Prior to this update, the softokn PKCS#11 module interface used a wrong object type which caused it to return an object with an invalid CKA_CERTIFICATE_TYPE attribute. With this update, the softokn PKCS#11 module interface uses the correct object type.

Rebuilding the nss package when IPv6 is enabled caused it to enter a loop in the test part of the rebuild. With this update, the selfserv test tool has been modified to use a dual-stack IPv6 listening socket, which can accept connections from both IPv4 and IPv6 clients.

The help page displayed after issuing the certutil -H command was missing the -W option (which changes the password to a key database). With this update, the -W option has been added to the help page.

Importing a private key (using the pk12util command) did not work for private keys placed in the /etc/pki/nssdb/ directory due to permission restrictions. This update addresses this issue, and the nss-sysinit module now enables the root user to import private key.

Due to a bug in the nss-sysinit package, visiting a specific website in the Mozilla Firefox web browser caused that website to return an This Connection is Untrusted. error even though the web page had a valid security certificate. With this update, this issue has been fixed and visiting the specific web site no longer returns SSL errors.

Prior to this update, PKCS#8 encoded PEM (Privacy Enhanced Mail) RSA private key files could not be read by nss and resulted in an error when being imported. With this update, nss correctly handles the aforementioned files.

This update fixes an unclosed comment in the source code which occurred after the said comment was reduced to a one line comment by a previously applied patch.

Support for Intel Advanced Encryption Standard Instructions (AES-NI) in the nss package has been enabled and works as expected.

This update fixes possible memory leaks in the SECKEY_DestroyPublicKey(SECKEY_ImportDERPublicKey(…)) function.

Under certain circumstances, after removing a Certificate Authority (CA) from the trust database, nss continues to consider the removed CA as trusted. This was due to improper handling of trust flags when removing a CA from the trust database. With this update, trust flags from the user database take precedence over the trust flags inherited from the system database, fixing this issue.

Prior to this update, when the setup-nsssysinit.sh script rewrote/recreated the pkcs11.txt file, it took the current umask (user mask) into an account. However, if run with restrictive umask settings, the pkcs11.txt file could be created with permissions that did not allow non-privileged users to read it. This could cause nss-sysinit to remain disabled even when it was intended to be enabled. With this update, the permissions of the pkcs11.txt file are changed at the end of the run of the setup-nsssysinit.sh script, fixing this issue.

The %verify(not md5 size mtime) declarations have been added to the configuration files.

The nss-sysinit application is no longer disabled after the package is upgraded.

Issuing an OpenLDAP command and using the LDAPTLS_CACERTDIR variable to pass in an arbitrary directory containing other directories caused the command to abort because OpenLDAP tried to pass down the directory as a file. With this update, specified files that are directories are properly rejected in the aforementioned case.

The PayPalEE.cert certificate expired on Oct 31, 2010, which caused the nss package to fail to build. This update prolongs this expiration date of this certificate, and the nss package no longer fails to build.

Various headers have been added to the nss-softokn-freebl-devel subpackage.

Updating the nss package but not the curl package on systems configured with both Satellite and non-Satellite repositories resulted in a segmentation fault in Yum. With this update, the segmentation fault no longer occurs in the aforementioned case.

The nss package has been updated for the 3.6.11 version of Mozilla Firefox.

This update introduces nss-sysinit status reporting.

This update enables nss to use PEM files interchangeably in a single process.