Custom Building NSS Lib for Mozilla Products

Mozilla in their great wisdom doesn't build their utility (addbuiltin) for adding extra root certificates when they build their main binaries (firefox/thunderbird) so you will need to do this prior to rebuilding libnss...

Step 1, getting the libnss source code:

wget ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_10_RTM/src/nss-3.10.tar.gz
wget ftp://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.6/src/nspr-4.6.tar.gz

Next extract both tar balls:

cd /usr/src
tar xzvf nss-3.10.tar.gz
tar xzvf nspr-4.6.tar.gz

You'll also need to more the nspr source tree into nss directory:

mv nspr-4.6/mozilla/nsprpub nss-3.10/mozilla/

Finally to build things you will need to do run make commands:

cd nss-3.10/mozilla/security/nss
make nss_build_all
cd cmd/addbuiltin
make

To run addbuiltin without installing mozilla libs you will need to do the following:

echo /usr/src/nss-3.10/mozilla/dist/Linux2.6_x86_glibc_PTH_DBG.OBJ/lib >> /etc/ld.so.conf
ldconfig
cp -a Linux2.6_x86_glibc_PTH_DBG.OBJ/addbuiltin /usr/bin

Download a copy of the CAcert root certificate in DER format only. Then run the addbuiltin program that comes with NSS code:

addbuiltin -n "CAcert Inc." -t "CT,C,C" < CAcert.der >> certdata.txt

This will append the our root certificate to:

nss-3.9.2/mozilla/security/nss/lib/ckfw/builtins/certdata.txt

Then you need to run: (make sure you are in the mozilla/security/nss/lib/ckfw/builtins directory)

make generate

Then build NSS. The end result is in a new libnssckbi library, which depending on your architecture will end up in a file like:

nss-3.9.2/mozilla/security/nss/lib/ckfw/builtins/Darwin7.8.0_OPT.OBJ/libnssckbi.dylib

Debian/Ubuntu Specific Notes

You need to grab a few packages on a fresh install:

apt-get -y install build-essential zip