/nss-tool/common/util.cc b/security/nss/nss-tool/common/util.cc
index e5af2cb8a..77459155a 100644
--- a/security/nss/nss-tool/common/util.cc
+++ b/security/nss/nss-tool/common/util.cc
@@ -199,3 +199,18 @@ std::vector<uint8_t> ReadInputData(std::string dataPath) {
 
   return data;
 }
+
+std::istream &GetStreamFromFileOrStdin(std::string &path, std::ifstream &ifs) {
+  if (path.empty()) {
+    return std::cin;
+  }
+
+  ifs.open(path, std::ifstream::binary);
+  if (!ifs.good()) {
+    std::cerr << "IO Error when opening " << path << std::endl;
+    std::cerr << "Input file does not exist or you don't have permissions."
+              << std::endl;
+  }
+
+  return ifs;
+}
diff --git a/security/nss/nss-tool/common/util.h b/security/nss/nss-tool/common/util.h
index bc2e297a4..58fb05839 100644
--- a/security/nss/nss-tool/common/util.h
+++ b/security/nss/nss-tool/common/util.h
@@ -27,5 +27,6 @@ bool ChangeSlotPassword(void);
 bool DBLoginIfNeeded(const ScopedPK11SlotInfo &slot);
 std::string StringToHex(const ScopedSECItem &input);
 std::vector<uint8_t> ReadInputData(std::string dataPath);
+std::istream &GetStreamFromFileOrStdin(std::string &path, std::ifstream &ifs);
 
 #endif  // util_h__
diff --git a/security/nss/nss-tool/nss_tool.cc b/security/nss/nss-tool/nss_tool.cc
index 1d8fc6153..8864f140d 100644
--- a/security/nss/nss-tool/nss_tool.cc
+++ b/security/nss/nss-tool/nss_tool.cc
@@ -13,6 +13,7 @@
 
 #include "argparse.h"
 #include "db/dbtool.h"
+#include "digest/digesttool.h"
 #include "enc/enctool.h"
 #include "tool.h"
 
@@ -21,11 +22,13 @@ static void Usage() {
   std::cerr << "       nss db [--path <directory>] <commands>" << std::endl;
   std::cerr << "       nss encrypt <options>" << std::endl;
   std::cerr << "       nss decrypt <options>" << std::endl;
+  std::cerr << "       nss digest <options>" << std::endl;
 }
 
 static const std::string kDbCommand = "db";
 static const std::string kEncryptCommand = "encrypt";
 static const std::string kDecryptCommand = "decrypt";
+static const std::string kDigestCommand = "digest";
 
 int main(int argc, char **argv) {
   if (argc < 2) {
@@ -46,6 +49,9 @@ int main(int argc, char **argv) {
     tool = std::unique_ptr<Tool>(new EncTool());
     arguments.push_back("--decrypt");
   }
+  if (argv[1] == kDigestCommand) {
+    tool = std::unique_ptr<Tool>(new DigestTool());
+  }
   if (!tool) {
     Usage();
     return 1;
diff --git a/security/nss/nss-tool/nss_tool.gyp b/security/nss/nss-tool/nss_tool.gyp
index ed408e9b6..a5d03fcf9 100644
--- a/security/nss/nss-tool/nss_tool.gyp
+++ b/security/nss/nss-tool/nss_tool.gyp
@@ -16,6 +16,7 @@
         'common/util.cc',
         'db/dbtool.cc',
         'enc/enctool.cc',
+        'digest/digesttool.cc'
       ],
       'include_dirs': [
         'common',
diff --git a/security/nss/nss.gyp b/security/nss/nss.gyp
index 97586b333..e62d28449 100644
--- a/security/nss/nss.gyp
+++ b/security/nss/nss.gyp
@@ -59,7 +59,8 @@
         'lib/smime/smime.gyp:smime',
         'lib/softoken/softoken.gyp:softokn',
         'lib/ssl/ssl.gyp:ssl',
-        'lib/util/util.gyp:nssutil'
+        'lib/util/util.gyp:nssutil',
+        'lib/libpkix/libpkix.gyp:libpkix',
       ],
       'conditions': [
         [ 'OS=="linux"', {
@@ -73,21 +74,6 @@
             'lib/softoken/legacydb/legacydb.gyp:nssdbm',
           ],
         }],
-        [ 'disable_libpkix==0', {
-          'dependencies': [
-            'lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
-            'lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
-            'lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
-            'lib/libpkix/pkix/params/params.gyp:pkixparams',
-            'lib/libpkix/pkix/results/results.gyp:pkixresults',
-            'lib/libpkix/pkix/store/store.gyp:pkixstore',
-            'lib/libpkix/pkix/top/top.gyp:pkixtop',
-            'lib/libpkix/pkix/util/util.gyp:pkixutil',
-            'lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule',
-            'lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
-            'lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
-          ],
-        }],
         [ 'use_system_sqlite==0', {
           'dependencies': [
             'lib/sqlite/sqlite.gyp:sqlite',
diff --git a/security/nss/readme.md b/security/nss/readme.md
index 8ffb64ec8..b75bfe7dd 100644
--- a/security/nss/readme.md
+++ b/security/nss/readme.md
@@ -42,9 +42,10 @@ your system environment to use the libraries of your build from the "lib"
 directory, e.g., using the `LD_LIBRARY_PATH` or `DYLD_LIBRARY_PATH`.
 
     Usage: build.sh [-hcv] [-j <n>] [--nspr] [--gyp|-g] [--opt|-o] [-m32]
-                    [--test] [--fuzz] [--pprof] [--scan-build[=output]]
+                    [--test] [--pprof] [--scan-build[=output]] [--ct-verif]
                     [--asan] [--ubsan] [--msan] [--sancov[=edge|bb|func|...]]
-                    [--ct-verif] [--disable-tests]
+                    [--disable-tests] [--fuzz[=tls|oss]] [--system-sqlite]
+                    [--no-zdefs] [--with-nspr] [--system-nspr] [--enable-libpkix]
 
     This script builds NSS with gyp and ninja.
 
@@ -62,7 +63,9 @@ directory, e.g., using the `LD_LIBRARY_PATH` or `DYLD_LIBRARY_PATH`.
         --opt|-o         do an opt build
         -m32             do a 32-bit build on a 64-bit system
         --test           ignore map files and export everything we have
-        --fuzz           enable fuzzing mode. this always enables test builds
+        --fuzz           build fuzzing targets (this always enables test builds)
+                         --fuzz=tls to enable TLS fuzzing mode
+                         --fuzz=oss to build for OSS-Fuzz
         --pprof          build with gperftool support
         --ct-verif       build with valgrind for ct-verif
         --scan-build     run the build with scan-build (scan-build has to be in the path)
@@ -74,6 +77,13 @@ directory, e.g., using the `LD_LIBRARY_PATH` or `DYLD_LIBRARY_PATH`.
         --sancov         do sanitize coverage builds
                          --sancov=func sets coverage to function level for example
         --disable-tests  don't build tests and corresponding cmdline utils
+        --system-sqlite  use system sqlite
+        --no-zdefs       don't set -Wl,-z,defs
+        --with-nspr      don't build NSPR but use the one at the given location, e.g.
+                         --with-nspr=/path/to/nspr/include:/path/to/nspr/lib
+        --system-nspr    use system nspr. This requires an installation of NSPR and
+                         might not work on all systems.
+        --enable-libpkix make libpkix part of the build.
 
 ## Building NSS (legacy build system)
 
diff --git a/security/nss/tests/gtests/gtests.sh b/security/nss/tests/gtests/gtests.sh
index 8c9d656cb..c785241c4 100644
--- a/security/nss/tests/gtests/gtests.sh
+++ b/security/nss/tests/gtests/gtests.sh
@@ -24,7 +24,7 @@ gtest_init()
 {
   cd "$(dirname "$1")"
   if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
-      cd common
+      cd ../common
       . ./init.sh
   fi
 
diff --git a/security/nss/tests/interop/interop.sh b/security/nss/tests/interop/interop.sh
index 12cefd044..59f0cb481 100644
--- a/security/nss/tests/interop/interop.sh
+++ b/security/nss/tests/interop/interop.sh
@@ -26,6 +26,7 @@ interop_init()
   if [ ! -d "$INTEROP" ]; then
     git clone -q https://github.com/mozilla/tls-interop "$INTEROP"
   fi
+  INTEROP=$(cd "$INTEROP";pwd -P)
 
   # We use the BoringSSL keyfiles
   BORING=${BORING:=boringssl}
@@ -33,6 +34,7 @@ interop_init()
     git clone -q https://boringssl.googlesource.com/boringssl "$BORING"
     git -C "$BORING" checkout -q ea80f9d5df4c302de391e999395e1c87f9c786b3
   fi
+  BORING=$(cd "$BORING";pwd -P)
 
   SCRIPTNAME="interop.sh"
   html_head "interop test"
@@ -53,7 +55,7 @@ interop_run()
   server=$3
 
   (cd "$INTEROP";
-   cargo run -- --client ${client} --server ${server} --rootdir ../${BORING}/ssl/test/runner/ --test-cases cases.json) 2>interop-${test_name}.errors | tee interop-${test_name}.log
+   cargo run -- --client "$client" --server "$server" --rootdir "$BORING"/ssl/test/runner/ --test-cases cases.json) 2>interop-${test_name}.errors | tee interop-${test_name}.log
   html_msg "${PIPESTATUS[0]}" 0 "Interop" "Run successfully"
   grep -i 'FAILED\|Assertion failure' interop-${test_name}.errors
   html_msg $? 1 "Interop" "No failures"
@@ -62,7 +64,7 @@ interop_run()
 cd "$(dirname "$0")"
 SOURCE_DIR="$PWD"/../..
 interop_init
-NSS_SHIM="${BINDIR}"/nss_bogo_shim
-BORING_SHIM="../${BORING}"/build/ssl/test/bssl_shim
+NSS_SHIM="$BINDIR"/nss_bogo_shim
+BORING_SHIM="$BORING"/build/ssl/test/bssl_shim
 interop_run "nss_nss" ${NSS_SHIM} ${NSS_SHIM}
 interop_cleanup
