- Add CERN CA

- Add back missing Mozilla Policy

- Backport upstream fix for CVE-2018-12384
- Remove nss-lockcert-api-change.patch, which turned out to be a
  mistake (the symbol was not exported from libnss)

- Backport upstream fix for CVE-2018-12384
- Remove nss-lockcert-api-change.patch, which turned out to be a
  mistake (the symbol was not exported from libnss)

- include CERN CA certificates

- Restore CERT_LockCertTrust and CERT_UnlockCertTrust back in cert.h

- Add CERN certs as builtins.

- Backport patch to simplify transcript calculation for CertificateVerify

- Backport patch to simplify transcript calculation for CertificateVerify

- Fix zero-length record treatment for stream ciphers and SSLv2

- Fix zero-length record treatment for stream ciphers and SSLv2

- Add CERN CAs

- Rebase to 3.28.4

- add CERN certs

- Fix crash with tstclnt -W
- Adjust gtests to run with our old softoken and downstream patches

- Update expired PayPalEE.cert

- Update expired PayPalEE.cert

- Add CERN CAs

- Mozilla #1314604 / Red Hat CVE-2016-8635
- remove disable_hw_gcm.patch which hasn't been used since 3.16.1

- add CERN CAs

- Ensure all ssl.sh tests are executed

- Ensure all ssl.sh tests are executed

- Ensure all ssl.sh tests are executed

- include CERN CA certificates

- Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
- Resolves: Bug 1289881

- include CERN CA certificates

- Rebuild against updated NSPR

- add CERN certificates as built-ins.

- Additional NULL initialization.

- add CERN certificates as built-ins.

- On RHEL 6.x keep the TLS version defaults unchanged.

- Carry over changes to include cern certificates

- Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
- Remove unused indentation pseudo patch
- require nss util 3.16.2.3

- Carry over changes to include cern certificates

- Resolves: Bug 1145432 - CVE-2014-1568

- Carry over changes to include cern certificates

- Replace expired PayPal test certificate that breaks the build
- Resolves: Bug 1145431 - CVE-2014-1568

- Update some patches on account of the rebase
- Resolves: Bug 1099619

- Update some patches on account of the rebase
- Resolves: Bug 1099619

- Make pem's derEncodingsMatch function work with encrypted keys
- Resolves: Bug 1048713 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL

- Make pem's derEncodingsMatch function work with encrypted keys
- Resolves: Bug 1048713 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL

- Revoke trust in one mis-issued anssi certificate
- Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]

- Revoke trust in one mis-issued anssi certificate
- Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]

- add CERN certificates as built-ins.

- Enable patch with fix for deadlock in trust domain lock and object lock
- Resolves: Bug 1036477 - deadlock in trust domain lock and object lock
- Disable hw gcm on rhel-5 based build environments where OS lacks support
- Rollback changes to build nss without softokn until Bug 689919 is approved
- Cipher suite was run as part of the nss-softokn build

- add CERN certificates as built-ins.

- Using export NSS_DISABLE_HW_GCM=1 to deal with some problemmatic build systems
- Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so

- Using export NSS_DISABLE_HW_GCM=1 to deal with some problemmatic build systems
- Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so

- Revert to accepting MD5 on digital signatures by default
- Resolves: rhbz#957603 - nss 3.14 - MD5 hash algorithm disabled

- Revert to accepting MD5 on digital signatures by default
- Resolves: rhbz#957603 - nss 3.14 - MD5 hash algorithm disabled

- Recreate the distrust patch by backporting the upstream one
- Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate

- Recreate the distrust patch by backporting the upstream one
- Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate

- Recreate the distrust patch by backporting the upstream one
- Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate

- Retagging for rhel-6.3 z-stream
- Update to NSS_3_13_6_RTM
- Resolves: rhbz#891663 - Update to 3.13.5 for mozilla 10.0.6
- Resolves: rhbz#891151 [CVE-2013-0743]

- added CERN CA certificates to builtin

- Resolves: rhbz#834100 - Update to 3.13.5 for mozilla 10.0.6

- Resolves: rhbz#828679 - retaggin

- Resolves: rhbz#828679 - retaggin

- Resolves: #rhbz#805232 PEM module may attempt to free uninitialized pointer

- Resolves: #rhbz#805232 PEM module may attempt to free uninitialized pointer

- Resolves: rhbz#798461 - Protect NSS_Shutdown from clients that fail to initialize nss

- Resolves: rhbz#798461 - Protect NSS_Shutdown from clients that fail to initialize nss

- Add patches for bugs 783315 and 747387
- Related: rhbz#744072 - Update to 3.13.1

- Add patches for bugs 783315 and 747387
- Related: rhbz#744072 - Update to 3.13.1

- Resolves: Bug 766056 - Fix nss-735047.patch to not revert the nss-bz689031.patch

- Resolves: Bug 766056 - Fix nss-735047.patch to not revert the nss-bz689031.patch

- added CERN CA certificates to builtin

- Update builtins certs to those from NSSCKBI_1_88_RTM

- Update builtins certs to those from NSSCKBI_1_88_RTM

- Retagging

- Retagging

- Retagging

- added CERN CA certificates to builtin

- Add "Conflicts: curl < 7.19.7-26.el6" to fix Bug 694663

- added CERN CA certificates to builtin

- Update builtin certs to NSS_3.12.9_WITH_CKBI_1_82_RTM via a patch

- Update to 3.12.8