Source code
Revision control
Copy as Markdown
Other Tools
(mozilla-projects-nss-reference-nss-environment-variables)=
# NSS environment variables
::::{container}
:::{note}
**Note: NSS Environment Variables are subject to be changed and/or removed from NSS.**
:::
::::
(run-time-environment-variables)=
## Run-Time Environment Variables
:::{container}
These environment variables affect the RUN TIME behavior of NSS shared libraries. There is a
separate set of environment variables that affect how NSS is built, documented below.
```{eval-rst}
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| Variable | Type | Description | Introduced in version |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSRANDCOUNT`` | Integer | Sets the maximum | 3.12.3 |
| | (byte count) | number of bytes to | |
| | | read from the file | |
| | | named in the | |
| | | environment variable | |
| | | NSRANDFILE (see | |
| | | below). Makes | |
| | | NSRANDFILE usable with | |
| | | /dev/urandom. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSRANDFILE`` | String | Uses this file to seed | Before 3.0 |
| | (file name) | the Pseudo Random | |
| | | Number Generator. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_ALLOW_WEAK_SIGNATURE_ALG`` | Boolean | Enables the use of MD2 | 3.12.3 |
| | (any non-empty value | and MD4 inside | |
| | to enable) | signatures. This was | |
| | | allowed by default | |
| | | before NSS 3.12.3. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_DEBUG_PKCS11_MODULE`` | String | Name the PKCS#11 module to be traced. :ref:`mozilla-projects-nss-nss-tech-notes-nss-tech-note2` | 3.6 |
| | (module name) | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_DEFAULT_DB_TYPE`` | String | Determines the default Database type to open if the app does not specify. `NSS_Shared_DB <http://wiki.mozilla.org/NSS_Shared_DB>`__ | 3.12 |
| | ("dbm", "sql", or | | |
| | "extern") | | |
| | | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_DISABLE_ARENA_FREE_LIST`` | String | Define this variable to get accurate leak allocation stacks when using leak reporting software. :ref:`mozilla-projects-nss-memory-allocation` | 3.4 |
| | (any non-empty value) | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_DISABLE_UNLOAD`` | String | Disable unloading of | 3.11.8 |
| | (any non-empty value) | dynamically loaded NSS | |
| | | shared libraries | |
| | | during shutdown. | |
| | | Necessary on some | |
| | | platforms to get | |
| | | correct function names | |
| | | when using leak | |
| | | reporting software. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_ENABLE_AUDIT`` | Boolean | Enable auditing of activities of the NSS cryptographic module in FIPS mode. `AuditData <http://wiki.mozilla.org/FIPS_Operational_Environment>`__ | 3.11.2 |
| | (1 to enable) | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_ENABLE_PKIX_VERIFY`` | Boolean | Use libPKIX, rather | 3.12 |
| | (any non-empty value | than the old cert | |
| | to enable) | library, to verify | |
| | | certificates. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_FIPS`` | String | Will start NSS in FIPS | 3.12.5 |
| | (" | mode. | |
| | fips","true","on","1") | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_HASH_ALG_SUPPORT`` | String | Specifies agorithms allowed to be used in certain applications, such as in signatures on certificates and CRLs. See documentation at `thislink <https://bugzilla.mozilla.org/show_bug.cgi?id=483113#c0>`__. | 3.12.3 |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_OUTPUT_FILE`` | String | Output file path name for the :ref:`mozilla-projects-nss-nss-tech-notes-nss-tech-note2`. Default is stdout. | 3.7 |
| | (filename) | | |
| | | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_SDB_USE_CACHE`` | String | Controls whether NSS uses a local cache of SQL database contents. Default is "auto". See `thesource <http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/security/nss/lib/softoken/sdb.c&rev=1.6#1797>`__ for more information. | 3.12 |
| | ("no","yes","auto") | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| `NSS_SSL_CBC_RANDOM_IV <https://dxr.mozilla.org/security/search?q=NSS_SSL_CBC_RANDOM_IV>`__ | String ("0", "1") | Controls the workaround for the `BEAST <https://en.wikipedia.org/wiki/Transport_Layer_Security#BEAST_attack>`__ attack on SSL 3.0 and TLS 1.0. "0" disables it, "1" enables it. It is also known as 1/n-1 record splitting. Default is "1". | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_SSL_ENABLE_RENEGOTIATION`` | String | (Definition for NSS | 3.12.5 |
| | ([0|n|N], | 3.12.6 and above) | Modified in 3.12.6 |
| | [1|u|U], | Sets how TLS | |
| | [2|r|R], | renegotiation is | |
| | [3|t|T]) | handled | |
| | | | |
| | | - [1|u|U]: | |
| | | SSL_RE | |
| | | | |
| | | NEGOTIATE_UNRESTRICTED | |
| | | | |
| | | | Server and client | |
| | | are allowed to | |
| | | renegotiate without | |
| | | any restrictions. | |
| | | | This setting was the | |
| | | default prior 3.12.5 | |
| | | and makes products | |
| | | vulnerable. | |
| | | | |
| | | - [0|n|N]: | |
| | | | |
| | | SSL_RENEGOTIATE_NEVER | |
| | | | |
| | | Never allow | |
| | | renegotiation - That | |
| | | was the default for | |
| | | 3.12.5 release. | |
| | | | |
| | | - [3|t|T]: | |
| | | SSL_RE | |
| | | | |
| | | NEGOTIATE_TRANSITIONAL | |
| | | | |
| | | Disallows unsafe | |
| | | renegotiation in | |
| | | server sockets only, | |
| | | but allows clients to | |
| | | continue to | |
| | | renegotiate with | |
| | | vulnerable servers. | |
| | | This value should only | |
| | | be used during the | |
| | | transition period when | |
| | | few servers have been | |
| | | upgraded. | |
| | | | |
| | | - [2|r|R]: | |
| | | SSL_RE | |
| | | | |
| | | NEGOTIATE_REQUIRES_XTN | |
| | | | |
| | | (default) | |
| | | | |
| | | | Only allows | |
| | | renegotiation if the | |
| | | peer's hello bears | |
| | | the TLS | |
| | | renegotiation_info | |
| | | extension. | |
| | | | This is the safe | |
| | | renegotiation. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_SSL_REQUIRE_SAFE_NEGOTIATION`` | Boolean | It controls whether | 3.12.5 |
| | (1 to enable) | safe renegotiation | |
| | | indication is required | |
| | | for initial handshake. | |
| | | In other words a | |
| | | connection will be | |
| | | dropped at initial | |
| | | handshake if a server | |
| | | or client do not | |
| | | support safe | |
| | | renegotiation. The | |
| | | default setting for | |
| | | this option is FALSE. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_SSL_SERVER_CACHE_MUTEX_TIMEOUT`` | Integer | Timeout time to detect | 3.4 |
| | (seconds) | dead or hung process | |
| | | in multi-process SSL | |
| | | server. Default is 30 | |
| | | seconds. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_STRICT_NOFORK`` | String | It is an error to try | 3.12.3 |
| | ("1", | to use a PKCS#11 | |
| | "DISABLED", | crypto module in a | |
| | or any other non-empty | process before it has | |
| | value) | been initialized in | |
| | | that process, even if | |
| | | the module was | |
| | | initialized in the | |
| | | parent process. | |
| | | Beginning in NSS | |
| | | 3.12.3, Softoken will | |
| | | detect this error. | |
| | | This environment | |
| | | variable controls | |
| | | Softoken's response to | |
| | | that error. | |
| | | | |
| | | - If set to "1" or | |
| | | unset, Softoken | |
| | | will trigger an | |
| | | assertion failure | |
| | | in debug builds, | |
| | | and will report an | |
| | | error in non-DEBUG | |
| | | builds. | |
| | | - If set to | |
| | | "DISABLED", | |
| | | Softoken will | |
| | | ignore forks, and | |
| | | behave as it did in | |
| | | older versions. | |
| | | - If set to any other | |
| | | non-empty value, | |
| | | Softoken will | |
| | | report an error in | |
| | | both DEBUG and | |
| | | non-DEBUG builds. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_STRICT_SHUTDOWN`` | String | will trigger an | 3.5 |
| | (any non-empty value) | assertion failure in | |
| | | debug builds when a | |
| | | program tries to | |
| | | shutdown NSS before | |
| | | freeing all the | |
| | | resources it acquired | |
| | | from NSS while NSS was | |
| | | initialized. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_TRACE_OCSP`` | Boolean | Enables OCSP tracing. The trace information is written to the file pointed by NSPR_LOG_FILE (default stderr). See `NSStracing <http://wiki.mozilla.org/NSS:Tracing>`__ | 3.12 |
| | (any value to enable) | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_USE_DECODED_CKA_EC_POINT`` | Boolean | Tells NSS to send EC | 3.12.3 |
| | (any value to enable) | key points across the | |
| | | PKCS#11 interface in | |
| | | the non-standard | |
| | | unencoded format that | |
| | | was used by default | |
| | | before NSS 3.12.3. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_USE_SHEXP_IN_CERT_NAME`` | Boolean | Tells NSS to allow | 3.12.3 |
| | (any value to enable) | shell-style wildcard | |
| | | patterns in | |
| | | certificates to match | |
| | | SSL server host names. | |
| | | This behavior was the | |
| | | default before NSS | |
| | | 3.12.3. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``PKIX_OBJECT_LEAK_TEST_ABORT_ON_LEAK`` | String | Debug variable for | 3.12 |
| | (any non-empty value) | PKIX leak checking. | |
| | | Note: *The code must | |
| | | be built with | |
| | | PKIX_OBJECT_LEAK_TEST | |
| | | defined to use this | |
| | | functionality.* | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``SOCKETTRACE`` | Boolean | Controls tracing of | 3.12 |
| | (1 to enable) | socket activity by | |
| | | libPKIX. Messages sent | |
| | | and received will be | |
| | | timestamped and dumped | |
| | | (to stdout) in | |
| | | standard hex-dump | |
| | | format. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``SQLITE_FORCE_PROXY_LOCKING`` | Boolean | 1 means force always | 3.12.6 |
| | (1 to enable) | use proxy, 0 means | |
| | | never use proxy, NULL | |
| | | means use proxy for | |
| | | non-local files only. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``SSLBYPASS`` | Boolean | Uses PKCS#11 bypass | 3.11 |
| | (1 to enable) | for performance | |
| | | improvement. | |
| | | Do not set this | |
| | | variable if FIPS is | |
| | | enabled. | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``SSLDEBUG`` | Integer | Debug level | Before 3.0 |
| | | Note: *The code must | |
| | | be built with DEBUG | |
| | | defined to use this | |
| | | functionality.* | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``SSLDEBUGFILE`` | String | File where debug or | 3.12 |
| | (file name) | trace information is | |
| | | written. | |
| | | If not set, the debug | |
| | | or trace information | |
| | | is written to stderr. | |
| | | | |
| | | Note: *SSLDEBUG or | |
| | | SSLTRACE have to be | |
| | | set to use this | |
| | | functionality.* | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``SSLFORCELOCKS`` | Boolean | Forces NSS to use | 3.11 |
| | (1 to enable) | locks for protection. | |
| | | Overrides the effect | |
| | | of SSL_NO_LOCKS (see | |
| | | ssl.h). | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``SSLKEYLOGFILE`` | String | Key log file. If set, NSS logs RSA pre-master secrets to this file. This allows packet sniffers to decrypt TLS connections. See :ref:`mozilla-projects-nss-key-log-format`. | 3.12.6 |
| | (file name) | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``SSLTRACE`` | Integer | Tracing level | Before 3.0 |
| | | Note: *The code must | |
| | | be built with TRACE | |
| | | defined to use this | |
| | | functionality.* | |
+---------------------------------------------------------------------------------------------+------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
```
:::
(build-time-environment-variables)=
## Build-Time Environment Variables
::::{container}
These environment variables affect the build (compilation) of NSS.
:::{note}
**Note: This section is a work in progress and is not yet complete.**
:::
````{eval-rst}
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| Variable | Type | Description | Introduced in version |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``BUILD_OPT`` | Boolean | Do an optimized (not | Before 3.0 |
| | (1 to enable) | DEBUG) build. Default | |
| | | is to do a DEBUG | |
| | | build. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``MOZ_DEBUG_SYMBOLS`` | Boolean | Needed on Windows to | 3.11 |
| | (1 to enable) | build with versions of | |
| | | MSVC (such as VC8 and | |
| | | VC9) that do not | |
| | | understand /PDB:NONE | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``MOZ_DEBUG_FLAGS`` | String | When ``MOZ_DEBUG_SYMBOLS`` is set, you may use ``MOZ_DEBUG_FLAGS`` to specify alternative compiler flags to produce symbolic debugging information in a particular format. | 3.12.8 |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSDISTMODE`` | String | On operating systems | Before 3.0 |
| | | other than Windows, | |
| | | this controls whether | |
| | | copies, absolute | |
| | | symlinks, or relative | |
| | | symlinks of the output | |
| | | files should be | |
| | | published to | |
| | | mozilla/dist. The | |
| | | possible values are: | |
| | | | |
| | | - copy: copies of | |
| | | files are published | |
| | | - absolute_symlink: | |
| | | symlinks whose | |
| | | targets are | |
| | | absolute pathnames | |
| | | are published | |
| | | | |
| | | If not specified, | |
| | | default to relative | |
| | | symlinks (symlinks | |
| | | whose targets are | |
| | | relative pathnames). | |
| | | On Windows, copies of | |
| | | files are always | |
| | | published. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NS_USE_GCC`` | Boolean | On systems where GCC | Before 3.0 |
| | (1 to enable) | is not the default | |
| | | compiler, this tells | |
| | | NSS to build with gcc. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| `NSS_ALLOW_SSLKEYLOGFILE <https://dxr.mozilla.org/nss/search?q=NSS_ALLOW_SSLKEYLOGFILE>`__ | Boolean | Enable NSS support in | 3.24 |
| | (1 to enable) | optimized builds for | |
| | | logging SSL/TLS key | |
| | | material to a logfile | |
| | | if the SSLKEYLOGFILE | |
| | | environment variable. | |
| | | As of NSS 3.24 this is | |
| | | disabled by default. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_BUILD_CONTINUE_ON_ERROR`` | Boolean | Continue building NSS | 3.12.4 |
| | (1 to enable) | source directories | |
| | | when a build error | |
| | | occurs. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_USE_SYSTEM_SQLITE`` | Boolean | Use the system | 3.12.6 |
| | (1 to enable) | installed sqlite | |
| | | library instead of the | |
| | | in-tree version. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_DISABLE_ECC (deprecated)`` | Boolean | Disable Elliptic Curve | 3.16 |
| | (1 to disable) | Cryptography features. | |
| | | As of NSS 3.16, ECC | |
| | | features are enabled | |
| | | by default. As of NSS | |
| | | 3.33 this variable has | |
| | | no effect. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_ENABLE_ECC (deprecated)`` | Boolean | Enable building of | Before 3.16; since |
| | (1 to enable) | code that uses | 3.11. |
| | | Elliptic Curve | |
| | | Cryptography. Unused | |
| | | as of NSS 3.16; see | |
| | | NSS_DISABLE_ECC. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ```NSS_FORCE_FIPS`` <https://dxr.mozilla.org/nss/search?q=NSS_FORCE_FIPS>`__ | | Boolean | Allows enabling FIPS mode using ``NSS_FIPS`` | 3.24 |
| | | (1 to enable) | | |
| | | | |
| | | | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``OS_TARGET`` | String | For cross-compilation | Before 3.0 |
| | (target OS) | environments only, | |
| | | when the target OS is | |
| | | not the default for | |
| | | the system on which | |
| | | the build is | |
| | | performed. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``USE_64`` | Boolean | On platforms that has | Before 3.0 |
| | (1 to enable) | separate 32-bit and | |
| | | 64-bit ABIs, NSS | |
| | | builds for the 32-bit | |
| | | ABI by default. This | |
| | | tells NSS to build for | |
| | | the 64-bit ABI. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``USE_DEBUG_RTL`` | Boolean | On Windows, MSVC has | Before 3.0 |
| | (1 to enable) | options to build with | |
| | | a normal Run Time | |
| | | Library or a debug Run | |
| | | Time Library. This | |
| | | tells NSS to build | |
| | | with the Debug Run | |
| | | Time Library. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``USE_PTHREADS`` | Boolean | On platforms where | Before 3.0 |
| | (1 to enable) | POSIX threads are | |
| | | available, but are not | |
| | | the OS'es preferred | |
| | | threads library, this | |
| | | tells NSS and NSPR to | |
| | | build using pthreads. | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
| ``NSS_NO_PKCS11_BYPASS`` | String | Disables at | Before 3.15 |
| | (1 to enable) | compile-time the NS | |
| | | ssl code to bypass the | |
| | | pkcs11 layer. When set | |
| | | the SSLBYPASS run-time | |
| | | variable won't take | |
| | | effect | |
+--------------------------------------------------------------------------------------------+-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
````
::::