使用 Homebrew, apk, dnf, MacPorts, Nix, pacman, apt, zypper 安装 nss

项目链接

• 主页

命令和别名

• addbuiltin
• atob
• baddbdir
• bltest
• btoa
• certutil
• chktest
• cmsutil
• crlutil
• dbtest
• dbtool
• derdump
• dertimetest
• digest
• ecperf
• encodeinttest
• fbectest
• fipstest
• httpserv
• listsuites
• lowhashtest
• makepqg
• mangle
• modutil
• multinit
• nonspr10
• nss-config
• nss-policy-check
• nssdefaults
• ocspclnt
• ocspresp
• oidcalc

项目历史

Mozilla's archived NSS history says the code began as the base security code in the original Netscape Navigator products: Navigator 1.0 supported SSL 2.0, Navigator 2.0 added SSL 3.0 and server-side private-key support, Navigator 3.0 added client authentication, and Communicator 4.0 broke much of the security code into its own NSPR-dependent component.

After Communicator 4.0, the security code began shipping independently. The archived history describes HCL as the first independently buildable security-code line, with NSS 2.0 as the first release fully tested and made available outside Netscape. Firefox Source Docs describes the modern NSS package as MPL-2.0 libraries for security-enabled client and server applications.

采用历史

NSS's adoption comes from browsers, mail clients, PKI tooling, and platforms that value its PKCS #11 model and Mozilla root store integration. Mozilla docs say it is used by Mozilla and other companies in Firefox, AOL Instant Messenger, Red Hat server products, and other products; Ubuntu documentation describes it as originally developed by Netscape, inherited by Mozilla, and used mainly in Firefox and Thunderbird on Ubuntu.

On July 1, 2026, Homebrew listed NSS 3.125 with 486,543 installs in its 365-day analytics window and 105,895 installs on request. Unlike NSPR, NSS is both a dependency and a directly requested toolkit because it ships command-line utilities such as `certutil`, `pk12util`, `modutil`, `vfychain`, and `tstclnt`.

使用方式

Developers use NSS when they need Mozilla-compatible TLS/PKI behavior, PKCS #11 modules, certificate/key databases, S/MIME/CMS processing, or command-line certificate database management. The practical package-nerd workflow is often `certutil -d sql:...`, `pk12util`, `modutil`, and `nss-config`, especially when dealing with software that uses NSS databases rather than PEM files directly.

NSS depends on NSPR for cross-platform I/O and threading. Its architecture includes FreeBL, Softoken, CKBI built-in root certificates, certificate/key databases, and SSL/TLS and S/MIME modules, which is why it feels like a complete PKI stack rather than a small crypto primitive library.

为什么软件包爱好者会关心

NSS is significant because it is the Mozilla security stack: a browser-grade TLS/PKI implementation with command-line tools and a different trust/key storage model from OpenSSL. Packaging it correctly matters for browsers, certificate management, and any software linked against Mozilla's crypto libraries.

时间线

• Navigator 1.0 era: Netscape security code supported SSL 2.0.
• Navigator 2.0 era: SSL 3.0 and server-side private-key support entered the codebase.
• Communicator 4.0 era: security code was partly split into its own NSPR-dependent component.
• NSS 2.0 era: the code became fully tested and available outside Netscape.
• July 1, 2026: Homebrew listed NSS 3.125.

Related projects

• NSPR provides the portability layer used by NSS.
• Firefox, Thunderbird, and other Mozilla-family software are major NSS consumers.

来源

• https://firefox-source-docs.mozilla.org/security/nss/index.html
• https://formulae.brew.sh/formula/nss
• https://nss-crypto.org/reference/security/nss/legacy/an_overview_of_nss_internals/index.html
• https://nss-crypto.org/reference/security/nss/legacy/faq/index.html
• https://nss-crypto.org/reference/security/nss/legacy/overview/index.html
• https://ubuntu.com/server/docs/explanation/crypto/network-security-services-nss/
• https://www-archive.mozilla.org/projects/security/pki/nss/history