Backed out changeset 3eb63c112f5a (Bug 1577822) for breaking WebAuthn mochitests UPGRADE_NSS_RELEASE
authorJ.C. Jones <jc@mozilla.com>
Wed, 16 Oct 2019 04:36:58 +0000
changeset 497778 d82198f745262f0530821763dca9c8eec88d2df9
parent 497777 71d5a7f29d054c17bd35868be6463353626a3869
child 497779 213b74bb0fa9d04dc84c36e834170dfde67f3d1f
push id98065
push userjjones@mozilla.com
push dateWed, 16 Oct 2019 04:42:31 +0000
treeherderautoland@d82198f74526 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1577822
milestone71.0a1
backs out3eb63c112f5ad197126daa785caf4e1770d02b35
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset 3eb63c112f5a (Bug 1577822) for breaking WebAuthn mochitests UPGRADE_NSS_RELEASE Differential Revision: https://phabricator.services.mozilla.com/D49374
security/nss/TAG-INFO
security/nss/automation/abi-check/expected-report-libnss3.so.txt
security/nss/automation/abi-check/expected-report-libsmime3.so.txt
security/nss/automation/abi-check/expected-report-libssl3.so.txt
security/nss/cmd/addbuiltin/addbuiltin.c
security/nss/cmd/lib/secutil.c
security/nss/coreconf/coreconf.dep
security/nss/gtests/mozpkix_gtest/pkixder_universal_types_tests.cpp
security/nss/gtests/softoken_gtest/manifest.mn
security/nss/gtests/softoken_gtest/softoken_gtest.gyp
security/nss/gtests/softoken_gtest/softoken_nssckbi_testlib_gtest.cc
security/nss/lib/certdb/certdb.c
security/nss/lib/certdb/certt.h
security/nss/lib/ckfw/builtins/README
security/nss/lib/ckfw/builtins/certdata.txt
security/nss/lib/ckfw/builtins/manifest.mn
security/nss/lib/ckfw/builtins/nssckbi.h
security/nss/lib/ckfw/builtins/testlib/Makefile
security/nss/lib/ckfw/builtins/testlib/builtins-testlib.gyp
security/nss/lib/ckfw/builtins/testlib/certdata-testlib.txt
security/nss/lib/ckfw/builtins/testlib/config.mk
security/nss/lib/ckfw/builtins/testlib/manifest.mn
security/nss/lib/ckfw/builtins/testlib/nssckbi-testlib.rc
security/nss/lib/ckfw/builtins/testlib/testcert_err_distrust.txt
security/nss/lib/ckfw/builtins/testlib/testcert_no_distrust.txt
security/nss/lib/ckfw/builtins/testlib/testcert_ok_distrust.txt
security/nss/lib/ckfw/manifest.mn
security/nss/lib/mozpkix/include/pkix/pkixder.h
security/nss/lib/mozpkix/lib/pkixcert.cpp
security/nss/lib/nss/nss.def
security/nss/lib/pki/pki3hack.c
security/nss/lib/softoken/pkcs11c.c
security/nss/lib/softoken/sdb.c
security/nss/lib/ssl/tls13con.c
security/nss/lib/util/pkcs11n.h
security/nss/nss.gyp
security/nss/tests/cert/cert.sh
--- a/security/nss/TAG-INFO
+++ b/security/nss/TAG-INFO
@@ -1,1 +1,1 @@
-NSS_3_47_BETA2
\ No newline at end of file
+NSS_3_47_BETA1
\ No newline at end of file
--- a/security/nss/automation/abi-check/expected-report-libnss3.so.txt
+++ b/security/nss/automation/abi-check/expected-report-libnss3.so.txt
@@ -1,33 +1,4 @@
 1 Added function:
 
   'function CERTCertList* PK11_GetCertsMatchingPrivateKey(SECKEYPrivateKey*)'    {PK11_GetCertsMatchingPrivateKey@@NSS_3.47}
 
-3 functions with some indirect sub-type change:
-
-  [C]'function SECStatus CERT_AddCertToListHead(CERTCertList*, CERTCertificate*)' at certdb.c:2631:1 has some indirect sub-type changes:
-    parameter 2 of type 'CERTCertificate*' has sub-type changes:
-      in pointed to type 'typedef CERTCertificate' at certt.h:39:1:
-        underlying type 'struct CERTCertificateStr' at certt.h:189:1 changed:
-          type size changed from 6016 to 6080 (in bits)
-          1 data member insertion:
-            'CERTCertDistrust* CERTCertificateStr::distrust', at offset 6016 (in bits) at certt.h:296:1
-          no data member changes (2 filtered);
-
-  [C]'function SECStatus CERT_CacheOCSPResponseFromSideChannel(CERTCertDBHandle*, CERTCertificate*, PRTime, const SECItem*, void*)' at ocsp.c:5102:1 has some indirect sub-type changes:
-    parameter 2 of type 'CERTCertificate*' has sub-type changes:
-      in pointed to type 'typedef CERTCertificate' at certt.h:39:1:
-        underlying type 'struct CERTCertificateStr' at certt.h:189:1 changed:
-          type size changed from 6016 to 6080 (in bits)
-          1 data member insertion:
-            'CERTCertDistrust* CERTCertificateStr::distrust', at offset 6016 (in bits) at certt.h:296:1
-          no data member change (1 filtered);
-
-  [C]'function CERTCertificateList* CERT_CertChainFromCert(CERTCertificate*, SECCertUsage, PRBool)' at certhigh.c:1030:1 has some indirect sub-type changes:
-    parameter 1 of type 'CERTCertificate*' has sub-type changes:
-      in pointed to type 'typedef CERTCertificate' at certt.h:39:1:
-        underlying type 'struct CERTCertificateStr' at certt.h:189:1 changed:
-          type size changed from 6016 to 6080 (in bits)
-          1 data member insertion:
-            'CERTCertDistrust* CERTCertificateStr::distrust', at offset 6016 (in bits) at certt.h:296:1
-          no data member changes (2 filtered);
-
--- a/security/nss/automation/abi-check/expected-report-libsmime3.so.txt
+++ b/security/nss/automation/abi-check/expected-report-libsmime3.so.txt
@@ -1,11 +0,0 @@
-1 function with some indirect sub-type change:
-
-  [C]'function CERTCertificate* CERT_ConvertAndDecodeCertificate(char*)' at certread.c:219:1 has some indirect sub-type changes:
-    return type changed:
-      in pointed to type 'typedef CERTCertificate' at certt.h:39:1:
-        underlying type 'struct CERTCertificateStr' at certt.h:189:1 changed:
-          type size changed from 6016 to 6080 (in bits)
-          1 data member insertion:
-            'CERTCertDistrust* CERTCertificateStr::distrust', at offset 6016 (in bits) at certt.h:296:1
-
-
--- a/security/nss/automation/abi-check/expected-report-libssl3.so.txt
+++ b/security/nss/automation/abi-check/expected-report-libssl3.so.txt
@@ -1,10 +0,0 @@
-1 function with some indirect sub-type change:
-
-  [C]'function SECStatus NSS_CmpCertChainWCANames(CERTCertificate*, CERTDistNames*)' at cmpcert.c:25:1 has some indirect sub-type changes:
-    parameter 1 of type 'CERTCertificate*' has sub-type changes:
-      in pointed to type 'typedef CERTCertificate' at certt.h:39:1:
-        underlying type 'struct CERTCertificateStr' at certt.h:189:1 changed:
-          type size changed from 6016 to 6080 (in bits)
-          1 data member insertion:
-            'CERTCertDistrust* CERTCertificateStr::distrust', at offset 6016 (in bits) at certt.h:296:1
-
--- a/security/nss/cmd/addbuiltin/addbuiltin.c
+++ b/security/nss/cmd/addbuiltin/addbuiltin.c
@@ -225,18 +225,16 @@ ConvertCertificate(SECItem *sdder, char 
         printf("CKA_VALUE MULTILINE_OCTAL\n");
         dumpbytes(sdder->data, sdder->len);
         printf("END\n");
         if (hasPositiveTrust(trust->sslFlags) ||
             hasPositiveTrust(trust->emailFlags) ||
             hasPositiveTrust(trust->objectSigningFlags)) {
             printf("CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE\n");
         }
-        printf("CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE\n");
-        printf("CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE\n");
     }
 
     if ((trust->sslFlags | trust->emailFlags | trust->objectSigningFlags) ==
         CERTDB_TERMINAL_RECORD)
         trust_info = "Distrust";
     else
         trust_info = "Trust for";
 
@@ -303,31 +301,29 @@ printheader()
            "#\n"
            "# This file contains the object definitions for the certs and other\n"
            "# information \"built into\" NSS.\n"
            "#\n"
            "# Object definitions:\n"
            "#\n"
            "#    Certificates\n"
            "#\n"
-           "#  -- Attribute --               -- type --          -- value --\n"
-           "#  CKA_CLASS                     CK_OBJECT_CLASS     CKO_CERTIFICATE\n"
-           "#  CKA_TOKEN                     CK_BBOOL            CK_TRUE\n"
-           "#  CKA_PRIVATE                   CK_BBOOL            CK_FALSE\n"
-           "#  CKA_MODIFIABLE                CK_BBOOL            CK_FALSE\n"
-           "#  CKA_LABEL                     UTF8                (varies)\n"
-           "#  CKA_CERTIFICATE_TYPE          CK_CERTIFICATE_TYPE CKC_X_509\n"
-           "#  CKA_SUBJECT                   DER+base64          (varies)\n"
-           "#  CKA_ID                        byte array          (varies)\n"
-           "#  CKA_ISSUER                    DER+base64          (varies)\n"
-           "#  CKA_SERIAL_NUMBER             DER+base64          (varies)\n"
-           "#  CKA_VALUE                     DER+base64          (varies)\n"
-           "#  CKA_NSS_EMAIL                 ASCII7              (unused here)\n"
-           "#  CKA_NSS_SERVER_DISTRUST_AFTER DER+base64          (varies)\n"
-           "#  CKA_NSS_EMAIL_DISTRUST_AFTER  DER+base64          (varies)\n"
+           "#  -- Attribute --          -- type --              -- value --\n"
+           "#  CKA_CLASS                CK_OBJECT_CLASS         CKO_CERTIFICATE\n"
+           "#  CKA_TOKEN                CK_BBOOL                CK_TRUE\n"
+           "#  CKA_PRIVATE              CK_BBOOL                CK_FALSE\n"
+           "#  CKA_MODIFIABLE           CK_BBOOL                CK_FALSE\n"
+           "#  CKA_LABEL                UTF8                    (varies)\n"
+           "#  CKA_CERTIFICATE_TYPE     CK_CERTIFICATE_TYPE     CKC_X_509\n"
+           "#  CKA_SUBJECT              DER+base64              (varies)\n"
+           "#  CKA_ID                   byte array              (varies)\n"
+           "#  CKA_ISSUER               DER+base64              (varies)\n"
+           "#  CKA_SERIAL_NUMBER        DER+base64              (varies)\n"
+           "#  CKA_VALUE                DER+base64              (varies)\n"
+           "#  CKA_NSS_EMAIL            ASCII7                  (unused here)\n"
            "#\n"
            "#    Trust\n"
            "#\n"
            "#  -- Attribute --              -- type --          -- value --\n"
            "#  CKA_CLASS                    CK_OBJECT_CLASS     CKO_TRUST\n"
            "#  CKA_TOKEN                    CK_BBOOL            CK_TRUE\n"
            "#  CKA_PRIVATE                  CK_BBOOL            CK_FALSE\n"
            "#  CKA_MODIFIABLE               CK_BBOOL            CK_FALSE\n"
@@ -391,48 +387,41 @@ Usage(char *progName)
     fprintf(stderr, "%-15s a label for the distrust record.\n", "");
     fprintf(stderr, "%-15s exclude the certificate (only add a trust record)\n", "-c");
     fprintf(stderr, "%-15s exclude hash from trust record\n", "-h");
     fprintf(stderr, "%-15s     (useful to distrust any matching issuer/serial)\n", "");
     fprintf(stderr, "%-15s     (not allowed when adding positive trust)\n", "");
     fprintf(stderr, "%-15s a CRL entry number, as shown by \"crlutil -S\"\n", "-e");
     fprintf(stderr, "%-15s input file to read (default stdin)\n", "-i file");
     fprintf(stderr, "%-15s     (pipe through atob if the cert is b64-encoded)\n", "");
-    fprintf(stderr, "%-15s convert a timestamp to DER, and output.\n", "-d timestamp");
-    fprintf(stderr, "%-15s useful to fill server and email distrust fields\n", "");
-    fprintf(stderr, "%-15s Example: %s -d 1561939200\n", "", progName);
-    fprintf(stderr, "%-15s NOTE: The informed timestamp are interpreted as seconds\n", "");
-    fprintf(stderr, "%-15s since unix epoch.\n", "");
-    fprintf(stderr, "%-15s TIP: date -d \"2019-07-01 00:00:00 UTC\" +%%s\n", "");
     exit(-1);
 }
 
 enum {
     opt_Input = 0,
     opt_Nickname,
     opt_Trust,
     opt_Distrust,
     opt_ExcludeCert,
     opt_ExcludeHash,
     opt_DistrustCRL,
-    opt_CRLEntry,
-    opt_ConvertDate
+    opt_CRLEnry
 };
 
-static secuCommandFlag addbuiltin_options[] = {
-    { /* opt_Input         */ 'i', PR_TRUE, 0, PR_FALSE },
-    { /* opt_Nickname      */ 'n', PR_TRUE, 0, PR_FALSE },
-    { /* opt_Trust         */ 't', PR_TRUE, 0, PR_FALSE },
-    { /* opt_Distrust      */ 'D', PR_FALSE, 0, PR_FALSE },
-    { /* opt_ExcludeCert   */ 'c', PR_FALSE, 0, PR_FALSE },
-    { /* opt_ExcludeHash   */ 'h', PR_FALSE, 0, PR_FALSE },
-    { /* opt_DistrustCRL   */ 'C', PR_FALSE, 0, PR_FALSE },
-    { /* opt_CRLEntry      */ 'e', PR_TRUE, 0, PR_FALSE },
-    { /* opt_ConvertDate   */ 'd', PR_TRUE, 0, PR_FALSE },
-};
+static secuCommandFlag addbuiltin_options[] =
+    {
+      { /* opt_Input         */ 'i', PR_TRUE, 0, PR_FALSE },
+      { /* opt_Nickname      */ 'n', PR_TRUE, 0, PR_FALSE },
+      { /* opt_Trust         */ 't', PR_TRUE, 0, PR_FALSE },
+      { /* opt_Distrust      */ 'D', PR_FALSE, 0, PR_FALSE },
+      { /* opt_ExcludeCert   */ 'c', PR_FALSE, 0, PR_FALSE },
+      { /* opt_ExcludeHash   */ 'h', PR_FALSE, 0, PR_FALSE },
+      { /* opt_DistrustCRL   */ 'C', PR_FALSE, 0, PR_FALSE },
+      { /* opt_CRLEnry       */ 'e', PR_TRUE, 0, PR_FALSE },
+    };
 
 int
 main(int argc, char **argv)
 {
     SECStatus rv;
     char *nickname = NULL;
     char *trusts = NULL;
     char *progName;
@@ -450,60 +439,36 @@ main(int argc, char **argv)
     progName = strrchr(argv[0], '/');
     progName = progName ? progName + 1 : argv[0];
 
     rv = SECU_ParseCommandLine(argc, argv, progName, &addbuiltin);
 
     if (rv != SECSuccess)
         Usage(progName);
 
-    if (addbuiltin.options[opt_ConvertDate].activated) {
-        char *endPtr;
-        PRTime distrustTimestamp = strtol(addbuiltin.options[opt_ConvertDate].arg, &endPtr, 0) * PR_USEC_PER_SEC;
-        if (*endPtr != '\0' && distrustTimestamp > 0) {
-            Usage(progName);
-            exit(1);
-        }
-        SECItem encTime;
-        DER_EncodeTimeChoice(NULL, &encTime, distrustTimestamp);
-        SECU_PrintTimeChoice(stdout, &encTime, "The timestamp represents this date", 0);
-        printf("Locate the entry of the desired certificate in certdata.txt\n"
-               "Erase the CKA_NSS_[SERVER|EMAIL]_DISTRUST_AFTER CK_BBOOL CK_FALSE\n"
-               "And override with the following respective entry:\n\n");
-        SECU_PrintTimeChoice(stdout, &encTime, "# For Server Distrust After", 0);
-        printf("CKA_NSS_SERVER_DISTRUST_AFTER MULTILINE_OCTAL\n");
-        dumpbytes(encTime.data, encTime.len);
-        printf("END\n");
-        SECU_PrintTimeChoice(stdout, &encTime, "# For Email Distrust After", 0);
-        printf("CKA_NSS_EMAIL_DISTRUST_AFTER MULTILINE_OCTAL\n");
-        dumpbytes(encTime.data, encTime.len);
-        printf("END\n");
-        exit(0);
-    }
-
     if (addbuiltin.options[opt_Trust].activated)
         ++mutuallyExclusiveOpts;
     if (addbuiltin.options[opt_Distrust].activated)
         ++mutuallyExclusiveOpts;
     if (addbuiltin.options[opt_DistrustCRL].activated)
         ++mutuallyExclusiveOpts;
 
     if (mutuallyExclusiveOpts != 1) {
         fprintf(stderr, "%s: you must specify exactly one of -t or -D or -C\n",
                 progName);
         Usage(progName);
     }
 
     if (addbuiltin.options[opt_DistrustCRL].activated) {
-        if (!addbuiltin.options[opt_CRLEntry].activated) {
+        if (!addbuiltin.options[opt_CRLEnry].activated) {
             fprintf(stderr, "%s: you must specify the CRL entry number.\n",
                     progName);
             Usage(progName);
         } else {
-            crlentry = atoi(addbuiltin.options[opt_CRLEntry].arg);
+            crlentry = atoi(addbuiltin.options[opt_CRLEnry].arg);
             if (crlentry < 1) {
                 fprintf(stderr, "%s: The CRL entry number must be > 0.\n",
                         progName);
                 Usage(progName);
             }
         }
     }
 
--- a/security/nss/cmd/lib/secutil.c
+++ b/security/nss/cmd/lib/secutil.c
@@ -1103,43 +1103,46 @@ typedef struct secuPBEParamsStr {
     SECItem keyLength;
     SECAlgorithmID cipherAlg;
     SECAlgorithmID kdfAlg;
 } secuPBEParams;
 
 SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate)
 
 /* SECOID_PKCS5_PBKDF2 */
-const SEC_ASN1Template secuKDF2Params[] = {
-    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(secuPBEParams) },
-    { SEC_ASN1_OCTET_STRING, offsetof(secuPBEParams, salt) },
-    { SEC_ASN1_INTEGER, offsetof(secuPBEParams, iterationCount) },
-    { SEC_ASN1_INTEGER, offsetof(secuPBEParams, keyLength) },
-    { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(secuPBEParams, kdfAlg),
-      SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
-    { 0 }
-};
+const SEC_ASN1Template secuKDF2Params[] =
+    {
+      { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(secuPBEParams) },
+      { SEC_ASN1_OCTET_STRING, offsetof(secuPBEParams, salt) },
+      { SEC_ASN1_INTEGER, offsetof(secuPBEParams, iterationCount) },
+      { SEC_ASN1_INTEGER, offsetof(secuPBEParams, keyLength) },
+      { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(secuPBEParams, kdfAlg),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+      { 0 }
+    };
 
 /* PKCS5v1 & PKCS12 */
-const SEC_ASN1Template secuPBEParamsTemp[] = {
-    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(secuPBEParams) },
-    { SEC_ASN1_OCTET_STRING, offsetof(secuPBEParams, salt) },
-    { SEC_ASN1_INTEGER, offsetof(secuPBEParams, iterationCount) },
-    { 0 }
-};
+const SEC_ASN1Template secuPBEParamsTemp[] =
+    {
+      { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(secuPBEParams) },
+      { SEC_ASN1_OCTET_STRING, offsetof(secuPBEParams, salt) },
+      { SEC_ASN1_INTEGER, offsetof(secuPBEParams, iterationCount) },
+      { 0 }
+    };
 
 /* SEC_OID_PKCS5_PBES2, SEC_OID_PKCS5_PBMAC1 */
-const SEC_ASN1Template secuPBEV2Params[] = {
-    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(secuPBEParams) },
-    { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(secuPBEParams, kdfAlg),
-      SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
-    { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(secuPBEParams, cipherAlg),
-      SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
-    { 0 }
-};
+const SEC_ASN1Template secuPBEV2Params[] =
+    {
+      { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(secuPBEParams) },
+      { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(secuPBEParams, kdfAlg),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+      { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(secuPBEParams, cipherAlg),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+      { 0 }
+    };
 
 void
 secu_PrintRSAPSSParams(FILE *out, SECItem *value, char *m, int level)
 {
     PLArenaPool *pool = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
     SECStatus rv;
     SECKEYRSAPSSParams param;
     SECAlgorithmID maskHashAlg;
@@ -2292,19 +2295,18 @@ SECU_PrintCertAttributes(FILE *out, CERT
     int rv = 0;
     while (attrs[0]) {
         rv |= SECU_PrintCertAttribute(out, attrs[0], m, level + 1);
         attrs++;
     }
     return rv;
 }
 
-/* sometimes a PRErrorCode, other times a SECStatus.  Sigh. */
-int
-SECU_PrintCertificateRequest(FILE *out, SECItem *der, char *m, int level)
+int /* sometimes a PRErrorCode, other times a SECStatus.  Sigh. */
+    SECU_PrintCertificateRequest(FILE *out, SECItem *der, char *m, int level)
 {
     PLArenaPool *arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
     CERTCertificateRequest *cr;
     int rv = SEC_ERROR_NO_MEMORY;
 
     if (!arena)
         return rv;
 
@@ -3244,36 +3246,16 @@ SEC_PrintCertificateAndTrust(CERTCertifi
     if (trust) {
         SECU_PrintTrustFlags(stdout, trust,
                              "Certificate Trust Flags", 1);
     } else if (CERT_GetCertTrust(cert, &certTrust) == SECSuccess) {
         SECU_PrintTrustFlags(stdout, &certTrust,
                              "Certificate Trust Flags", 1);
     }
 
-    /* The distrust fields are hard-coded in nssckbi and read-only.
-     * If verifying some cert, with vfychain, for instance, the certificate may
-     * not have a defined slot if not imported. */
-    if (cert->slot != NULL && cert->distrust != NULL) {
-        const unsigned int kDistrustFieldSize = 13;
-        fprintf(stdout, "\n");
-        SECU_Indent(stdout, 1);
-        fprintf(stdout, "%s:\n", "Certificate Distrust Dates");
-        if (cert->distrust->serverDistrustAfter.len == kDistrustFieldSize) {
-            SECU_PrintTimeChoice(stdout,
-                                 &cert->distrust->serverDistrustAfter,
-                                 "Server Distrust After", 2);
-        }
-        if (cert->distrust->emailDistrustAfter.len == kDistrustFieldSize) {
-            SECU_PrintTimeChoice(stdout,
-                                 &cert->distrust->emailDistrustAfter,
-                                 "E-mail Distrust After", 2);
-        }
-    }
-
     printf("\n");
 
     return (SECSuccess);
 }
 
 static char *
 bestCertName(CERTCertificate *cert)
 {
--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -5,9 +5,8 @@
 
 /*
  * A dummy header file that is a dependency for all the object files.
  * Used to force a full recompilation of NSS in Mozilla's Tinderbox
  * depend builds.  See comments in rules.mk.
  */
 
 #error "Do not include this header file."
-
--- a/security/nss/gtests/mozpkix_gtest/pkixder_universal_types_tests.cpp
+++ b/security/nss/gtests/mozpkix_gtest/pkixder_universal_types_tests.cpp
@@ -1219,58 +1219,8 @@ TEST_F(pkixder_universal_types_tests, OI
   Reader reader(input);
 
   const uint8_t expectedOID[] = {
     0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x01
   };
 
   ASSERT_EQ(Success, OID(reader, expectedOID));
 }
-
-TEST_F(pkixder_universal_types_tests, SkipOptionalImplicitPrimitiveTag)
-{
-  const uint8_t DER_IMPLICIT_BIT_STRING_WITH_CLASS_NUMBER_1[] = {
-    0x81,
-    0x04,
-      0x00,
-      0x0A,
-      0x0B,
-      0x0C,
-  };
-  Input input(DER_IMPLICIT_BIT_STRING_WITH_CLASS_NUMBER_1);
-  Reader reader(input);
-
-  ASSERT_EQ(Success, SkipOptionalImplicitPrimitiveTag(reader, 1));
-  ASSERT_TRUE(reader.AtEnd());
-}
-
-TEST_F(pkixder_universal_types_tests, SkipOptionalImplicitPrimitiveTagMismatch)
-{
-  const uint8_t DER_IMPLICIT_BIT_STRING_WITH_CLASS_NUMBER_1[] = {
-    0x81,
-    0x04,
-      0x00,
-      0x0A,
-      0x0B,
-      0x0C,
-  };
-  Input input(DER_IMPLICIT_BIT_STRING_WITH_CLASS_NUMBER_1);
-  Reader reader(input);
-
-  ASSERT_EQ(Success, SkipOptionalImplicitPrimitiveTag(reader, 2));
-  ASSERT_FALSE(reader.AtEnd());
-}
-
-TEST_F(pkixder_universal_types_tests, NoSkipOptionalImplicitConstructedTag)
-{
-  const uint8_t DER_IMPLICIT_SEQUENCE_WITH_CLASS_NUMBER_1[] = {
-    0xA1,
-    0x03,
-      0x05,
-      0x01,
-      0x00,
-  };
-  Input input(DER_IMPLICIT_SEQUENCE_WITH_CLASS_NUMBER_1);
-  Reader reader(input);
-
-  ASSERT_EQ(Success, SkipOptionalImplicitPrimitiveTag(reader, 1));
-  ASSERT_FALSE(reader.AtEnd());
-}
--- a/security/nss/gtests/softoken_gtest/manifest.mn
+++ b/security/nss/gtests/softoken_gtest/manifest.mn
@@ -1,32 +1,23 @@
 # -*- makefile -*-
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 CORE_DEPTH = ../..
 DEPTH      = ../..
 MODULE = nss
 
-DEFINES += -DDLL_SUFFIX=\"$(DLL_SUFFIX)\" -DDLL_PREFIX=\"$(DLL_PREFIX)\"
-
-include $(CORE_DEPTH)/coreconf/arch.mk
-ifneq ($(OS_ARCH),WINNT)
-DB_TESTS = \
-	softoken_nssckbi_testlib_gtest.cc
-endif
-
 CPPSRCS = \
 	softoken_gtest.cc \
-	$(DB_TESTS) \
 	$(NULL)
 
 INCLUDES += \
 	-I$(CORE_DEPTH)/gtests/google_test/gtest/include \
-	-I$(CORE_DEPTH)/gtests/common \
+  -I$(CORE_DEPTH)/gtests/common \
 	-I$(CORE_DEPTH)/cpputil \
 	$(NULL)
 
 REQUIRES = nspr gtest
 
 PROGRAM = softoken_gtest
 
 EXTRA_LIBS = \
--- a/security/nss/gtests/softoken_gtest/softoken_gtest.gyp
+++ b/security/nss/gtests/softoken_gtest/softoken_gtest.gyp
@@ -7,17 +7,16 @@
     '../common/gtest.gypi',
   ],
   'targets': [
     {
       'target_name': 'softoken_gtest',
       'type': 'executable',
       'sources': [
         'softoken_gtest.cc',
-        'softoken_nssckbi_testlib_gtest.cc',
       ],
       'dependencies': [
         '<(DEPTH)/exports.gyp:nss_exports',
         '<(DEPTH)/lib/util/util.gyp:nssutil3',
         '<(DEPTH)/gtests/google_test/google_test.gyp:gtest',
       ],
       'conditions': [
         [ 'static_libs==1', {
@@ -40,18 +39,14 @@
           ],
         }],
       ],
     }
   ],
   'target_defaults': {
     'include_dirs': [
       '../../lib/util'
-    ],
-    'defines': [
-      'DLL_PREFIX=\"<(dll_prefix)\"',
-      'DLL_SUFFIX=\"<(dll_suffix)\"'
     ]
   },
   'variables': {
     'module': 'nss'
   }
 }
deleted file mode 100644
--- a/security/nss/gtests/softoken_gtest/softoken_nssckbi_testlib_gtest.cc
+++ /dev/null
@@ -1,124 +0,0 @@
-#include "cert.h"
-#include "certdb.h"
-#include "nspr.h"
-#include "nss.h"
-#include "pk11pub.h"
-#include "secerr.h"
-
-#include "nss_scoped_ptrs.h"
-#include "util.h"
-
-#define GTEST_HAS_RTTI 0
-#include "gtest/gtest.h"
-
-namespace nss_test {
-
-class SoftokenBuiltinsTest : public ::testing::Test {
- protected:
-  SoftokenBuiltinsTest() : nss_db_dir_("SoftokenBuiltinsTest.d-") {}
-  SoftokenBuiltinsTest(const std::string &prefix) : nss_db_dir_(prefix) {}
-
-  virtual void SetUp() {
-    std::string nss_init_arg("sql:");
-    nss_init_arg.append(nss_db_dir_.GetUTF8Path());
-    ASSERT_EQ(SECSuccess, NSS_Initialize(nss_init_arg.c_str(), "", "",
-                                         SECMOD_DB, NSS_INIT_NOROOTINIT));
-  }
-
-  virtual void TearDown() {
-    ASSERT_EQ(SECSuccess, NSS_Shutdown());
-    const std::string &nss_db_dir_path = nss_db_dir_.GetPath();
-    ASSERT_EQ(0, unlink((nss_db_dir_path + "/cert9.db").c_str()));
-    ASSERT_EQ(0, unlink((nss_db_dir_path + "/key4.db").c_str()));
-    ASSERT_EQ(0, unlink((nss_db_dir_path + "/pkcs11.txt").c_str()));
-  }
-
-  virtual void LoadModule() {
-    ScopedPK11SlotInfo slot(PK11_GetInternalKeySlot());
-    ASSERT_TRUE(slot);
-    EXPECT_EQ(SECSuccess, PK11_InitPin(slot.get(), nullptr, nullptr));
-    SECStatus result = SECMOD_AddNewModule(
-        "Builtins-testlib", DLL_PREFIX "nssckbi-testlib." DLL_SUFFIX, 0, 0);
-    ASSERT_EQ(result, SECSuccess);
-  }
-
-  ScopedUniqueDirectory nss_db_dir_;
-};
-
-// The next tests in this class are used to test the Distrust Fields.
-// More details about these fields in lib/ckfw/builtins/README.
-TEST_F(SoftokenBuiltinsTest, CheckNoDistrustFields) {
-  const char *kCertNickname =
-      "Builtin Object Token:Distrust Fields Test - no_distrust";
-  LoadModule();
-
-  CERTCertDBHandle *cert_handle = CERT_GetDefaultCertDB();
-  ASSERT_TRUE(cert_handle);
-  ScopedCERTCertificate cert(
-      CERT_FindCertByNickname(cert_handle, kCertNickname));
-  ASSERT_TRUE(cert);
-
-  EXPECT_EQ(PR_FALSE,
-            PK11_HasAttributeSet(cert->slot, cert->pkcs11ID,
-                                 CKA_NSS_SERVER_DISTRUST_AFTER, PR_FALSE));
-  EXPECT_EQ(PR_FALSE,
-            PK11_HasAttributeSet(cert->slot, cert->pkcs11ID,
-                                 CKA_NSS_EMAIL_DISTRUST_AFTER, PR_FALSE));
-  ASSERT_FALSE(cert->distrust);
-}
-
-TEST_F(SoftokenBuiltinsTest, CheckOkDistrustFields) {
-  const char *kCertNickname =
-      "Builtin Object Token:Distrust Fields Test - ok_distrust";
-  LoadModule();
-
-  CERTCertDBHandle *cert_handle = CERT_GetDefaultCertDB();
-  ASSERT_TRUE(cert_handle);
-  ScopedCERTCertificate cert(
-      CERT_FindCertByNickname(cert_handle, kCertNickname));
-  ASSERT_TRUE(cert);
-
-  const char *kExpectedDERValueServer = "200617000000Z";
-  const char *kExpectedDERValueEmail = "071014085320Z";
-  // When a valid timestamp is encoded, the result length is exactly 13.
-  const unsigned int kDistrustFieldSize = 13;
-
-  ASSERT_TRUE(cert->distrust);
-  ASSERT_EQ(kDistrustFieldSize, cert->distrust->serverDistrustAfter.len);
-  ASSERT_NE(nullptr, cert->distrust->serverDistrustAfter.data);
-  EXPECT_TRUE(!memcmp(kExpectedDERValueServer,
-                      cert->distrust->serverDistrustAfter.data,
-                      kDistrustFieldSize));
-
-  ASSERT_EQ(kDistrustFieldSize, cert->distrust->emailDistrustAfter.len);
-  ASSERT_NE(nullptr, cert->distrust->emailDistrustAfter.data);
-  EXPECT_TRUE(!memcmp(kExpectedDERValueEmail,
-                      cert->distrust->emailDistrustAfter.data,
-                      kDistrustFieldSize));
-}
-
-TEST_F(SoftokenBuiltinsTest, CheckInvalidDistrustFields) {
-  const char *kCertNickname =
-      "Builtin Object Token:Distrust Fields Test - err_distrust";
-  LoadModule();
-
-  CERTCertDBHandle *cert_handle = CERT_GetDefaultCertDB();
-  ASSERT_TRUE(cert_handle);
-  ScopedCERTCertificate cert(
-      CERT_FindCertByNickname(cert_handle, kCertNickname));
-  ASSERT_TRUE(cert);
-
-  // The field should never be set to TRUE in production, we are just
-  // testing if this field is readable, even if set to TRUE.
-  EXPECT_EQ(PR_TRUE,
-            PK11_HasAttributeSet(cert->slot, cert->pkcs11ID,
-                                 CKA_NSS_SERVER_DISTRUST_AFTER, PR_FALSE));
-  // If something other than CK_BBOOL CK_TRUE, it will be considered FALSE
-  // Here, there is an OCTAL value, but with unexpected content (1 digit less).
-  EXPECT_EQ(PR_FALSE,
-            PK11_HasAttributeSet(cert->slot, cert->pkcs11ID,
-                                 CKA_NSS_EMAIL_DISTRUST_AFTER, PR_FALSE));
-  ASSERT_FALSE(cert->distrust);
-}
-
-}  // namespace nss_test
--- a/security/nss/lib/certdb/certdb.c
+++ b/security/nss/lib/certdb/certdb.c
@@ -2884,20 +2884,25 @@ CERT_LockCertRefCount(CERTCertificate *c
 
 /*
  * Free the cert reference count lock
  */
 void
 CERT_UnlockCertRefCount(CERTCertificate *cert)
 {
     PORT_Assert(certRefCountLock != NULL);
-    PRStatus prstat = PZ_Unlock(certRefCountLock);
-    if (prstat != PR_SUCCESS) {
+
+#ifdef DEBUG
+    {
+        PRStatus prstat = PZ_Unlock(certRefCountLock);
         PORT_Assert(prstat == PR_SUCCESS);
     }
+#else
+    PZ_Unlock(certRefCountLock);
+#endif
 }
 
 static PZLock *certTrustLock = NULL;
 
 /*
  * Acquire the cert trust lock
  * There is currently one global lock for all certs, but I'm putting a cert
  * arg here so that it will be easy to make it per-cert in the future if
@@ -2991,33 +2996,42 @@ cert_DestroyLocks(void)
 
 /*
  * Free the cert trust lock
  */
 void
 CERT_UnlockCertTrust(const CERTCertificate *cert)
 {
     PORT_Assert(certTrustLock != NULL);
-    PRStatus prstat = PZ_Unlock(certTrustLock);
-    if (prstat != PR_SUCCESS) {
+
+#ifdef DEBUG
+    {
+        PRStatus prstat = PZ_Unlock(certTrustLock);
         PORT_Assert(prstat == PR_SUCCESS);
     }
+#else
+    PZ_Unlock(certTrustLock);
+#endif
 }
 
 /*
  * Free the temp/perm lock
  */
 void
 CERT_UnlockCertTempPerm(const CERTCertificate *cert)
 {
     PORT_Assert(certTempPermLock != NULL);
-    PRStatus prstat = PZ_Unlock(certTempPermLock);
-    if (prstat != PR_SUCCESS) {
+#ifdef DEBUG
+    {
+        PRStatus prstat = PZ_Unlock(certTempPermLock);
         PORT_Assert(prstat == PR_SUCCESS);
     }
+#else
+    (void)PZ_Unlock(certTempPermLock);
+#endif
 }
 
 /*
  * Get the StatusConfig data for this handle
  */
 CERTStatusConfig *
 CERT_GetStatusConfig(CERTCertDBHandle *handle)
 {
--- a/security/nss/lib/certdb/certt.h
+++ b/security/nss/lib/certdb/certt.h
@@ -30,17 +30,16 @@ typedef struct CERTAuthKeyIDStr CERTAuth
 typedef struct CERTBasicConstraintsStr CERTBasicConstraints;
 typedef struct NSSTrustDomainStr CERTCertDBHandle;
 typedef struct CERTCertExtensionStr CERTCertExtension;
 typedef struct CERTCertKeyStr CERTCertKey;
 typedef struct CERTCertListStr CERTCertList;
 typedef struct CERTCertListNodeStr CERTCertListNode;
 typedef struct CERTCertNicknamesStr CERTCertNicknames;
 typedef struct CERTCertTrustStr CERTCertTrust;
-typedef struct CERTCertDistrustStr CERTCertDistrust;
 typedef struct CERTCertificateStr CERTCertificate;
 typedef struct CERTCertificateListStr CERTCertificateList;
 typedef struct CERTCertificateRequestStr CERTCertificateRequest;
 typedef struct CERTCrlStr CERTCrl;
 typedef struct CERTCrlDistributionPointsStr CERTCrlDistributionPoints;
 typedef struct CERTCrlEntryStr CERTCrlEntry;
 typedef struct CERTCrlHeadNodeStr CERTCrlHeadNode;
 typedef struct CERTCrlKeyStr CERTCrlKey;
@@ -137,28 +136,16 @@ struct CERTPublicKeyAndChallengeStr {
 
 struct CERTCertTrustStr {
     unsigned int sslFlags;
     unsigned int emailFlags;
     unsigned int objectSigningFlags;
 };
 
 /*
- * Distrust dates for specific certificate usages.
- * These dates are hardcoded in nssckbi/builtins. They are DER encoded to be
- * compatible with the format of certdata.txt, other date fields in certs and
- * existing functions to read these dates. Clients should check the distrust
- * date in certificates to avoid trusting a CA for service they have ceased to
- * support */
-struct CERTCertDistrustStr {
-    SECItem serverDistrustAfter;
-    SECItem emailDistrustAfter;
-};
-
-/*
  * defined the types of trust that exist
  */
 typedef enum SECTrustTypeEnum {
     trustSSL = 0,
     trustEmail = 1,
     trustObjectSigning = 2,
     trustTypeNone = 3
 } SECTrustType;
@@ -287,18 +274,16 @@ struct CERTCertificateStr {
         } bits;
     } options;
     int series; /* was int authsocketcount; record the series of the pkcs11ID */
 
     /* This is PKCS #11 stuff. */
     PK11SlotInfo *slot;        /*if this cert came of a token, which is it*/
     CK_OBJECT_HANDLE pkcs11ID; /*and which object on that token is it */
     PRBool ownSlot;            /*true if the cert owns the slot reference */
-    /* These fields are used in nssckbi/builtins CAs. */
-    CERTCertDistrust *distrust;
 };
 #define SEC_CERTIFICATE_VERSION_1 0 /* default created */
 #define SEC_CERTIFICATE_VERSION_2 1 /* v2 */
 #define SEC_CERTIFICATE_VERSION_3 2 /* v3 extensions */
 
 #define SEC_CRL_VERSION_1 0 /* default */
 #define SEC_CRL_VERSION_2 1 /* v2 extensions */
 
--- a/security/nss/lib/ckfw/builtins/README
+++ b/security/nss/lib/ckfw/builtins/README
@@ -17,18 +17,17 @@ specifies your shared library search pat
 variants), SHLIB_PATH (32-bit HP-UX), LIBPATH (AIX), or PATH (Windows).
 
 2. Copy newroot.der to this directory.
 
 3. In this directory, run addbuiltin to add the new root certificate. The
 argument to the -n option should be replaced by the nickname of the root
 certificate.
 
-    % addbuiltin -n "Nickname of the Root Certificate" -t C,C,C < newroot.der \
-    >> certdata.txt
+    % addbuiltin -n "Nickname of the Root Certificate" -t C,C,C < newroot.der >> certdata.txt
 
 4. Edit nssckbi.h to bump the version of the module.
 
 5. Run gmake in this directory to build the nssckbi module.
 
 6. After you verify that the new nssckbi module is correct, check in
 certdata.txt and nssckbi.h.
 
@@ -39,68 +38,8 @@ 1. Change directory to this directory.
 2. Edit certdata.txt and remove the root CA certificate.
 
 3. Edit nssckbi.h to bump the version of the module.
 
 4. Run gmake in this directory to build the nssckbi module.
 
 5. After you verify that the new nssckbi module is correct, check in
 certdata.txt and nssckbi.h.
-
-III. Scheduling a Distrust date for Server/TLS or Email certificates issued
-by a CA
-
-For each Builtin Root CA Certificate we have the Trust Bits to know what kind
-of certificates issued by this CA are trusted: Server/TLS, E-mail or S/MIME.
-Sometimes a CA discontinues support for a particular kind of certificate,
-but will still issue other kinds. For instance, they might cease support for
-email certificates but continue to provide server certificates. In this
-scenario, we have to disable the Trust Bit for this kind of certificate when
-the last issued certificate expires.
-Between the last expired certificate date and the change and propagation of
-this respective Trust Bit, could have a undesired gap.
-
-So, in these situations we can set a Distrust Date for this Builtin Root CA
-Certificate. Clients should check the distrust date in certificates to avoid
-trusting a CA for service they have ceased to support.
-
-A distrust date is a timestamp in unix epoch, encoded in DER format and saved
-in certdata.txt. These fields are defined at the "Certificate" entries of
-certdata.txt, in a MULTILINE_OCTAL format. By default, for readability purpose,
-these fields are set as a boolean CK_FALSE and will be ignored when read.
-
-1. Create the timestamp for the desired distrust date. An easy and practical way
-to do this is using the date command.
-    % date -d "2019-07-01 00:00:00 UTC" +%s
-    The result should be something like: 1561939200
-
-2. Then, run the addbuiltin -d to verify the timestamp and do the right
-conversions.
-   The -d option takes the timestamp as an argument, which is interpreted as
-   seconds since unix epoch. The addbuiltin command will show the result in the
-   stdout, as it should be inserted in certdata.txt.
-   % addbuiltin -d 1561939200
-   The result should be something like this:
-
-   The timestamp represents this date: Mon Jul 01 00:00:00 2019
-   Locate the entry of the desired certificate in certdata.txt
-   Erase the CKA_NSS_[SERVER|EMAIL]_DISTRUST_AFTER CK_BBOOL CK_FALSE
-   And override with the following respective entry:
-
-   # For Server Distrust After: Mon Jul 01 00:00:00 2019
-   CKA_NSS_SERVER_DISTRUST_AFTER MULTILINE_OCTAL
-   \061\071\060\067\060\061\060\060\060\060\060\060\132
-   END
-   # For Email Distrust After: Mon Jul 01 00:00:00 2019
-   CKA_NSS_EMAIL_DISTRUST_AFTER MULTILINE_OCTAL
-   \061\071\060\067\060\061\060\060\060\060\060\060\132
-   END
-
-3. Edit the certdata.txt, overriding the desired entry for the desired CA, as
-the instructions generated by the previous command.
-
-4. If necessary, increment the version counter
-NSS_BUILTINS_LIBRARY_VERSION_MINOR in nssckbi.h.
-
-5. Build the nssckbi module.
-
-6. A good way to test is with certutil:
-    % certutil -L -d $DBDIR -n "Builtin Object Token:<nickname>"
--- a/security/nss/lib/ckfw/builtins/certdata.txt
+++ b/security/nss/lib/ckfw/builtins/certdata.txt
@@ -8,31 +8,29 @@
 #
 # This file contains the object definitions for the certs and other
 # information "built into" NSS.
 #
 # Object definitions:
 #
 #    Certificates
 #
-#  -- Attribute --               -- type --          -- value --
-#  CKA_CLASS                     CK_OBJECT_CLASS     CKO_CERTIFICATE
-#  CKA_TOKEN                     CK_BBOOL            CK_TRUE
-#  CKA_PRIVATE                   CK_BBOOL            CK_FALSE
-#  CKA_MODIFIABLE                CK_BBOOL            CK_FALSE
-#  CKA_LABEL                     UTF8                (varies)
-#  CKA_CERTIFICATE_TYPE          CK_CERTIFICATE_TYPE CKC_X_509
-#  CKA_SUBJECT                   DER+base64          (varies)
-#  CKA_ID                        byte array          (varies)
-#  CKA_ISSUER                    DER+base64          (varies)
-#  CKA_SERIAL_NUMBER             DER+base64          (varies)
-#  CKA_VALUE                     DER+base64          (varies)
-#  CKA_NSS_EMAIL                 ASCII7              (unused here)
-#  CKA_NSS_SERVER_DISTRUST_AFTER DER+base64          (varies)
-#  CKA_NSS_EMAIL_DISTRUST_AFTER  DER+base64          (varies)
+#  -- Attribute --          -- type --              -- value --
+#  CKA_CLASS                CK_OBJECT_CLASS         CKO_CERTIFICATE
+#  CKA_TOKEN                CK_BBOOL                CK_TRUE
+#  CKA_PRIVATE              CK_BBOOL                CK_FALSE
+#  CKA_MODIFIABLE           CK_BBOOL                CK_FALSE
+#  CKA_LABEL                UTF8                    (varies)
+#  CKA_CERTIFICATE_TYPE     CK_CERTIFICATE_TYPE     CKC_X_509
+#  CKA_SUBJECT              DER+base64              (varies)
+#  CKA_ID                   byte array              (varies)
+#  CKA_ISSUER               DER+base64              (varies)
+#  CKA_SERIAL_NUMBER        DER+base64              (varies)
+#  CKA_VALUE                DER+base64              (varies)
+#  CKA_NSS_EMAIL            ASCII7                  (unused here)
 #
 #    Trust
 #
 #  -- Attribute --              -- type --          -- value --
 #  CKA_CLASS                    CK_OBJECT_CLASS     CKO_TRUST
 #  CKA_TOKEN                    CK_BBOOL            CK_TRUE
 #  CKA_PRIVATE                  CK_BBOOL            CK_FALSE
 #  CKA_MODIFIABLE               CK_BBOOL            CK_FALSE
@@ -161,18 +159,16 @@ CKA_VALUE MULTILINE_OCTAL
 \052\304\126\061\225\320\147\211\205\053\371\154\246\135\106\235
 \014\252\202\344\231\121\335\160\267\333\126\075\141\344\152\341
 \134\326\366\376\075\336\101\314\007\256\143\122\277\123\123\364
 \053\351\307\375\266\367\202\137\205\322\101\030\333\201\263\004
 \034\305\037\244\200\157\025\040\311\336\014\210\012\035\326\146
 \125\342\374\110\311\051\046\151\340
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "GlobalSign Root CA"
 # Issuer: CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
 # Serial Number:04:00:00:00:00:01:15:4b:5a:c3:94
 # Subject: CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
 # Not Valid Before: Tue Sep 01 12:00:00 1998
 # Not Valid After : Fri Jan 28 12:00:00 2028
 # Fingerprint (MD5): 3E:45:52:15:09:51:92:E1:B7:5D:37:9F:B1:87:29:8A
@@ -297,18 +293,16 @@ CKA_VALUE MULTILINE_OCTAL
 \001\373\303\155\271\357\104\155\171\106\061\176\012\376\251\202
 \301\377\357\253\156\040\304\120\311\137\235\115\233\027\214\014
 \345\001\311\240\101\152\163\123\372\245\120\264\156\045\017\373
 \114\030\364\375\122\331\216\151\261\350\021\017\336\210\330\373
 \035\111\367\252\336\225\317\040\170\302\140\022\333\045\100\214
 \152\374\176\102\070\100\144\022\367\236\201\341\223\056
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "GlobalSign Root CA - R2"
 # Issuer: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R2
 # Serial Number:04:00:00:00:00:01:0f:86:26:e6:0d
 # Subject: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R2
 # Not Valid Before: Fri Dec 15 08:00:00 2006
 # Not Valid After : Wed Dec 15 08:00:00 2021
 # Fingerprint (MD5): 94:14:77:7E:3E:5E:FD:8F:30:BD:41:B0:CF:E7:D0:30
@@ -455,18 +449,16 @@ CKA_VALUE MULTILINE_OCTAL
 \245\040\200\151\150\241\117\176\341\153\317\007\101\372\203\216
 \274\070\335\260\056\021\261\153\262\102\314\232\274\371\110\042
 \171\112\031\017\262\034\076\040\164\331\152\303\276\362\050\170
 \023\126\171\117\155\120\352\033\260\265\127\261\067\146\130\043
 \363\334\017\337\012\207\304\357\206\005\325\070\024\140\231\243
 \113\336\006\226\161\054\362\333\266\037\244\357\077\356
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Verisign Class 1 Public Primary Certification Authority - G3"
 # Issuer: CN=VeriSign Class 1 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Serial Number:00:8b:5b:75:56:84:54:85:0b:00:cf:af:38:48:ce:b1:a4
 # Subject: CN=VeriSign Class 1 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Not Valid Before: Fri Oct 01 00:00:00 1999
 # Not Valid After : Wed Jul 16 23:59:59 2036
 # Fingerprint (MD5): B1:47:BC:18:57:D1:18:A0:78:2D:EC:71:E8:2A:95:73
@@ -622,18 +614,16 @@ CKA_VALUE MULTILINE_OCTAL
 \260\177\373\066\045\332\225\320\361\044\024\027\335\030\200\153
 \106\043\071\124\365\216\142\011\004\035\224\220\246\233\346\045
 \342\102\105\252\270\220\255\276\010\217\251\013\102\030\224\317
 \162\071\341\261\103\340\050\317\267\347\132\154\023\153\111\263
 \377\343\030\174\211\213\063\135\254\063\327\247\371\332\072\125
 \311\130\020\371\252\357\132\266\317\113\113\337\052
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Verisign Class 2 Public Primary Certification Authority - G3"
 # Issuer: CN=VeriSign Class 2 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Serial Number:61:70:cb:49:8c:5f:98:45:29:e7:b0:a6:d9:50:5b:7a
 # Subject: CN=VeriSign Class 2 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Not Valid Before: Fri Oct 01 00:00:00 1999
 # Not Valid After : Wed Jul 16 23:59:59 2036
 # Fingerprint (MD5): F8:BE:C4:63:22:C9:A8:46:74:8B:B8:1D:1E:4A:2B:F6
@@ -789,18 +779,16 @@ CKA_VALUE MULTILINE_OCTAL
 \027\201\053\132\067\311\136\052\364\306\342\241\134\124\233\246
 \124\000\317\360\361\301\307\230\060\032\073\066\026\333\243\156
 \352\375\255\262\302\332\357\002\107\023\212\300\361\263\061\255
 \117\034\341\117\234\257\017\014\235\367\170\015\330\364\065\126
 \200\332\267\155\027\217\235\036\201\144\341\376\305\105\272\255
 \153\271\012\172\116\117\113\204\356\113\361\175\335\021
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
 # Issuer: CN=VeriSign Class 3 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Serial Number:00:9b:7e:06:49:a3:3e:62:b9:d5:ee:90:48:71:29:ef:57
 # Subject: CN=VeriSign Class 3 Public Primary Certification Authority - G3,OU="(c) 1999 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Not Valid Before: Fri Oct 01 00:00:00 1999
 # Not Valid After : Wed Jul 16 23:59:59 2036
 # Fingerprint (MD5): CD:68:B6:A7:C7:C4:CE:75:E0:1D:4F:57:44:61:92:09
@@ -1066,18 +1054,16 @@ CKA_VALUE MULTILINE_OCTAL
 \036\266\032\254\336\132\367\321\252\250\047\246\376\171\201\304
 \171\231\063\127\272\022\260\251\340\102\154\223\312\126\336\376
 \155\204\013\010\213\176\215\352\327\230\041\306\363\347\074\171
 \057\136\234\321\114\025\215\341\354\042\067\314\232\103\013\227
 \334\200\220\215\263\147\233\157\110\010\025\126\317\277\361\053
 \174\136\232\166\351\131\220\305\174\203\065\021\145\121
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Entrust.net Premium 2048 Secure Server CA"
 # Issuer: CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net
 # Serial Number: 946069240 (0x3863def8)
 # Subject: CN=Entrust.net Certification Authority (2048),OU=(c) 1999 Entrust.net Limited,OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),O=Entrust.net
 # Not Valid Before: Fri Dec 24 17:50:51 1999
 # Not Valid After : Tue Jul 24 14:15:12 2029
 # Fingerprint (MD5): EE:29:31:BC:32:7E:9A:E6:E8:B5:F7:51:B4:34:71:90
@@ -1206,18 +1192,16 @@ CKA_VALUE MULTILINE_OCTAL
 \144\346\037\267\316\360\362\237\056\273\033\267\362\120\210\163
 \222\302\342\343\026\215\232\062\002\253\216\030\335\351\020\021
 \356\176\065\253\220\257\076\060\224\172\320\063\075\247\145\017
 \365\374\216\236\142\317\107\104\054\001\135\273\035\265\062\322
 \107\322\070\056\320\376\201\334\062\152\036\265\356\074\325\374
 \347\201\035\031\303\044\102\352\143\071\251
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Baltimore CyberTrust Root"
 # Issuer: CN=Baltimore CyberTrust Root,OU=CyberTrust,O=Baltimore,C=IE
 # Serial Number: 33554617 (0x20000b9)
 # Subject: CN=Baltimore CyberTrust Root,OU=CyberTrust,O=Baltimore,C=IE
 # Not Valid Before: Fri May 12 18:46:00 2000
 # Not Valid After : Mon May 12 23:59:00 2025
 # Fingerprint (MD5): AC:B6:94:A5:9C:17:E0:D7:91:52:9B:B1:97:06:A6:E4
@@ -1352,18 +1336,16 @@ CKA_VALUE MULTILINE_OCTAL
 \247\077\376\321\146\255\013\274\153\231\206\357\077\175\363\030
 \062\312\173\306\343\253\144\106\225\370\046\151\331\125\203\173
 \054\226\007\377\131\054\104\243\306\345\351\251\334\241\143\200
 \132\041\136\041\317\123\124\360\272\157\211\333\250\252\225\317
 \213\343\161\314\036\033\040\104\010\300\172\266\100\375\304\344
 \065\341\035\026\034\320\274\053\216\326\161\331
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "AddTrust Low-Value Services Root"
 # Issuer: CN=AddTrust Class 1 CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
 # Serial Number: 1 (0x1)
 # Subject: CN=AddTrust Class 1 CA Root,OU=AddTrust TTP Network,O=AddTrust AB,C=SE
 # Not Valid Before: Tue May 30 10:38:31 2000
 # Not Valid After : Sat May 30 10:38:31 2020
 # Fingerprint (MD5): 1E:42:95:02:33:92:6B:B9:5F:C0:7F:DA:D6:B2:4B:FC
@@ -1503,18 +1485,16 @@ CKA_VALUE MULTILINE_OCTAL
 \142\041\150\025\040\103\074\231\347\174\275\044\330\251\221\027
 \163\210\077\126\033\061\070\030\264\161\017\232\315\310\016\236
 \216\056\033\341\214\230\203\313\037\061\361\104\114\306\004\163
 \111\166\140\017\307\370\275\027\200\153\056\351\314\114\016\132
 \232\171\017\040\012\056\325\236\143\046\036\125\222\224\330\202
 \027\132\173\320\274\307\217\116\206\004
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "AddTrust External Root"
 # Issuer: CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
 # Serial Number: 1 (0x1)
 # Subject: CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
 # Not Valid Before: Tue May 30 10:48:38 2000
 # Not Valid After : Sat May 30 10:48:38 2020
 # Fingerprint (MD5): 1D:35:54:04:85:78:B0:3F:42:42:4D:BF:20:73:0A:3F
@@ -1669,18 +1649,16 @@ CKA_VALUE MULTILINE_OCTAL
 \234\066\303\046\342\021\366\147\111\035\222\253\214\373\353\377
 \172\356\205\112\247\120\200\360\247\134\112\224\056\137\005\231
 \074\122\101\340\315\264\143\317\001\103\272\234\203\334\217\140
 \073\363\132\264\264\173\256\332\013\220\070\165\357\201\035\146
 \322\367\127\160\066\263\277\374\050\257\161\045\205\133\023\376
 \036\177\132\264\074
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Entrust Root Certification Authority"
 # Issuer: CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US
 # Serial Number: 1164660820 (0x456b5054)
 # Subject: CN=Entrust Root Certification Authority,OU="(c) 2006 Entrust, Inc.",OU=www.entrust.net/CPS is incorporated by reference,O="Entrust, Inc.",C=US
 # Not Valid Before: Mon Nov 27 20:23:42 2006
 # Not Valid After : Fri Nov 27 20:53:42 2026
 # Fingerprint (MD5): D6:A5:C3:ED:5D:DD:3E:00:C1:3D:87:92:1F:1D:3F:E4
@@ -1805,18 +1783,16 @@ CKA_VALUE MULTILINE_OCTAL
 \207\016\004\154\325\377\335\240\135\355\207\122\267\053\025\002
 \256\071\246\152\164\351\332\304\347\274\115\064\036\251\134\115
 \063\137\222\011\057\210\146\135\167\227\307\035\166\023\251\325
 \345\361\026\011\021\065\325\254\333\044\161\160\054\230\126\013
 \331\027\264\321\343\121\053\136\165\350\325\320\334\117\064\355
 \302\005\146\200\241\313\346\063
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "GeoTrust Global CA"
 # Issuer: CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US
 # Serial Number: 144470 (0x23456)
 # Subject: CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US
 # Not Valid Before: Tue May 21 04:00:00 2002
 # Not Valid After : Sat May 21 04:00:00 2022
 # Fingerprint (MD5): F7:75:AB:29:FB:51:4E:B7:77:5E:FF:05:3C:99:8E:F5
@@ -1967,18 +1943,16 @@ CKA_VALUE MULTILINE_OCTAL
 \014\136\011\154\010\227\174\243\075\174\223\377\077\241\024\247
 \317\265\135\353\333\333\034\304\166\337\210\271\275\105\005\225
 \033\256\374\106\152\114\257\110\343\316\256\017\322\176\353\346
 \154\234\117\201\152\172\144\254\273\076\325\347\313\166\056\305
 \247\110\301\134\220\017\313\310\077\372\346\062\341\215\033\157
 \244\346\216\330\371\051\110\212\316\163\376\054
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "GeoTrust Universal CA"
 # Issuer: CN=GeoTrust Universal CA,O=GeoTrust Inc.,C=US
 # Serial Number: 1 (0x1)
 # Subject: CN=GeoTrust Universal CA,O=GeoTrust Inc.,C=US
 # Not Valid Before: Thu Mar 04 05:00:00 2004
 # Not Valid After : Sun Mar 04 05:00:00 2029
 # Fingerprint (MD5): 92:65:58:8B:A2:1A:31:72:73:68:5C:B4:A5:7A:07:48
@@ -2129,18 +2103,16 @@ CKA_VALUE MULTILINE_OCTAL
 \351\242\334\257\176\030\022\203\375\126\027\101\056\325\051\202
 \175\231\364\061\366\161\251\317\054\001\047\245\005\271\252\262
 \110\116\052\357\237\223\122\121\225\074\122\163\216\126\114\027
 \100\300\011\050\344\213\152\110\123\333\354\315\125\125\361\306
 \370\351\242\054\114\246\321\046\137\176\257\132\114\332\037\246
 \362\034\054\176\256\002\026\322\126\320\057\127\123\107\350\222
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "GeoTrust Universal CA 2"
 # Issuer: CN=GeoTrust Universal CA 2,O=GeoTrust Inc.,C=US
 # Serial Number: 1 (0x1)
 # Subject: CN=GeoTrust Universal CA 2,O=GeoTrust Inc.,C=US
 # Not Valid Before: Thu Mar 04 05:00:00 2004
 # Not Valid After : Sun Mar 04 05:00:00 2029
 # Fingerprint (MD5): 34:FC:B8:D0:36:DB:9E:14:B3:C2:F2:DB:8F:E4:94:C7
@@ -2251,18 +2223,16 @@ CKA_VALUE MULTILINE_OCTAL
 \345\114\121\343\001\255\205\135\032\073\261\325\163\020\244\323
 \362\274\156\144\365\132\126\220\250\307\016\114\164\017\056\161
 \073\367\310\107\364\151\157\025\362\021\136\203\036\234\174\122
 \256\375\002\332\022\250\131\147\030\333\274\160\335\233\261\151
 \355\200\316\211\100\110\152\016\065\312\051\146\025\041\224\054
 \350\140\052\233\205\112\100\363\153\212\044\354\006\026\054\163
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Certum Root CA"
 # Issuer: CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL
 # Serial Number: 65568 (0x10020)
 # Subject: CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL
 # Not Valid Before: Tue Jun 11 10:46:39 2002
 # Not Valid After : Fri Jun 11 10:46:39 2027
 # Fingerprint (MD5): 2C:8F:9F:66:1D:18:90:B1:47:26:9D:8E:86:82:8C:A9
@@ -2399,18 +2369,16 @@ CKA_VALUE MULTILINE_OCTAL
 \372\272\002\316\247\054\251\020\023\054\324\345\010\046\253\042
 \227\140\370\220\136\164\324\242\232\123\275\362\251\150\340\242
 \156\302\327\154\261\243\017\236\277\353\150\347\126\362\256\362
 \343\053\070\072\011\201\265\153\205\327\276\055\355\077\032\267
 \262\143\342\365\142\054\202\324\152\000\101\120\361\071\203\237
 \225\351\066\226\230\156
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Comodo AAA Services root"
 # Issuer: CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
 # Serial Number: 1 (0x1)
 # Subject: CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
 # Not Valid Before: Thu Jan 01 00:00:00 2004
 # Not Valid After : Sun Dec 31 23:59:59 2028
 # Fingerprint (MD5): 49:79:04:B0:EB:87:19:AC:47:B0:BC:11:51:9B:74:D0
@@ -2579,18 +2547,16 @@ CKA_VALUE MULTILINE_OCTAL
 \154\241\273\236\372\004\154\111\046\164\217\322\163\353\314\060
 \242\346\352\131\042\207\370\227\365\016\375\352\314\222\244\026
 \304\122\030\352\041\316\261\361\346\204\201\345\272\251\206\050
 \362\103\132\135\022\235\254\036\331\250\345\012\152\247\177\240
 \207\051\317\362\211\115\324\354\305\342\346\172\320\066\043\212
 \112\164\066\371
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "QuoVadis Root CA"
 # Issuer: CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM
 # Serial Number: 985026699 (0x3ab6508b)
 # Subject: CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM
 # Not Valid Before: Mon Mar 19 18:33:33 2001
 # Not Valid After : Wed Mar 17 18:33:33 2021
 # Fingerprint (MD5): 27:DE:36:FE:72:B7:00:03:00:9D:F4:F0:1E:6C:04:24
@@ -2750,18 +2716,16 @@ CKA_VALUE MULTILINE_OCTAL
 \272\027\102\202\227\161\201\123\061\251\237\366\175\142\277\162
 \341\243\223\035\314\212\046\132\011\070\320\316\327\015\200\026
 \264\170\245\072\207\114\215\212\245\325\106\227\362\054\020\271
 \274\124\042\300\001\120\151\103\236\364\262\357\155\370\354\332
 \361\343\261\357\337\221\217\124\052\013\045\301\046\031\304\122
 \020\005\145\325\202\020\352\302\061\315\056
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "QuoVadis Root CA 2"
 # Issuer: CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM
 # Serial Number: 1289 (0x509)
 # Subject: CN=QuoVadis Root CA 2,O=QuoVadis Limited,C=BM
 # Not Valid Before: Fri Nov 24 18:27:00 2006
 # Not Valid After : Mon Nov 24 18:23:33 2031
 # Fingerprint (MD5): 5E:39:7B:DD:F8:BA:EC:82:E9:AC:62:BA:0C:54:00:2B
@@ -2932,18 +2896,16 @@ CKA_VALUE MULTILINE_OCTAL
 \137\116\301\050\222\336\030\272\325\052\050\273\021\213\027\223
 \230\231\140\224\134\043\317\132\047\227\136\013\005\006\223\067
 \036\073\151\066\353\251\236\141\035\217\062\332\216\014\326\164
 \076\173\011\044\332\001\167\107\304\073\315\064\214\231\365\312
 \341\045\141\063\262\131\033\342\156\327\067\127\266\015\251\022
 \332
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "QuoVadis Root CA 3"
 # Issuer: CN=QuoVadis Root CA 3,O=QuoVadis Limited,C=BM
 # Serial Number: 1478 (0x5c6)
 # Subject: CN=QuoVadis Root CA 3,O=QuoVadis Limited,C=BM
 # Not Valid Before: Fri Nov 24 19:11:23 2006
 # Not Valid After : Mon Nov 24 19:06:44 2031
 # Fingerprint (MD5): 31:85:3C:62:94:97:63:B9:AA:FD:89:4E:AF:6F:E0:CF
@@ -3063,18 +3025,16 @@ CKA_VALUE MULTILINE_OCTAL
 \045\020\313\361\072\362\331\372\333\111\126\273\246\376\247\101
 \065\303\340\210\141\311\210\307\337\066\020\042\230\131\352\260
 \112\373\126\026\163\156\254\115\367\042\241\117\255\035\172\055
 \105\047\345\060\301\136\362\332\023\313\045\102\121\225\107\003
 \214\154\041\314\164\102\355\123\377\063\213\217\017\127\001\026
 \057\317\246\356\311\160\042\024\275\375\276\154\013\003
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Security Communication Root CA"
 # Issuer: OU=Security Communication RootCA1,O=SECOM Trust.net,C=JP
 # Serial Number: 0 (0x0)
 # Subject: OU=Security Communication RootCA1,O=SECOM Trust.net,C=JP
 # Not Valid Before: Tue Sep 30 04:20:49 2003
 # Not Valid After : Sat Sep 30 04:20:49 2023
 # Fingerprint (MD5): F1:BC:63:6A:54:E0:B5:27:F5:CD:E7:1A:E3:4D:6E:4A
@@ -3188,18 +3148,16 @@ CKA_VALUE MULTILINE_OCTAL
 \116\116\236\314\014\215\224\334\331\105\234\136\354\102\120\143
 \256\364\135\304\261\022\334\312\073\250\056\235\024\132\005\165
 \267\354\327\143\342\272\065\266\004\010\221\350\332\235\234\366
 \146\265\030\254\012\246\124\046\064\063\322\033\301\324\177\032
 \072\216\013\252\062\156\333\374\117\045\237\331\062\307\226\132
 \160\254\337\114
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Sonera Class 2 Root CA"
 # Issuer: CN=Sonera Class2 CA,O=Sonera,C=FI
 # Serial Number: 29 (0x1d)
 # Subject: CN=Sonera Class2 CA,O=Sonera,C=FI
 # Not Valid Before: Fri Apr 06 07:29:40 2001
 # Not Valid After : Tue Apr 06 07:29:40 2021
 # Fingerprint (MD5): A3:EC:75:0F:2E:88:DF:FA:48:01:4E:0B:5C:48:6F:FB
@@ -3347,18 +3305,16 @@ CKA_VALUE MULTILINE_OCTAL
 \327\167\037\347\000\074\235\157\216\344\062\011\035\115\170\064
 \170\064\074\224\233\046\355\117\161\306\031\172\275\040\042\110
 \132\376\113\175\003\267\347\130\276\306\062\116\164\036\150\335
 \250\150\133\263\076\356\142\175\331\200\350\012\165\172\267\356
 \264\145\232\041\220\340\252\320\230\274\070\265\163\074\213\370
 \334
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Camerfirma Chambers of Commerce Root"
 # Issuer: CN=Chambers of Commerce Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU
 # Serial Number: 0 (0x0)
 # Subject: CN=Chambers of Commerce Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU
 # Not Valid Before: Tue Sep 30 16:13:43 2003
 # Not Valid After : Wed Sep 30 16:13:44 2037
 # Fingerprint (MD5): B0:01:EE:14:D9:AF:29:18:94:76:8E:F1:69:33:2A:84
@@ -3509,18 +3465,16 @@ CKA_VALUE MULTILINE_OCTAL
 \045\310\062\370\040\021\315\175\062\063\110\224\124\114\335\334
 \171\304\060\237\353\216\270\125\265\327\210\134\305\152\044\075
 \262\323\005\003\121\306\007\357\314\024\162\164\075\156\162\316
 \030\050\214\112\240\167\345\011\053\105\104\107\254\267\147\177
 \001\212\005\132\223\276\241\301\377\370\347\016\147\244\107\111
 \166\135\165\220\032\365\046\217\360
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Camerfirma Global Chambersign Root"
 # Issuer: CN=Global Chambersign Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU
 # Serial Number: 0 (0x0)
 # Subject: CN=Global Chambersign Root,OU=http://www.chambersign.org,O=AC Camerfirma SA CIF A82743287,C=EU
 # Not Valid Before: Tue Sep 30 16:14:18 2003
 # Not Valid After : Wed Sep 30 16:14:18 2037
 # Fingerprint (MD5): C5:E6:7B:BF:06:D0:4F:43:ED:C4:7A:65:8A:FB:6B:19
@@ -3664,18 +3618,16 @@ CKA_VALUE MULTILINE_OCTAL
 \176\034\033\333\152\200\017\041\274\351\333\246\267\100\364\262
 \213\251\261\344\357\232\032\320\075\151\231\356\250\050\243\341
 \074\263\360\262\021\234\317\174\100\346\335\347\103\175\242\330
 \072\265\251\215\362\064\231\304\324\020\341\006\375\011\204\020
 \073\356\304\114\364\354\047\174\102\302\164\174\202\212\011\311
 \264\003\045\274
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "XRamp Global CA Root"
 # Issuer: CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US
 # Serial Number:50:94:6c:ec:18:ea:d5:9c:4d:d5:97:ef:75:8f:a0:ad
 # Subject: CN=XRamp Global Certification Authority,O=XRamp Security Services Inc,OU=www.xrampsecurity.com,C=US
 # Not Valid Before: Mon Nov 01 17:14:04 2004
 # Not Valid After : Mon Jan 01 05:37:19 2035
 # Fingerprint (MD5): A1:0B:44:B3:CA:10:D8:00:6E:9D:0F:D8:0F:92:0A:D1
@@ -3813,18 +3765,16 @@ CKA_VALUE MULTILINE_OCTAL
 \353\116\046\266\163\053\344\323\366\114\376\046\161\342\141\021
 \164\112\377\127\032\207\017\165\110\056\317\121\151\027\240\002
 \022\141\225\325\321\100\262\020\114\356\304\254\020\103\246\245
 \236\012\325\225\142\232\015\317\210\202\305\062\014\344\053\237
 \105\346\015\237\050\234\261\271\052\132\127\255\067\017\257\035
 \177\333\275\237
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Go Daddy Class 2 CA"
 # Issuer: OU=Go Daddy Class 2 Certification Authority,O="The Go Daddy Group, Inc.",C=US
 # Serial Number: 0 (0x0)
 # Subject: OU=Go Daddy Class 2 Certification Authority,O="The Go Daddy Group, Inc.",C=US
 # Not Valid Before: Tue Jun 29 17:06:20 2004
 # Not Valid After : Thu Jun 29 17:06:20 2034
 # Fingerprint (MD5): 91:DE:06:25:AB:DA:FD:32:17:0C:BB:25:17:2A:84:67
@@ -3960,18 +3910,16 @@ CKA_VALUE MULTILINE_OCTAL
 \125\042\130\000\043\352\343\022\103\051\133\107\010\335\214\101
 \152\145\006\250\345\041\252\101\264\225\041\225\271\175\321\064
 \253\023\326\255\274\334\342\075\071\315\275\076\165\160\241\030
 \131\003\311\042\264\217\234\325\136\052\327\245\266\324\012\155
 \370\267\100\021\106\232\037\171\016\142\277\017\227\354\340\057
 \037\027\224
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Starfield Class 2 CA"
 # Issuer: OU=Starfield Class 2 Certification Authority,O="Starfield Technologies, Inc.",C=US
 # Serial Number: 0 (0x0)
 # Subject: OU=Starfield Class 2 Certification Authority,O="Starfield Technologies, Inc.",C=US
 # Not Valid Before: Tue Jun 29 17:39:16 2004
 # Not Valid After : Thu Jun 29 17:39:16 2034
 # Fingerprint (MD5): 32:4A:4B:BB:C8:63:69:9B:BE:74:9A:C6:DD:1D:46:24
@@ -4126,18 +4074,16 @@ CKA_VALUE MULTILINE_OCTAL
 \220\124\221\003\074\107\345\325\311\145\340\267\113\175\354\107
 \323\263\013\076\255\236\320\164\000\016\353\275\121\255\300\336
 \054\300\303\152\376\357\334\013\247\372\106\337\140\333\234\246
 \131\120\165\043\151\163\223\262\371\374\002\323\107\346\161\316
 \020\002\356\047\214\204\377\254\105\015\023\134\203\062\340\045
 \245\206\054\174\364\022
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Taiwan GRCA"
 # Issuer: O=Government Root Certification Authority,C=TW
 # Serial Number:1f:9d:59:5a:d7:2f:c2:06:44:a5:80:08:69:e3:5e:f6
 # Subject: O=Government Root Certification Authority,C=TW
 # Not Valid Before: Thu Dec 05 13:23:33 2002
 # Not Valid After : Sun Dec 05 13:23:33 2032
 # Fingerprint (MD5): 37:85:44:53:32:45:1F:20:F0:F3:95:E1:25:C4:43:4E
@@ -4267,18 +4213,16 @@ CKA_VALUE MULTILINE_OCTAL
 \037\153\014\066\007\026\177\067\174\251\133\155\172\361\022\106
 \140\203\327\047\004\276\113\316\227\276\303\147\052\150\021\337
 \200\347\014\063\146\277\023\015\024\156\363\177\037\143\020\036
 \372\215\033\045\155\154\217\245\267\141\001\261\322\243\046\241
 \020\161\235\255\342\303\371\303\231\121\267\053\007\010\316\056
 \346\120\262\247\372\012\105\057\242\360\362
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "DigiCert Assured ID Root CA"
 # Issuer: CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Serial Number:0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
 # Subject: CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Not Valid Before: Fri Nov 10 00:00:00 2006
 # Not Valid After : Mon Nov 10 00:00:00 2031
 # Fingerprint (MD5): 87:CE:0B:7B:2A:0E:49:00:E1:58:71:9B:37:A8:93:72
@@ -4410,18 +4354,16 @@ CKA_VALUE MULTILINE_OCTAL
 \141\041\030\325\004\255\170\074\054\072\200\153\247\353\257\025
 \024\351\330\211\301\271\070\154\342\221\154\212\377\144\271\167
 \045\127\060\300\033\044\243\341\334\351\337\107\174\265\264\044
 \010\005\060\354\055\275\013\277\105\277\120\271\251\363\353\230
 \001\022\255\310\210\306\230\064\137\215\012\074\306\351\325\225
 \225\155\336
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "DigiCert Global Root CA"
 # Issuer: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Serial Number:08:3b:e0:56:90:42:46:b1:a1:75:6a:c9:59:91:c7:4a
 # Subject: CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Not Valid Before: Fri Nov 10 00:00:00 2006
 # Not Valid After : Mon Nov 10 00:00:00 2031
 # Fingerprint (MD5): 79:E4:A9:84:0D:7D:3A:96:D7:C0:4F:E2:43:4C:89:2E
@@ -4554,18 +4496,16 @@ CKA_VALUE MULTILINE_OCTAL
 \342\300\020\127\270\310\166\022\221\125\362\110\151\330\274\052
 \002\133\017\104\324\040\061\333\364\272\160\046\135\220\140\236
 \274\113\027\011\057\264\313\036\103\150\311\007\047\301\322\134
 \367\352\041\271\150\022\234\074\234\277\236\374\200\134\233\143
 \315\354\107\252\045\047\147\240\067\363\000\202\175\124\327\251
 \370\351\056\023\243\167\350\037\112
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "DigiCert High Assurance EV Root CA"
 # Issuer: CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Serial Number:02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
 # Subject: CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Not Valid Before: Fri Nov 10 00:00:00 2006
 # Not Valid After : Mon Nov 10 00:00:00 2031
 # Fingerprint (MD5): D4:74:DE:57:5C:39:B2:D3:9C:85:83:C5:C0:65:49:8A
@@ -4686,18 +4626,16 @@ CKA_VALUE MULTILINE_OCTAL
 \147\267\130\253\376\147\166\161\170\333\015\242\126\024\023\071
 \044\061\205\242\250\002\132\060\107\341\335\120\007\274\002\011
 \220\000\353\144\143\140\233\026\274\210\311\022\346\322\175\221
 \213\371\075\062\215\145\264\351\174\261\127\166\352\305\266\050
 \071\277\025\145\034\310\366\167\226\152\012\215\167\013\330\221
 \013\004\216\007\333\051\266\012\356\235\202\065\065\020
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "DST Root CA X3"
 # Issuer: CN=DST Root CA X3,O=Digital Signature Trust Co.
 # Serial Number:44:af:b0:80:d6:a3:27:ba:89:30:39:86:2e:f8:40:6b
 # Subject: CN=DST Root CA X3,O=Digital Signature Trust Co.
 # Not Valid Before: Sat Sep 30 21:12:19 2000
 # Not Valid After : Thu Sep 30 14:01:15 2021
 # Fingerprint (MD5): 41:03:52:DC:0F:F7:50:1B:16:F0:02:8E:BA:6F:45:C5
@@ -4855,18 +4793,16 @@ CKA_VALUE MULTILINE_OCTAL
 \221\313\062\233\023\075\076\175\222\122\065\254\222\224\242\323
 \030\302\174\307\352\257\166\005\026\335\147\047\302\176\034\007
 \042\041\363\100\012\033\064\007\104\023\302\204\152\216\337\031
 \132\277\177\353\035\342\032\070\321\134\257\107\222\153\200\265
 \060\245\311\215\330\253\061\201\037\337\302\146\067\323\223\251
 \205\206\171\145\322
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "SwissSign Platinum CA - G2"
 # Issuer: CN=SwissSign Platinum CA - G2,O=SwissSign AG,C=CH
 # Serial Number:4e:b2:00:67:0c:03:5d:4f
 # Subject: CN=SwissSign Platinum CA - G2,O=SwissSign AG,C=CH
 # Not Valid Before: Wed Oct 25 08:36:00 2006
 # Not Valid After : Sat Oct 25 08:36:00 2036
 # Fingerprint (MD5): C9:98:27:77:28:1E:3D:0E:15:3C:84:00:B8:85:03:E6
@@ -5022,18 +4958,16 @@ CKA_VALUE MULTILINE_OCTAL
 \223\340\177\043\263\125\255\162\045\116\106\371\322\026\357\260
 \144\301\001\236\351\312\240\152\230\016\317\330\140\362\057\111
 \270\344\102\341\070\065\026\364\310\156\117\367\201\126\350\272
 \243\276\043\257\256\375\157\003\340\002\073\060\166\372\033\155
 \101\317\001\261\351\270\311\146\364\333\046\363\072\244\164\362
 \111\044\133\311\260\320\127\301\372\076\172\341\227\311
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "SwissSign Gold CA - G2"
 # Issuer: CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
 # Serial Number:00:bb:40:1c:43:f5:5e:4f:b0
 # Subject: CN=SwissSign Gold CA - G2,O=SwissSign AG,C=CH
 # Not Valid Before: Wed Oct 25 08:30:35 2006
 # Not Valid After : Sat Oct 25 08:30:35 2036
 # Fingerprint (MD5): 24:77:D9:A8:91:D1:3B:FA:88:2D:C2:FF:F8:CD:33:93
@@ -5190,18 +5124,16 @@ CKA_VALUE MULTILINE_OCTAL
 \204\010\146\322\304\066\175\247\076\020\374\210\340\324\200\345
 \000\275\252\363\116\006\243\172\152\371\142\162\343\011\117\353
 \233\016\001\043\361\237\273\174\334\334\154\021\227\045\262\362
 \264\143\024\322\006\052\147\214\203\365\316\352\007\330\232\152
 \036\354\344\012\273\052\114\353\011\140\071\316\312\142\330\056
 \156
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "SwissSign Silver CA - G2"
 # Issuer: CN=SwissSign Silver CA - G2,O=SwissSign AG,C=CH
 # Serial Number:4f:1b:d4:2f:54:bb:2f:4b
 # Subject: CN=SwissSign Silver CA - G2,O=SwissSign AG,C=CH
 # Not Valid Before: Wed Oct 25 08:32:46 2006
 # Not Valid After : Sat Oct 25 08:32:46 2036
 # Fingerprint (MD5): E0:06:A1:C9:7D:CF:C9:FC:0D:C0:56:75:96:D8:62:13
@@ -5324,18 +5256,16 @@ CKA_VALUE MULTILINE_OCTAL
 \061\267\371\264\161\200\022\110\231\162\163\132\131\123\301\143
 \122\063\355\247\311\322\071\002\160\372\340\261\102\146\051\252
 \233\121\355\060\124\042\024\137\331\253\035\301\344\224\360\370
 \365\053\367\352\312\170\106\326\270\221\375\246\015\053\032\024
 \001\076\200\360\102\240\225\007\136\155\315\314\113\244\105\215
 \253\022\350\263\336\132\345\240\174\350\017\042\035\132\351\131
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "GeoTrust Primary Certification Authority"
 # Issuer: CN=GeoTrust Primary Certification Authority,O=GeoTrust Inc.,C=US
 # Serial Number:18:ac:b5:6a:fd:69:b6:15:3a:63:6c:af:da:fa:c4:a1
 # Subject: CN=GeoTrust Primary Certification Authority,O=GeoTrust Inc.,C=US
 # Not Valid Before: Mon Nov 27 00:00:00 2006
 # Not Valid After : Wed Jul 16 23:59:59 2036
 # Fingerprint (MD5): 02:26:C3:01:5E:08:30:37:43:A9:D0:7D:CF:37:E6:BF
@@ -5481,18 +5411,16 @@ CKA_VALUE MULTILINE_OCTAL
 \263\041\030\204\345\066\000\353\143\040\231\271\351\376\063\004
 \273\101\310\301\002\371\104\143\040\236\201\316\102\323\326\077
 \054\166\323\143\234\131\335\217\246\341\016\240\056\101\367\056
 \225\107\317\274\375\063\363\366\013\141\176\176\221\053\201\107
 \302\047\060\356\247\020\135\067\217\134\071\053\344\004\360\173
 \215\126\214\150
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "thawte Primary Root CA"
 # Issuer: CN=thawte Primary Root CA,OU="(c) 2006 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
 # Serial Number:34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
 # Subject: CN=thawte Primary Root CA,OU="(c) 2006 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
 # Not Valid Before: Fri Nov 17 00:00:00 2006
 # Not Valid After : Wed Jul 16 23:59:59 2036
 # Fingerprint (MD5): 8C:CA:DC:0B:22:CE:F5:BE:72:AC:41:1A:11:A8:D8:12
@@ -5658,18 +5586,16 @@ CKA_VALUE MULTILINE_OCTAL
 \341\364\021\157\020\265\225\374\347\102\005\062\333\316\235\121
 \136\050\266\236\205\323\133\357\245\175\105\100\162\216\267\016
 \153\016\006\373\063\065\110\161\270\235\047\213\304\145\137\015
 \206\166\234\104\172\366\225\134\366\135\062\010\063\244\124\266
 \030\077\150\134\362\102\112\205\070\124\203\137\321\350\054\362
 \254\021\326\250\355\143\152
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
 # Issuer: CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU="(c) 2006 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Serial Number:18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
 # Subject: CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU="(c) 2006 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Not Valid Before: Wed Nov 08 00:00:00 2006
 # Not Valid After : Wed Jul 16 23:59:59 2036
 # Fingerprint (MD5): CB:17:E4:31:67:3E:E2:09:FE:45:57:93:F3:0A:FA:1C
@@ -5803,18 +5729,16 @@ CKA_VALUE MULTILINE_OCTAL
 \010\374\210\351\256\213\177\341\060\364\067\176\375\306\062\332
 \055\236\104\060\060\154\356\007\336\322\064\374\322\377\100\366
 \113\364\146\106\006\124\246\362\062\012\143\046\060\153\233\321
 \334\213\107\272\341\271\325\142\320\242\240\364\147\005\170\051
 \143\032\157\004\326\370\306\114\243\232\261\067\264\215\345\050
 \113\035\236\054\302\270\150\274\355\002\356\061
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "SecureTrust CA"
 # Issuer: CN=SecureTrust CA,O=SecureTrust Corporation,C=US
 # Serial Number:0c:f0:8e:5c:08:16:a5:ad:42:7f:f0:eb:27:18:59:d0
 # Subject: CN=SecureTrust CA,O=SecureTrust Corporation,C=US
 # Not Valid Before: Tue Nov 07 19:31:18 2006
 # Not Valid After : Mon Dec 31 19:40:55 2029
 # Fingerprint (MD5): DC:32:C3:A7:6D:25:57:C7:68:09:9D:EA:2D:A9:A2:D1
@@ -5940,18 +5864,16 @@ CKA_VALUE MULTILINE_OCTAL
 \210\321\072\051\060\204\316\322\071\200\142\033\250\307\127\111
 \274\152\125\121\147\025\112\276\065\007\344\325\165\230\067\171
 \060\024\333\051\235\154\305\151\314\107\125\242\060\367\314\134
 \177\302\303\230\034\153\116\026\200\353\172\170\145\105\242\000
 \032\257\014\015\125\144\064\110\270\222\271\361\264\120\051\362
 \117\043\037\332\154\254\037\104\341\335\043\170\121\133\307\026
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Secure Global CA"
 # Issuer: CN=Secure Global CA,O=SecureTrust Corporation,C=US
 # Serial Number:07:56:22:a4:e8:d4:8a:89:4d:f4:13:c8:f0:f8:ea:a5
 # Subject: CN=Secure Global CA,O=SecureTrust Corporation,C=US
 # Not Valid Before: Tue Nov 07 19:42:28 2006
 # Not Valid After : Mon Dec 31 19:52:06 2029
 # Fingerprint (MD5): CF:F4:27:0D:D4:ED:DC:65:16:49:6D:3D:DA:BF:6E:DE
@@ -6092,18 +6014,16 @@ CKA_VALUE MULTILINE_OCTAL
 \141\364\222\166\175\077\204\215\125\267\350\345\254\325\361\365
 \031\126\246\132\373\220\034\257\223\353\345\034\324\147\227\135
 \004\016\276\013\203\246\027\203\271\060\022\240\305\063\025\005
 \271\015\373\307\005\166\343\330\112\215\374\064\027\243\306\041
 \050\276\060\105\061\036\307\170\276\130\141\070\254\073\342\001
 \145
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "COMODO Certification Authority"
 # Issuer: CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 # Serial Number:4e:81:2d:8a:82:65:e0:0b:02:ee:3e:35:02:46:e5:3d
 # Subject: CN=COMODO Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 # Not Valid Before: Fri Dec 01 00:00:00 2006
 # Not Valid After : Mon Dec 31 23:59:59 2029
 # Fingerprint (MD5): 5C:48:DC:F7:42:72:EC:56:94:6D:1C:CC:71:35:80:75
@@ -6240,18 +6160,16 @@ CKA_VALUE MULTILINE_OCTAL
 \300\247\210\362\123\167\263\140\136\256\256\050\332\065\054\157
 \064\105\323\046\341\336\354\133\117\047\153\026\174\275\104\004
 \030\202\263\211\171\027\020\161\075\172\242\026\116\365\001\315
 \244\154\145\150\241\111\166\134\103\311\330\274\066\147\154\245
 \224\265\324\314\271\275\152\065\126\041\336\330\303\353\373\313
 \244\140\114\260\125\240\240\173\127\262
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Network Solutions Certificate Authority"
 # Issuer: CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US
 # Serial Number:57:cb:33:6f:c2:5c:16:e6:47:16:17:e3:90:31:68:e0
 # Subject: CN=Network Solutions Certificate Authority,O=Network Solutions L.L.C.,C=US
 # Not Valid Before: Fri Dec 01 00:00:00 2006
 # Not Valid After : Mon Dec 31 23:59:59 2029
 # Fingerprint (MD5): D3:F3:A6:16:C0:FA:6B:1D:59:B1:2D:96:4D:0E:11:2E
@@ -6368,18 +6286,16 @@ CKA_VALUE MULTILINE_OCTAL
 \267\170\012\162\267\210\337\377\265\106\024\011\012\372\240\346
 \175\010\306\032\207\275\030\250\163\275\046\312\140\014\235\316
 \231\237\317\134\017\060\341\276\024\061\352\002\060\024\364\223
 \074\111\247\063\172\220\106\107\263\143\175\023\233\116\267\157
 \030\067\200\123\376\335\040\340\065\232\066\321\307\001\271\346
 \334\335\363\377\035\054\072\026\127\331\222\071\326
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "COMODO ECC Certification Authority"
 # Issuer: CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 # Serial Number:1f:47:af:aa:62:00:70:50:54:4c:01:9e:9b:63:99:2a
 # Subject: CN=COMODO ECC Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 # Not Valid Before: Thu Mar 06 00:00:00 2008
 # Not Valid After : Mon Jan 18 23:59:59 2038
 # Fingerprint (MD5): 7C:62:FF:74:9D:31:53:5E:68:4A:D5:78:AA:1E:BF:23
@@ -6521,18 +6437,16 @@ CKA_VALUE MULTILINE_OCTAL
 \113\326\104\150\263\075\371\123\164\204\263\106\221\106\226\000
 \267\200\054\266\341\343\020\342\333\242\347\050\217\001\226\142
 \026\076\000\343\034\245\066\201\030\242\114\122\166\300\021\243
 \156\346\035\272\343\132\276\066\123\305\076\165\217\206\151\051
 \130\123\265\234\273\157\237\134\305\030\354\335\057\341\230\311
 \374\276\337\012\015
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "OISTE WISeKey Global Root GA CA"
 # Issuer: CN=OISTE WISeKey Global Root GA CA,OU=OISTE Foundation Endorsed,OU=Copyright (c) 2005,O=WISeKey,C=CH
 # Serial Number:41:3d:72:c7:f4:6b:1f:81:43:7d:f1:d2:28:54:df:9a
 # Subject: CN=OISTE WISeKey Global Root GA CA,OU=OISTE Foundation Endorsed,OU=Copyright (c) 2005,O=WISeKey,C=CH
 # Not Valid Before: Sun Dec 11 16:03:44 2005
 # Not Valid After : Fri Dec 11 16:09:51 2037
 # Fingerprint (MD5): BC:6C:51:33:A7:E9:D3:66:63:54:15:72:1B:21:92:93
@@ -6658,18 +6572,16 @@ CKA_VALUE MULTILINE_OCTAL
 \365\337\124\315\336\346\330\326\011\010\227\143\345\301\056\260
 \267\104\046\300\046\300\257\125\060\236\073\325\066\052\031\004
 \364\134\036\377\317\054\267\377\320\375\207\100\021\325\021\043
 \273\110\300\041\251\244\050\055\375\025\370\260\116\053\364\060
 \133\041\374\021\221\064\276\101\357\173\235\227\165\377\227\225
 \300\226\130\057\352\273\106\327\273\344\331\056
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Certigna"
 # Issuer: CN=Certigna,O=Dhimyotis,C=FR
 # Serial Number:00:fe:dc:e3:01:0f:c9:48:ff
 # Subject: CN=Certigna,O=Dhimyotis,C=FR
 # Not Valid Before: Fri Jun 29 15:13:05 2007
 # Not Valid After : Tue Jun 29 15:13:05 2027
 # Fingerprint (MD5): AB:57:A6:5B:7D:42:82:19:B5:D8:58:26:28:5E:FD:FF
@@ -6789,18 +6701,16 @@ CKA_VALUE MULTILINE_OCTAL
 \174\004\270\330\104\037\223\137\161\011\042\267\156\076\352\034
 \003\116\235\032\040\141\373\201\067\354\136\374\012\105\253\327
 \347\027\125\320\240\352\140\233\246\366\343\214\133\051\302\006
 \140\024\235\055\227\114\251\223\025\235\141\304\001\137\110\326
 \130\275\126\061\022\116\021\310\041\340\263\021\221\145\333\264
 \246\210\070\316\125
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Cybertrust Global Root"
 # Issuer: CN=Cybertrust Global Root,O="Cybertrust, Inc"
 # Serial Number:04:00:00:00:00:01:0f:85:aa:2d:48
 # Subject: CN=Cybertrust Global Root,O="Cybertrust, Inc"
 # Not Valid Before: Fri Dec 15 08:00:00 2006
 # Not Valid After : Wed Dec 15 08:00:00 2021
 # Fingerprint (MD5): 72:E4:4A:87:E3:69:40:80:77:EA:BC:E3:F4:FF:F0:E1
@@ -6958,18 +6868,16 @@ CKA_VALUE MULTILINE_OCTAL
 \331\363\370\047\266\311\276\035\264\154\144\220\177\364\344\304
 \133\327\067\256\102\016\335\244\032\157\174\210\124\305\026\156
 \341\172\150\056\370\072\277\015\244\074\211\073\170\247\116\143
 \203\004\041\010\147\215\362\202\111\320\133\375\261\315\017\203
 \204\324\076\040\205\367\112\075\053\234\375\052\012\011\115\352
 \201\370\021\234
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "ePKI Root Certification Authority"
 # Issuer: OU=ePKI Root Certification Authority,O="Chunghwa Telecom Co., Ltd.",C=TW
 # Serial Number:15:c8:bd:65:47:5c:af:b8:97:00:5e:e4:06:d2:bc:9d
 # Subject: OU=ePKI Root Certification Authority,O="Chunghwa Telecom Co., Ltd.",C=TW
 # Not Valid Before: Mon Dec 20 02:31:27 2004
 # Not Valid After : Wed Dec 20 02:31:27 2034
 # Fingerprint (MD5): 1B:2E:00:CA:26:06:90:3D:AD:FE:6F:15:68:D3:6B:B3
@@ -7085,18 +6993,16 @@ CKA_VALUE MULTILINE_OCTAL
 \164\161\120\211\155\274\024\343\017\206\256\361\253\076\307\240
 \011\314\243\110\321\340\333\144\347\222\265\317\257\162\103\160
 \213\371\303\204\074\023\252\176\222\233\127\123\223\372\160\302
 \221\016\061\371\233\147\135\351\226\070\136\137\263\163\116\210
 \025\147\336\236\166\020\142\040\276\125\151\225\103\000\071\115
 \366\356\260\132\116\111\104\124\130\137\102\203
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "certSIGN ROOT CA"
 # Issuer: OU=certSIGN ROOT CA,O=certSIGN,C=RO
 # Serial Number:20:06:05:16:70:02
 # Subject: OU=certSIGN ROOT CA,O=certSIGN,C=RO
 # Not Valid Before: Tue Jul 04 17:20:04 2006
 # Not Valid After : Fri Jul 04 17:20:04 2031
 # Fingerprint (MD5): 18:98:C0:D6:E9:3A:FC:F9:B0:F5:0C:F7:4B:01:44:17
@@ -7235,18 +7141,16 @@ CKA_VALUE MULTILINE_OCTAL
 \044\333\312\340\016\055\007\262\076\126\334\215\365\101\205\007
 \110\233\014\013\313\111\077\175\354\267\375\313\215\147\211\032
 \253\355\273\036\243\000\010\010\027\052\202\134\061\135\106\212
 \055\017\206\233\164\331\105\373\324\100\261\172\252\150\055\206
 \262\231\042\341\301\053\307\234\370\363\137\250\202\022\353\031
 \021\055
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "GeoTrust Primary Certification Authority - G3"
 # Issuer: CN=GeoTrust Primary Certification Authority - G3,OU=(c) 2008 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US
 # Serial Number:15:ac:6e:94:19:b2:79:4b:41:f6:27:a9:c3:18:0f:1f
 # Subject: CN=GeoTrust Primary Certification Authority - G3,OU=(c) 2008 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US
 # Not Valid Before: Wed Apr 02 00:00:00 2008
 # Not Valid After : Tue Dec 01 23:59:59 2037
 # Fingerprint (MD5): B5:E8:34:36:C9:10:44:58:48:70:6D:2E:83:D4:B8:05
@@ -7366,18 +7270,16 @@ CKA_VALUE MULTILINE_OCTAL
 \346\012\303\275\365\200\212\227\065\015\033\211\074\124\206\167
 \050\312\241\364\171\336\265\346\070\260\360\145\160\214\177\002
 \124\302\277\377\330\241\076\331\317\002\061\000\304\215\224\374
 \334\123\322\334\235\170\026\037\025\063\043\123\122\343\132\061
 \135\235\312\256\275\023\051\104\015\047\133\250\347\150\234\022
 \367\130\077\056\162\002\127\243\217\241\024\056
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "thawte Primary Root CA - G2"
 # Issuer: CN=thawte Primary Root CA - G2,OU="(c) 2007 thawte, Inc. - For authorized use only",O="thawte, Inc.",C=US
 # Serial Number:35:fc:26:5c:d9:84:4f:c9:3d:26:3d:57:9b:ae:d7:56
 # Subject: CN=thawte Primary Root CA - G2,OU="(c) 2007 thawte, Inc. - For authorized use only",O="thawte, Inc.",C=US
 # Not Valid Before: Mon Nov 05 00:00:00 2007
 # Not Valid After : Mon Jan 18 23:59:59 2038
 # Fingerprint (MD5): 74:9D:EA:60:24:C4:FD:22:53:3E:CC:3A:72:D9:29:4F
@@ -7528,18 +7430,16 @@ CKA_VALUE MULTILINE_OCTAL
 \006\352\233\344\162\202\343\241\011\301\351\000\031\323\076\324
 \160\153\272\161\246\252\130\256\364\273\351\154\266\357\207\314
 \233\273\377\071\346\126\141\323\012\247\304\134\114\140\173\005
 \167\046\172\277\330\007\122\054\142\367\160\143\331\071\274\157
 \034\302\171\334\166\051\257\316\305\054\144\004\136\210\066\156
 \061\324\100\032\142\064\066\077\065\001\256\254\143\240
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "thawte Primary Root CA - G3"
 # Issuer: CN=thawte Primary Root CA - G3,OU="(c) 2008 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
 # Serial Number:60:01:97:b7:46:a7:ea:b4:b4:9a:d6:4b:2f:f7:90:fb
 # Subject: CN=thawte Primary Root CA - G3,OU="(c) 2008 thawte, Inc. - For authorized use only",OU=Certification Services Division,O="thawte, Inc.",C=US
 # Not Valid Before: Wed Apr 02 00:00:00 2008
 # Not Valid After : Tue Dec 01 23:59:59 2037
 # Fingerprint (MD5): FB:1B:5D:43:8A:94:CD:44:C6:76:F2:43:4B:47:E7:31
@@ -7666,18 +7566,16 @@ CKA_VALUE MULTILINE_OCTAL
 \323\106\250\362\112\114\002\143\373\154\137\070\333\056\101\223
 \251\016\346\235\334\061\034\262\240\247\030\034\171\341\307\066
 \002\060\072\126\257\232\164\154\366\373\203\340\063\323\010\137
 \241\234\302\133\237\106\326\266\313\221\006\143\242\006\347\063
 \254\076\250\201\022\320\313\272\320\222\013\266\236\226\252\004
 \017\212
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "GeoTrust Primary Certification Authority - G2"
 # Issuer: CN=GeoTrust Primary Certification Authority - G2,OU=(c) 2007 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US
 # Serial Number:3c:b2:f4:48:0a:00:e2:fe:eb:24:3b:5e:60:3e:c3:6b
 # Subject: CN=GeoTrust Primary Certification Authority - G2,OU=(c) 2007 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US
 # Not Valid Before: Mon Nov 05 00:00:00 2007
 # Not Valid After : Mon Jan 18 23:59:59 2038
 # Fingerprint (MD5): 01:5E:D8:6B:BD:6F:3D:8E:A1:31:F8:12:E0:98:73:6A
@@ -7838,18 +7736,16 @@ CKA_VALUE MULTILINE_OCTAL
 \217\277\276\241\252\277\075\035\265\324\070\352\327\260\134\072
 \117\152\077\217\300\146\154\143\252\351\331\244\026\364\201\321
 \225\024\016\175\315\225\064\331\322\217\160\163\201\173\234\176
 \275\230\141\330\105\207\230\220\305\353\206\060\306\065\277\360
 \377\303\125\210\203\113\357\005\222\006\161\362\270\230\223\267
 \354\315\202\141\361\070\346\117\227\230\052\132\215
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "VeriSign Universal Root Certification Authority"
 # Issuer: CN=VeriSign Universal Root Certification Authority,OU="(c) 2008 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Serial Number:40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d
 # Subject: CN=VeriSign Universal Root Certification Authority,OU="(c) 2008 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Not Valid Before: Wed Apr 02 00:00:00 2008
 # Not Valid After : Tue Dec 01 23:59:59 2037
 # Fingerprint (MD5): 8E:AD:B5:01:AA:4D:81:E4:8C:1D:D1:E1:14:00:95:19
@@ -7995,18 +7891,16 @@ CKA_VALUE MULTILINE_OCTAL
 \340\247\374\066\204\121\221\040\054\166\115\103\075\304\035\204
 \043\320\254\326\174\065\006\316\315\151\275\220\015\333\154\110
 \102\035\016\252\102\002\061\000\234\075\110\071\043\071\130\032
 \025\022\131\152\236\357\325\131\262\035\122\054\231\161\315\307
 \051\337\033\052\141\173\161\321\336\363\300\345\015\072\112\252
 \055\247\330\206\052\335\056\020
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
 # Issuer: CN=VeriSign Class 3 Public Primary Certification Authority - G4,OU="(c) 2007 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Serial Number:2f:80:fe:23:8c:0e:22:0f:48:67:12:28:91:87:ac:b3
 # Subject: CN=VeriSign Class 3 Public Primary Certification Authority - G4,OU="(c) 2007 VeriSign, Inc. - For authorized use only",OU=VeriSign Trust Network,O="VeriSign, Inc.",C=US
 # Not Valid Before: Mon Nov 05 00:00:00 2007
 # Not Valid After : Mon Jan 18 23:59:59 2038
 # Fingerprint (MD5): 3A:52:E1:E7:FD:6F:3A:E3:6F:F3:6F:99:1B:F9:22:41
@@ -8157,18 +8051,16 @@ CKA_VALUE MULTILINE_OCTAL
 \270\270\333\276\265\271\051\371\332\067\005\000\111\224\003\204
 \104\347\277\103\061\317\165\213\045\321\364\246\144\365\222\366
 \253\005\353\075\351\245\013\066\142\332\314\006\137\066\213\266
 \136\061\270\052\373\136\366\161\337\104\046\236\304\346\015\221
 \264\056\165\225\200\121\152\113\060\246\260\142\241\223\361\233
 \330\316\304\143\165\077\131\107\261
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "NetLock Arany (Class Gold) Főtanúsítvány"
 # Issuer: CN=NetLock Arany (Class Gold) F..tan..s..tv..ny,OU=Tan..s..tv..nykiad..k (Certification Services),O=NetLock Kft.,L=Budapest,C=HU
 # Serial Number:49:41:2c:e4:00:10
 # Subject: CN=NetLock Arany (Class Gold) F..tan..s..tv..ny,OU=Tan..s..tv..nykiad..k (Certification Services),O=NetLock Kft.,L=Budapest,C=HU
 # Not Valid Before: Thu Dec 11 15:08:21 2008
 # Not Valid After : Wed Dec 06 15:08:21 2028
 # Fingerprint (MD5): C5:A1:B7:FF:73:DD:D6:D7:34:32:18:DF:FC:3C:AD:88
@@ -8333,18 +8225,16 @@ CKA_VALUE MULTILINE_OCTAL
 \143\260\127\067\105\055\173\212\234\277\005\352\145\125\063\367
 \071\020\305\050\052\041\172\033\212\304\044\371\077\025\310\232
 \025\040\365\125\142\226\355\155\223\120\274\344\252\170\255\331
 \313\012\145\207\246\146\301\304\201\243\167\072\130\036\013\356
 \203\213\235\036\322\122\244\314\035\157\260\230\155\224\061\265
 \370\161\012\334\271\374\175\062\140\346\353\257\212\001
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Staat der Nederlanden Root CA - G2"
 # Issuer: CN=Staat der Nederlanden Root CA - G2,O=Staat der Nederlanden,C=NL
 # Serial Number: 10000012 (0x98968c)
 # Subject: CN=Staat der Nederlanden Root CA - G2,O=Staat der Nederlanden,C=NL
 # Not Valid Before: Wed Mar 26 11:18:17 2008
 # Not Valid After : Wed Mar 25 11:03:10 2020
 # Fingerprint (MD5): 7C:A5:0F:F8:5B:9A:7D:6D:30:AE:54:5A:E3:42:A2:8A
@@ -8461,18 +8351,16 @@ CKA_VALUE MULTILINE_OCTAL
 \237\212\363\312\154\117\372\021\072\025\025\106\303\315\037\203
 \133\055\101\022\355\120\147\101\023\075\041\253\224\212\252\116
 \174\301\261\373\247\326\265\047\057\227\253\156\340\035\342\321
 \034\054\037\104\342\374\276\221\241\234\373\326\051\123\163\206
 \237\123\330\103\016\135\326\143\202\161\035\200\164\312\366\342
 \002\153\331\132
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Hongkong Post Root CA 1"
 # Issuer: CN=Hongkong Post Root CA 1,O=Hongkong Post,C=HK
 # Serial Number: 1000 (0x3e8)
 # Subject: CN=Hongkong Post Root CA 1,O=Hongkong Post,C=HK
 # Not Valid Before: Thu May 15 05:13:14 2003
 # Not Valid After : Mon May 15 04:52:29 2023
 # Fingerprint (MD5): A8:0D:6F:39:78:B9:43:6D:77:42:6D:98:5A:CC:23:CA
@@ -8594,18 +8482,16 @@ CKA_VALUE MULTILINE_OCTAL
 \122\312\177\201\376\331\153\323\367\021\355\045\337\370\347\371
 \244\372\162\227\204\123\015\245\320\062\030\121\166\131\024\154
 \017\353\354\137\200\214\165\103\203\303\205\230\377\114\236\055
 \015\344\167\203\223\116\265\226\007\213\050\023\233\214\031\215
 \101\047\111\100\356\336\346\043\104\071\334\241\042\326\272\003
 \362
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "SecureSign RootCA11"
 # Issuer: CN=SecureSign RootCA11,O="Japan Certification Services, Inc.",C=JP
 # Serial Number: 1 (0x1)
 # Subject: CN=SecureSign RootCA11,O="Japan Certification Services, Inc.",C=JP
 # Not Valid Before: Wed Apr 08 04:56:47 2009
 # Not Valid After : Sun Apr 08 04:56:47 2029
 # Fingerprint (MD5): B7:52:74:E2:92:B4:80:93:F2:75:E4:CC:D7:F2:EA:26
@@ -8743,18 +8629,16 @@ CKA_VALUE MULTILINE_OCTAL
 \362\053\361\105\207\345\075\254\321\307\127\204\275\153\256\334
 \330\371\266\033\142\160\013\075\066\311\102\362\062\327\172\141
 \346\322\333\075\317\310\251\311\233\334\333\130\104\327\157\070
 \257\177\170\323\243\255\032\165\272\034\301\066\174\217\036\155
 \034\303\165\106\256\065\005\246\366\134\075\041\356\126\360\311
 \202\042\055\172\124\253\160\303\175\042\145\202\160\226
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Microsec e-Szigno Root CA 2009"
 # Issuer: E=info@e-szigno.hu,CN=Microsec e-Szigno Root CA 2009,O=Microsec Ltd.,L=Budapest,C=HU
 # Serial Number:00:c2:7e:43:04:4e:47:3f:19
 # Subject: E=info@e-szigno.hu,CN=Microsec e-Szigno Root CA 2009,O=Microsec Ltd.,L=Budapest,C=HU
 # Not Valid Before: Tue Jun 16 11:30:18 2009
 # Not Valid After : Sun Dec 30 11:30:18 2029
 # Fingerprint (MD5): F8:49:F4:03:BC:44:2D:83:BE:48:69:7D:29:64:FC:B1
@@ -8877,18 +8761,16 @@ CKA_VALUE MULTILINE_OCTAL
 \016\017\221\176\066\353\303\127\111\276\341\056\055\174\140\213
 \303\101\121\023\043\235\316\367\062\153\224\001\250\231\347\054
 \063\037\072\073\045\322\206\100\316\073\054\206\170\311\141\057
 \024\272\356\333\125\157\337\204\356\005\011\115\275\050\330\162
 \316\323\142\120\145\036\353\222\227\203\061\331\263\265\312\107
 \130\077\137
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "GlobalSign Root CA - R3"
 # Issuer: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3
 # Serial Number:04:00:00:00:00:01:21:58:53:08:a2
 # Subject: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3
 # Not Valid Before: Wed Mar 18 10:00:00 2009
 # Not Valid After : Sun Mar 18 10:00:00 2029
 # Fingerprint (MD5): C5:DF:B8:49:CA:05:13:55:EE:2D:BA:1A:C3:3E:B0:28
@@ -9052,18 +8934,16 @@ CKA_VALUE MULTILINE_OCTAL
 \316\064\140\250\100\361\363\074\244\303\050\043\214\376\047\063
 \103\100\240\027\074\353\352\073\260\162\246\243\271\112\113\136
 \026\110\364\262\274\310\214\222\305\235\237\254\162\066\274\064
 \200\064\153\251\213\222\300\270\027\355\354\166\123\365\044\001
 \214\263\042\350\113\174\125\306\235\372\243\024\273\145\205\156
 \156\117\022\176\012\074\235\225
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
 # Issuer: CN=Autoridad de Certificacion Firmaprofesional CIF A62634068,C=ES
 # Serial Number:53:ec:3b:ee:fb:b2:48:5f
 # Subject: CN=Autoridad de Certificacion Firmaprofesional CIF A62634068,C=ES
 # Not Valid Before: Wed May 20 08:38:15 2009
 # Not Valid After : Tue Dec 31 08:38:15 2030
 # Fingerprint (MD5): 73:3A:74:7A:EC:BB:A3:96:A6:C2:E4:E2:C8:9B:C0:C3
@@ -9223,18 +9103,16 @@ CKA_VALUE MULTILINE_OCTAL
 \235\243\074\114\162\302\127\304\240\324\314\070\047\316\325\006
 \236\242\110\331\351\237\316\202\160\066\223\232\073\337\226\041
 \343\131\267\014\332\221\067\360\375\131\132\263\231\310\151\154
 \103\046\001\065\143\140\125\211\003\072\165\330\272\112\331\124
 \377\356\336\200\330\055\321\070\325\136\055\013\230\175\076\154
 \333\374\046\210\307
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Izenpe.com"
 # Issuer: CN=Izenpe.com,O=IZENPE S.A.,C=ES
 # Serial Number:00:b0:b7:5a:16:48:5f:bf:e1:cb:f5:8b:d7:19:e6:7d
 # Subject: CN=Izenpe.com,O=IZENPE S.A.,C=ES
 # Not Valid Before: Thu Dec 13 13:08:28 2007
 # Not Valid After : Sun Dec 13 08:27:25 2037
 # Fingerprint (MD5): A6:B0:CD:85:80:DA:5C:50:34:A3:39:90:2F:55:67:73
@@ -9430,18 +9308,16 @@ CKA_VALUE MULTILINE_OCTAL
 \320\213\332\273\307\275\030\253\010\157\074\200\153\100\077\031
 \031\272\145\212\346\276\325\134\323\066\327\357\100\122\044\140
 \070\147\004\061\354\217\363\202\306\336\271\125\363\073\061\221
 \132\334\265\010\025\255\166\045\012\015\173\056\207\342\014\246
 \006\274\046\020\155\067\235\354\335\170\214\174\200\305\360\331
 \167\110\320
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Chambers of Commerce Root - 2008"
 # Issuer: CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
 # Serial Number:00:a3:da:42:7e:a4:b1:ae:da
 # Subject: CN=Chambers of Commerce Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
 # Not Valid Before: Fri Aug 01 12:29:50 2008
 # Not Valid After : Sat Jul 31 12:29:50 2038
 # Fingerprint (MD5): 5E:80:9E:84:5A:0E:65:0B:17:02:F3:55:18:2A:3E:D7
@@ -9641,18 +9517,16 @@ CKA_VALUE MULTILINE_OCTAL
 \277\300\222\224\064\033\343\047\267\213\036\157\102\377\347\351
 \067\233\120\035\055\242\371\002\356\313\130\130\072\161\274\150
 \343\252\301\257\034\050\037\242\334\043\145\077\201\352\256\231
 \323\330\060\317\023\015\117\025\311\204\274\247\110\055\370\060
 \043\167\330\106\113\171\155\366\214\355\072\177\140\021\170\364
 \351\233\256\325\124\300\164\200\321\013\102\237\301
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Global Chambersign Root - 2008"
 # Issuer: CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
 # Serial Number:00:c9:cd:d3:e9:d5:7d:23:ce
 # Subject: CN=Global Chambersign Root - 2008,O=AC Camerfirma S.A.,serialNumber=A82743287,L=Madrid (see current address at www.camerfirma.com/address),C=EU
 # Not Valid Before: Fri Aug 01 12:31:40 2008
 # Not Valid After : Sat Jul 31 12:31:40 2038
 # Fingerprint (MD5): 9E:80:FF:78:01:0C:2E:C1:36:BD:FE:96:90:6E:08:F3
@@ -9791,18 +9665,16 @@ CKA_VALUE MULTILINE_OCTAL
 \042\220\070\055\172\215\321\124\361\151\343\137\063\312\172\075
 \173\012\343\312\177\137\071\345\342\165\272\305\166\030\063\316
 \054\360\057\114\255\367\261\347\316\117\250\304\233\112\124\006
 \305\177\175\325\010\017\342\034\376\176\027\270\254\136\366\324
 \026\262\103\011\014\115\366\247\153\264\231\204\145\312\172\210
 \342\342\104\276\134\367\352\034\365
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Go Daddy Root Certificate Authority - G2"
 # Issuer: CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US
 # Serial Number: 0 (0x0)
 # Subject: CN=Go Daddy Root Certificate Authority - G2,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US
 # Not Valid Before: Tue Sep 01 00:00:00 2009
 # Not Valid After : Thu Dec 31 23:59:59 2037
 # Fingerprint (MD5): 80:3A:BC:22:C1:E6:FB:8D:9B:3B:27:4A:32:1B:9A:01
@@ -9943,18 +9815,16 @@ CKA_VALUE MULTILINE_OCTAL
 \244\277\320\227\005\112\274\352\030\050\002\220\275\124\170\011
 \041\161\323\321\175\035\331\026\260\251\141\075\320\012\000\042
 \374\307\173\313\011\144\105\013\073\100\201\367\175\174\062\365
 \230\312\130\216\175\052\356\220\131\163\144\371\066\164\136\045
 \241\365\146\005\056\177\071\025\251\052\373\120\213\216\205\151
 \364
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Starfield Root Certificate Authority - G2"
 # Issuer: CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 # Serial Number: 0 (0x0)
 # Subject: CN=Starfield Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 # Not Valid Before: Tue Sep 01 00:00:00 2009
 # Not Valid After : Thu Dec 31 23:59:59 2037
 # Fingerprint (MD5): D6:39:81:C6:52:7E:96:69:FC:FC:CA:66:ED:05:F2:96
@@ -10097,18 +9967,16 @@ CKA_VALUE MULTILINE_OCTAL
 \215\125\116\251\002\347\107\021\106\076\364\375\275\173\051\046
 \273\251\141\142\067\050\266\055\052\366\020\206\144\311\160\247
 \322\255\267\051\160\171\352\074\332\143\045\237\375\150\267\060
 \354\160\373\165\212\267\155\140\147\262\036\310\271\351\330\250
 \157\002\213\147\015\115\046\127\161\332\040\374\301\112\120\215
 \261\050\272
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Starfield Services Root Certificate Authority - G2"
 # Issuer: CN=Starfield Services Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 # Serial Number: 0 (0x0)
 # Subject: CN=Starfield Services Root Certificate Authority - G2,O="Starfield Technologies, Inc.",L=Scottsdale,ST=Arizona,C=US
 # Not Valid Before: Tue Sep 01 00:00:00 2009
 # Not Valid After : Thu Dec 31 23:59:59 2037
 # Fingerprint (MD5): 17:35:74:AF:7B:61:1C:EB:F4:F9:3C:E2:EE:40:F9:A2
@@ -10230,18 +10098,16 @@ CKA_VALUE MULTILINE_OCTAL
 \333\146\070\251\063\126\110\361\155\033\063\215\015\214\077\140
 \067\235\323\312\155\176\064\176\015\237\162\166\213\033\237\162
 \375\122\065\101\105\002\226\057\034\262\232\163\111\041\261\111
 \107\105\107\264\357\152\064\021\311\115\232\314\131\267\326\002
 \236\132\116\145\265\224\256\033\337\051\260\026\361\277\000\236
 \007\072\027\144\265\004\265\043\041\231\012\225\073\227\174\357
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "AffirmTrust Commercial"
 # Issuer: CN=AffirmTrust Commercial,O=AffirmTrust,C=US
 # Serial Number:77:77:06:27:26:a9:b1:7c
 # Subject: CN=AffirmTrust Commercial,O=AffirmTrust,C=US
 # Not Valid Before: Fri Jan 29 14:06:06 2010
 # Not Valid After : Tue Dec 31 14:06:06 2030
 # Fingerprint (MD5): 82:92:BA:5B:EF:CD:8A:6F:A6:3D:55:F9:84:F6:D6:B7
@@ -10358,18 +10224,16 @@ CKA_VALUE MULTILINE_OCTAL
 \276\303\067\244\272\066\340\174\207\205\227\032\025\242\336\056
 \242\133\275\257\030\371\220\120\315\160\131\370\047\147\107\313
 \307\240\007\072\175\321\054\135\154\031\072\146\265\175\375\221
 \157\202\261\276\010\223\333\024\107\361\242\067\307\105\236\074
 \307\167\257\144\250\223\337\366\151\203\202\140\362\111\102\064
 \355\132\000\124\205\034\026\066\222\014\134\372\246\255\277\333
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "AffirmTrust Networking"
 # Issuer: CN=AffirmTrust Networking,O=AffirmTrust,C=US
 # Serial Number:7c:4f:04:39:1c:d4:99:2d
 # Subject: CN=AffirmTrust Networking,O=AffirmTrust,C=US
 # Not Valid Before: Fri Jan 29 14:08:24 2010
 # Not Valid After : Tue Dec 31 14:08:24 2030
 # Fingerprint (MD5): 42:65:CA:BE:01:9A:9A:4C:A9:8C:41:49:CD:C0:D5:7F
@@ -10518,18 +10382,16 @@ CKA_VALUE MULTILINE_OCTAL
 \151\153\271\341\155\011\364\361\252\120\166\012\172\175\172\027
 \241\125\226\102\231\061\011\335\140\021\215\005\060\176\346\216
 \106\321\235\024\332\307\027\344\005\226\214\304\044\265\033\317
 \024\007\262\100\370\243\236\101\206\274\004\320\153\226\310\052
 \200\064\375\277\357\006\243\335\130\305\205\075\076\217\376\236
 \051\340\266\270\011\150\031\034\030\103
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "AffirmTrust Premium"
 # Issuer: CN=AffirmTrust Premium,O=AffirmTrust,C=US
 # Serial Number:6d:8c:14:46:b1:a6:0a:ee
 # Subject: CN=AffirmTrust Premium,O=AffirmTrust,C=US
 # Not Valid Before: Fri Jan 29 14:10:36 2010
 # Not Valid After : Mon Dec 31 14:10:36 2040
 # Fingerprint (MD5): C4:5D:0E:48:B6:AC:28:30:4E:0A:BC:F9:38:16:87:57
@@ -10626,18 +10488,16 @@ CKA_VALUE MULTILINE_OCTAL
 \152\206\340\304\047\164\344\070\123\327\005\177\033\064\343\306
 \057\263\312\011\074\067\235\327\347\270\106\361\375\241\342\161
 \002\060\102\131\207\103\324\121\337\272\323\011\062\132\316\210
 \176\127\075\234\137\102\153\365\007\055\265\360\202\223\371\131
 \157\256\144\372\130\345\213\036\343\143\276\265\201\315\157\002
 \214\171
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "AffirmTrust Premium ECC"
 # Issuer: CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
 # Serial Number:74:97:25:8a:c7:3f:7a:54
 # Subject: CN=AffirmTrust Premium ECC,O=AffirmTrust,C=US
 # Not Valid Before: Fri Jan 29 14:20:24 2010
 # Not Valid After : Mon Dec 31 14:20:24 2040
 # Fingerprint (MD5): 64:B0:09:55:CF:B1:D5:99:E2:BE:13:AB:A6:5D:EA:4D
@@ -10767,18 +10627,16 @@ CKA_VALUE MULTILINE_OCTAL
 \126\203\163\160\344\206\032\322\061\101\272\057\276\055\023\132
 \166\157\116\350\116\201\016\077\133\003\042\240\022\276\146\130
 \021\112\313\003\304\264\052\052\055\226\027\340\071\124\274\110
 \323\166\047\235\232\055\006\246\311\354\071\322\253\333\237\232
 \013\047\002\065\051\261\100\225\347\371\350\234\125\210\031\106
 \326\267\064\365\176\316\071\232\331\070\361\121\367\117\054
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Certum Trusted Network CA"
 # Issuer: CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 # Serial Number: 279744 (0x444c0)
 # Subject: CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 # Not Valid Before: Wed Oct 22 12:07:37 2008
 # Not Valid After : Mon Dec 31 12:07:37 2029
 # Fingerprint (MD5): D5:E9:81:40:C5:18:69:FC:46:2C:89:75:62:0F:AA:78
@@ -10905,18 +10763,16 @@ CKA_VALUE MULTILINE_OCTAL
 \337\373\155\171\131\362\204\042\122\256\017\314\373\174\073\347
 \152\312\107\141\303\172\370\323\222\004\037\270\040\204\341\066
 \124\026\307\100\336\073\212\163\334\337\306\011\114\337\354\332
 \377\324\123\102\241\311\362\142\035\042\203\074\227\305\371\031
 \142\047\254\145\042\327\323\074\306\345\216\262\123\314\111\316
 \274\060\376\173\016\063\220\373\355\322\024\221\037\007\257
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "TWCA Root Certification Authority"
 # Issuer: CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW
 # Serial Number: 1 (0x1)
 # Subject: CN=TWCA Root Certification Authority,OU=Root CA,O=TAIWAN-CA,C=TW
 # Not Valid Before: Thu Aug 28 07:24:33 2008
 # Not Valid After : Tue Dec 31 15:59:59 2030
 # Fingerprint (MD5): AA:08:8F:F6:F9:7B:B7:F2:B1:A7:1E:9B:EA:EA:BD:79
@@ -11390,18 +11246,16 @@ CKA_VALUE MULTILINE_OCTAL
 \106\022\154\221\356\064\325\354\232\221\347\104\276\220\061\162
 \325\111\002\366\002\345\364\037\353\174\331\226\125\251\377\354
 \212\371\231\107\377\065\132\002\252\004\313\212\133\207\161\051
 \221\275\244\264\172\015\275\232\365\127\043\000\007\041\027\077
 \112\071\321\005\111\013\247\266\067\201\245\135\214\252\063\136
 \201\050\174\247\175\047\353\000\256\215\067
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Security Communication RootCA2"
 # Issuer: OU=Security Communication RootCA2,O="SECOM Trust Systems CO.,LTD.",C=JP
 # Serial Number: 0 (0x0)
 # Subject: OU=Security Communication RootCA2,O="SECOM Trust Systems CO.,LTD.",C=JP
 # Not Valid Before: Fri May 29 05:00:39 2009
 # Not Valid After : Tue May 29 05:00:39 2029
 # Fingerprint (MD5): 6C:39:7D:A4:0E:55:59:B2:3F:D6:41:B1:12:50:DE:43
@@ -11575,18 +11429,16 @@ CKA_VALUE MULTILINE_OCTAL
 \210\277\102\325\053\075\345\371\272\236\056\263\312\364\163\222
 \002\013\276\114\146\353\040\376\271\313\265\231\177\346\266\023
 \372\312\113\115\331\356\123\106\006\073\306\116\255\223\132\201
 \176\154\052\113\152\005\105\214\362\041\244\061\220\207\154\145
 \234\235\245\140\225\072\122\177\365\321\253\010\156\363\356\133
 \371\210\075\176\270\157\156\003\344\102
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "EC-ACC"
 # Issuer: CN=EC-ACC,OU=Jerarquia Entitats de Certificacio Catalanes,OU=Vegeu https://www.catcert.net/verarrel (c)03,OU=Serveis Publics de Certificacio,O=Agencia Catalana de Certificacio (NIF Q-0801176-I),C=ES
 # Serial Number:ee:2b:3d:eb:d4:21:de:14:a8:62:ac:04:f3:dd:c4:01
 # Subject: CN=EC-ACC,OU=Jerarquia Entitats de Certificacio Catalanes,OU=Vegeu https://www.catcert.net/verarrel (c)03,OU=Serveis Publics de Certificacio,O=Agencia Catalana de Certificacio (NIF Q-0801176-I),C=ES
 # Not Valid Before: Tue Jan 07 23:00:00 2003
 # Not Valid After : Tue Jan 07 22:59:59 2031
 # Fingerprint (MD5): EB:F5:9D:29:0D:61:F9:42:1F:7C:C2:BA:6D:E3:15:09
@@ -11740,18 +11592,16 @@ CKA_VALUE MULTILINE_OCTAL
 \002\365\263\011\057\363\114\207\337\052\313\225\174\001\314\254
 \066\172\277\242\163\172\367\217\301\265\232\241\024\262\217\063
 \237\015\357\042\334\146\173\204\275\105\027\006\075\074\312\271
 \167\064\217\312\352\317\077\061\076\343\210\343\200\111\045\310
 \227\265\235\232\231\115\260\074\370\112\000\233\144\335\237\071
 \113\321\047\327\270
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for Certificate "Hellenic Academic and Research Institutions RootCA 2011"
 # Issuer: CN=Hellenic Academic and Research Institutions RootCA 2011,O=Hellenic Academic and Research Institutions Cert. Authority,C=GR
 # Serial Number: 0 (0x0)
 # Subject: CN=Hellenic Academic and Research Institutions RootCA 2011,O=Hellenic Academic and Research Institutions Cert. Authority,C=GR
 # Not Valid Before: Tue Dec 06 13:49:52 2011
 # Not Valid After : Mon Dec 01 13:49:52 2031
 # Fingerprint (MD5): 73:9F:4C:4B:73:5B:79:E9:FA:BA:1C:EF:6E:CB:D5:C9
@@ -11978,18 +11828,16 @@ CKA_VALUE MULTILINE_OCTAL
 \157\005\354\252\166\176\277\153\026\240\353\265\307\374\222\124
 \057\053\021\047\045\067\170\114\121\152\260\363\314\130\135\024
 \361\152\110\025\377\302\007\266\261\215\017\216\134\120\106\263
 \075\277\001\230\117\262\131\124\107\076\064\173\170\155\126\223
 \056\163\352\146\050\170\315\035\024\277\240\217\057\056\270\056
 \216\362\024\212\314\351\265\174\373\154\235\014\245\341\226
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Actalis Authentication Root CA"
 # Issuer: CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT
 # Serial Number:57:0a:11:97:42:c4:e3:cc
 # Subject: CN=Actalis Authentication Root CA,O=Actalis S.p.A./03358520967,L=Milan,C=IT
 # Not Valid Before: Thu Sep 22 11:22:02 2011
 # Not Valid After : Sun Sep 22 11:22:02 2030
 # Fingerprint (MD5): 69:C1:0D:4F:07:A3:1B:C3:FE:56:3D:04:BC:11:F6:A6
@@ -12111,18 +11959,16 @@ CKA_VALUE MULTILINE_OCTAL
 \155\116\054\033\200\147\354\255\040\237\014\142\141\325\227\377
 \103\355\055\301\332\135\051\052\205\077\254\145\356\206\017\005
 \215\220\137\337\356\237\364\277\356\035\373\230\344\177\220\053
 \204\170\020\016\154\111\123\357\025\133\145\106\112\135\257\272
 \373\072\162\035\315\366\045\210\036\227\314\041\234\051\001\015
 \145\353\127\331\363\127\226\273\110\315\201
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Trustis FPS Root CA"
 # Issuer: OU=Trustis FPS Root CA,O=Trustis Limited,C=GB
 # Serial Number:1b:1f:ad:b6:20:f9:24:d3:36:6b:f7:c7:f1:8c:a0:59
 # Subject: OU=Trustis FPS Root CA,O=Trustis Limited,C=GB
 # Not Valid Before: Tue Dec 23 12:14:06 2003
 # Not Valid After : Sun Jan 21 11:36:54 2024
 # Fingerprint (MD5): 30:C9:E7:1E:6B:E6:14:EB:65:B2:16:69:20:31:67:4D
@@ -12273,18 +12119,16 @@ CKA_VALUE MULTILINE_OCTAL
 \336\046\140\034\353\126\121\246\243\352\344\243\077\247\377\141
 \334\361\132\115\154\062\043\103\356\254\250\356\356\112\022\011
 \074\135\161\302\276\171\372\302\207\150\035\013\375\134\151\314
 \006\320\232\175\124\231\052\311\071\032\031\257\113\052\103\363
 \143\135\132\130\342\057\343\035\344\251\326\320\012\320\236\277
 \327\201\011\361\311\307\046\015\254\230\026\126\240
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Buypass Class 2 Root CA"
 # Issuer: CN=Buypass Class 2 Root CA,O=Buypass AS-983163327,C=NO
 # Serial Number: 2 (0x2)
 # Subject: CN=Buypass Class 2 Root CA,O=Buypass AS-983163327,C=NO
 # Not Valid Before: Tue Oct 26 08:38:03 2010
 # Not Valid After : Fri Oct 26 08:38:03 2040
 # Fingerprint (MD5): 46:A7:D2:FE:45:FB:64:5A:A8:59:90:9B:78:44:9B:29
@@ -12434,18 +12278,16 @@ CKA_VALUE MULTILINE_OCTAL
 \151\364\075\025\316\006\245\054\017\076\366\201\272\224\273\303
 \273\277\145\170\322\206\171\377\111\073\032\203\014\360\336\170
 \354\310\362\115\114\032\336\202\051\370\301\132\332\355\356\346
 \047\136\350\105\320\235\034\121\250\150\253\104\343\320\213\152
 \343\370\073\273\334\115\327\144\362\121\276\346\252\253\132\351
 \061\356\006\274\163\277\023\142\012\237\307\271\227
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Buypass Class 3 Root CA"
 # Issuer: CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
 # Serial Number: 2 (0x2)
 # Subject: CN=Buypass Class 3 Root CA,O=Buypass AS-983163327,C=NO
 # Not Valid Before: Tue Oct 26 08:28:58 2010
 # Not Valid After : Fri Oct 26 08:28:58 2040
 # Fingerprint (MD5): 3D:3B:18:9E:2C:64:5A:E8:D5:88:CE:0E:F9:37:C2:EC
@@ -12578,18 +12420,16 @@ CKA_VALUE MULTILINE_OCTAL
 \321\310\042\107\313\314\317\001\061\222\331\030\343\042\276\011
 \036\032\076\132\262\344\153\014\124\172\175\103\116\270\211\245
 \173\327\242\075\226\206\314\362\046\064\055\152\222\235\232\032
 \320\060\342\135\116\004\260\137\213\040\176\167\301\075\225\202
 \321\106\232\073\074\170\270\157\241\320\015\144\242\170\036\051
 \116\223\303\244\124\024\133
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "T-TeleSec GlobalRoot Class 3"
 # Issuer: CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
 # Serial Number: 1 (0x1)
 # Subject: CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
 # Not Valid Before: Wed Oct 01 10:29:56 2008
 # Not Valid After : Sat Oct 01 23:59:59 2033
 # Fingerprint (MD5): CA:FB:40:A8:4E:39:92:8A:1D:FE:8E:2F:C4:27:EA:EF
@@ -12729,18 +12569,16 @@ CKA_VALUE MULTILINE_OCTAL
 \160\254\067\153\346\263\063\162\050\311\263\127\240\366\002\026
 \210\006\013\266\246\113\040\050\324\336\075\213\255\067\005\123
 \164\376\156\314\274\103\027\161\136\371\305\314\032\251\141\356
 \367\166\014\363\162\364\162\255\317\162\002\066\007\107\317\357
 \031\120\211\140\314\351\044\225\017\302\313\035\362\157\166\220
 \307\314\165\301\226\305\235
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "EE Certification Centre Root CA"
 # Issuer: E=pki@sk.ee,CN=EE Certification Centre Root CA,O=AS Sertifitseerimiskeskus,C=EE
 # Serial Number:54:80:f9:a0:73:ed:3f:00:4c:ca:89:d8:e3:71:e6:4a
 # Subject: E=pki@sk.ee,CN=EE Certification Centre Root CA,O=AS Sertifitseerimiskeskus,C=EE
 # Not Valid Before: Sat Oct 30 10:10:30 2010
 # Not Valid After : Tue Dec 17 23:59:59 2030
 # Fingerprint (MD5): 43:5E:88:D4:7D:1A:4A:7E:FD:84:2E:52:EB:01:D4:6F
@@ -12944,18 +12782,16 @@ CKA_VALUE MULTILINE_OCTAL
 \163\354\144\124\120\155\321\234\125\373\151\303\066\303\214\274
 \074\205\246\153\012\046\015\340\223\230\140\256\176\306\044\227
 \212\141\137\221\216\146\222\011\207\066\315\213\233\055\076\366
 \121\324\120\324\131\050\275\203\362\314\050\173\123\206\155\330
 \046\210\160\327\352\221\315\076\271\312\300\220\156\132\306\136
 \164\145\327\134\376\243\342
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "D-TRUST Root Class 3 CA 2 2009"
 # Issuer: CN=D-TRUST Root Class 3 CA 2 2009,O=D-Trust GmbH,C=DE
 # Serial Number: 623603 (0x983f3)
 # Subject: CN=D-TRUST Root Class 3 CA 2 2009,O=D-Trust GmbH,C=DE
 # Not Valid Before: Thu Nov 05 08:35:58 2009
 # Not Valid After : Mon Nov 05 08:35:58 2029
 # Fingerprint (MD5): CD:E0:25:69:8D:47:AC:9C:89:35:90:F7:FD:51:3D:2F
@@ -13090,18 +12926,16 @@ CKA_VALUE MULTILINE_OCTAL
 \306\227\206\320\202\303\344\102\155\376\260\342\144\116\016\046
 \347\100\064\046\265\010\211\327\010\143\143\070\047\165\036\063
 \352\156\250\335\237\231\117\164\115\201\211\200\113\335\232\227
 \051\134\057\276\201\101\271\214\377\352\175\140\006\236\315\327
 \075\323\056\243\025\274\250\346\046\345\157\303\334\270\003\041
 \352\237\026\361\054\124\265
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "D-TRUST Root Class 3 CA 2 EV 2009"
 # Issuer: CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
 # Serial Number: 623604 (0x983f4)
 # Subject: CN=D-TRUST Root Class 3 CA 2 EV 2009,O=D-Trust GmbH,C=DE
 # Not Valid Before: Thu Nov 05 08:50:46 2009
 # Not Valid After : Mon Nov 05 08:50:46 2029
 # Fingerprint (MD5): AA:C6:43:2C:5E:2D:CD:C4:34:C0:50:4F:11:02:4F:B6
@@ -13255,18 +13089,16 @@ CKA_VALUE MULTILINE_OCTAL
 \314\303\245\351\157\012\216\233\145\302\120\205\265\243\240\123
 \022\314\125\207\141\363\201\256\020\106\141\275\104\041\270\302
 \075\164\317\176\044\065\372\034\007\016\233\075\042\312\357\061
 \057\214\254\022\275\357\100\050\374\051\147\237\262\023\117\146
 \044\304\123\031\351\036\051\025\357\346\155\260\177\055\147\375
 \363\154\033\165\106\243\345\112\027\351\244\327\013
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "CA Disig Root R2"
 # Issuer: CN=CA Disig Root R2,O=Disig a.s.,L=Bratislava,C=SK
 # Serial Number:00:92:b8:88:db:b0:8a:c1:63
 # Subject: CN=CA Disig Root R2,O=Disig a.s.,L=Bratislava,C=SK
 # Not Valid Before: Thu Jul 19 09:15:30 2012
 # Not Valid After : Sat Jul 19 09:15:30 2042
 # Fingerprint (MD5): 26:01:FB:D8:27:A7:17:9A:45:54:38:1A:43:01:3B:03
@@ -13457,18 +13289,16 @@ CKA_VALUE MULTILINE_OCTAL
 \167\177\230\047\232\062\135\052\343\204\356\305\230\146\057\226
 \040\035\335\330\303\047\327\260\371\376\331\175\315\320\237\217
 \013\024\130\121\237\057\213\303\070\055\336\350\217\326\215\207
 \244\365\126\103\026\231\054\364\244\126\264\064\270\141\067\311
 \302\130\200\033\240\227\241\374\131\215\351\021\366\321\017\113
 \125\064\106\052\213\206\073
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "ACCVRAIZ1"
 # Issuer: C=ES,O=ACCV,OU=PKIACCV,CN=ACCVRAIZ1
 # Serial Number:5e:c3:b7:a6:43:7f:a4:e0
 # Subject: C=ES,O=ACCV,OU=PKIACCV,CN=ACCVRAIZ1
 # Not Valid Before: Thu May 05 09:37:37 2011
 # Not Valid After : Tue Dec 31 09:37:37 2030
 # Fingerprint (MD5): D0:A0:5A:EE:05:B6:09:94:21:A1:7D:F1:B2:29:82:02
@@ -13619,18 +13449,16 @@ CKA_VALUE MULTILINE_OCTAL
 \225\040\256\043\202\304\263\072\000\142\277\346\066\044\341\127
 \272\307\036\220\165\325\137\077\225\141\053\301\073\315\345\263
 \150\141\320\106\046\251\041\122\151\055\353\056\307\353\167\316
 \246\072\265\003\063\117\166\321\347\134\124\001\135\313\170\364
 \311\014\277\317\022\216\027\055\043\150\224\347\253\376\251\262
 \053\006\320\004\315
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "TWCA Global Root CA"
 # Issuer: CN=TWCA Global Root CA,OU=Root CA,O=TAIWAN-CA,C=TW
 # Serial Number: 3262 (0xcbe)
 # Subject: CN=TWCA Global Root CA,OU=Root CA,O=TAIWAN-CA,C=TW
 # Not Valid Before: Wed Jun 27 06:28:33 2012
 # Not Valid After : Tue Dec 31 15:59:59 2030
 # Fingerprint (MD5): F9:03:7E:CF:E6:9E:3C:73:7A:2A:90:07:69:FF:2B:96
@@ -13778,18 +13606,16 @@ CKA_VALUE MULTILINE_OCTAL
 \034\277\304\126\123\372\143\145\320\363\034\016\026\365\153\206
 \130\115\030\324\344\015\216\245\235\133\221\334\166\044\120\077
 \306\052\373\331\267\234\265\326\346\320\331\350\031\213\025\161
 \110\255\267\352\330\131\210\324\220\277\026\263\331\351\254\131
 \141\124\310\034\272\312\301\312\341\271\040\114\217\072\223\211
 \245\240\314\277\323\366\165\244\165\226\155\126
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "TeliaSonera Root CA v1"
 # Issuer: CN=TeliaSonera Root CA v1,O=TeliaSonera
 # Serial Number:00:95:be:16:a0:f7:2e:46:f1:7b:39:82:72:fa:8b:cd:96
 # Subject: CN=TeliaSonera Root CA v1,O=TeliaSonera
 # Not Valid Before: Thu Oct 18 12:00:50 2007
 # Not Valid After : Mon Oct 18 12:00:50 2032
 # Fingerprint (MD5): 37:41:49:1B:18:56:9A:26:F5:AD:C2:66:FB:40:A5:4C
@@ -13968,18 +13794,16 @@ CKA_VALUE MULTILINE_OCTAL
 \264\330\362\160\117\237\062\023\343\260\247\127\345\332\332\103
 \313\204\064\362\050\304\352\155\364\052\357\301\153\166\332\373
 \176\273\205\074\322\123\302\115\276\161\341\105\321\375\043\147
 \015\023\165\373\317\145\147\042\235\256\260\011\321\011\377\035
 \064\277\376\043\227\067\322\071\372\075\015\006\013\264\333\073
 \243\253\157\134\035\266\176\350\263\202\064\355\006\134\044
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "E-Tugra Certification Authority"
 # Issuer: CN=E-Tugra Certification Authority,OU=E-Tugra Sertifikasyon Merkezi,O=E-Tu..ra EBG Bili..im Teknolojileri ve Hizmetleri A....,L=Ankara,C=TR
 # Serial Number:6a:68:3e:9c:51:9b:cb:53
 # Subject: CN=E-Tugra Certification Authority,OU=E-Tugra Sertifikasyon Merkezi,O=E-Tu..ra EBG Bili..im Teknolojileri ve Hizmetleri A....,L=Ankara,C=TR
 # Not Valid Before: Tue Mar 05 12:09:48 2013
 # Not Valid After : Fri Mar 03 12:09:48 2023
 # Fingerprint (MD5): B8:A1:03:63:B0:BD:21:71:70:8A:6F:13:3A:BB:79:49
@@ -14119,18 +13943,16 @@ CKA_VALUE MULTILINE_OCTAL
 \057\076\170\205\142\156\311\137\301\170\143\164\130\300\110\030
 \014\231\071\353\244\314\032\265\171\132\215\025\234\330\024\015
 \366\172\007\127\307\042\203\005\055\074\233\045\046\075\030\263
 \251\103\174\310\310\253\144\217\016\243\277\234\033\235\060\333
 \332\320\031\056\252\074\361\373\063\200\166\344\315\255\031\117
 \005\047\216\023\241\156\302
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "T-TeleSec GlobalRoot Class 2"
 # Issuer: CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
 # Serial Number: 1 (0x1)
 # Subject: CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE
 # Not Valid Before: Wed Oct 01 10:40:14 2008
 # Not Valid After : Sat Oct 01 23:59:59 2033
 # Fingerprint (MD5): 2B:9B:9E:E4:7B:6C:1F:00:72:1A:CC:C1:77:79:DF:6A
@@ -14252,18 +14074,16 @@ CKA_VALUE MULTILINE_OCTAL
 \247\360\126\042\251\074\145\124\306\025\250\275\206\236\315\203
 \226\150\172\161\201\211\341\013\341\352\021\033\150\010\314\151
 \236\354\236\101\236\104\062\046\172\342\207\012\161\075\353\344
 \132\244\322\333\305\315\306\336\140\177\271\363\117\104\222\357
 \052\267\030\076\247\031\331\013\175\261\067\101\102\260\272\140
 \035\362\376\011\021\260\360\207\173\247\235
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Atos TrustedRoot 2011"
 # Issuer: C=DE,O=Atos,CN=Atos TrustedRoot 2011
 # Serial Number:5c:33:cb:62:2c:5f:b3:32
 # Subject: C=DE,O=Atos,CN=Atos TrustedRoot 2011
 # Not Valid Before: Thu Jul 07 14:58:30 2011
 # Not Valid After : Tue Dec 31 23:59:59 2030
 # Fingerprint (MD5): AE:B9:C4:32:4B:AC:7F:5D:66:CC:77:94:BB:2A:77:56
@@ -14414,18 +14234,16 @@ CKA_VALUE MULTILINE_OCTAL
 \253\136\072\354\174\151\274\307\073\205\116\236\025\271\264\025
 \117\303\225\172\130\327\311\154\351\154\271\363\051\143\136\264
 \054\360\055\075\355\132\145\340\251\133\100\302\110\231\201\155
 \236\037\006\052\074\022\264\213\017\233\242\044\360\246\215\326
 \172\340\113\266\144\226\143\225\204\302\112\315\034\056\044\207
 \063\140\345\303
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "QuoVadis Root CA 1 G3"
 # Issuer: CN=QuoVadis Root CA 1 G3,O=QuoVadis Limited,C=BM
 # Serial Number:78:58:5f:2e:ad:2c:19:4b:e3:37:07:35:34:13:28:b5:96:d4:65:93
 # Subject: CN=QuoVadis Root CA 1 G3,O=QuoVadis Limited,C=BM
 # Not Valid Before: Thu Jan 12 17:27:44 2012
 # Not Valid After : Sun Jan 12 17:27:44 2042
 # Fingerprint (SHA-256): 8A:86:6F:D1:B2:76:B5:7E:57:8E:92:1C:65:82:8A:2B:ED:58:E9:F2:F2:88:05:41:34:B7:F1:F4:BF:C9:CC:74
@@ -14578,18 +14396,16 @@ CKA_VALUE MULTILINE_OCTAL
 \035\123\262\116\205\173\006\070\307\054\370\370\260\162\215\045
 \345\167\122\364\003\034\110\246\120\137\210\040\060\156\362\202
 \103\253\075\227\204\347\123\373\041\301\117\017\042\232\206\270
 \131\052\366\107\075\031\210\055\350\205\341\236\354\205\010\152
 \261\154\064\311\035\354\110\053\073\170\355\146\304\216\171\151
 \203\336\177\214
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "QuoVadis Root CA 2 G3"
 # Issuer: CN=QuoVadis Root CA 2 G3,O=QuoVadis Limited,C=BM
 # Serial Number:44:57:34:24:5b:81:89:9b:35:f2:ce:b8:2b:3b:5b:a7:26:f0:75:28
 # Subject: CN=QuoVadis Root CA 2 G3,O=QuoVadis Limited,C=BM
 # Not Valid Before: Thu Jan 12 18:59:32 2012
 # Not Valid After : Sun Jan 12 18:59:32 2042
 # Fingerprint (SHA-256): 8F:E4:FB:0A:F9:3A:4D:0D:67:DB:0B:EB:B2:3E:37:C7:1B:F3:25:DC:BC:DD:24:0E:A0:4D:AF:58:B4:7E:18:40
@@ -14742,18 +14558,16 @@ CKA_VALUE MULTILINE_OCTAL
 \076\132\051\064\271\075\204\316\261\145\324\131\221\221\126\165
 \041\301\167\236\371\172\341\140\235\323\255\004\030\364\174\353
 \136\223\217\123\112\042\051\370\110\053\076\115\206\254\133\177
 \313\006\231\131\140\330\130\145\225\215\104\321\367\177\176\047
 \177\175\256\200\365\007\114\266\076\234\161\124\231\004\113\375
 \130\371\230\364
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "QuoVadis Root CA 3 G3"
 # Issuer: CN=QuoVadis Root CA 3 G3,O=QuoVadis Limited,C=BM
 # Serial Number:2e:f5:9b:02:28:a7:db:7a:ff:d5:a3:a9:ee:bd:03:a0:cf:12:6a:1d
 # Subject: CN=QuoVadis Root CA 3 G3,O=QuoVadis Limited,C=BM
 # Not Valid Before: Thu Jan 12 20:26:32 2012
 # Not Valid After : Sun Jan 12 20:26:32 2042
 # Fingerprint (SHA-256): 88:EF:81:DE:20:2E:B0:18:45:2E:43:F8:64:72:5C:EA:5F:BD:1F:C2:D9:D2:05:73:07:09:C5:D8:B8:69:0F:46
@@ -14881,18 +14695,16 @@ CKA_VALUE MULTILINE_OCTAL
 \304\143\276\255\364\024\373\211\354\242\101\016\114\314\310\127
 \100\320\156\003\252\315\014\216\211\231\231\154\360\074\060\257
 \070\337\157\274\243\276\051\040\047\253\164\377\023\042\170\336
 \227\122\125\036\203\265\124\040\003\356\256\300\117\126\336\067
 \314\303\177\252\004\047\273\323\167\270\142\333\027\174\234\050
 \042\023\163\154\317\046\365\212\051\347
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "DigiCert Assured ID Root G2"
 # Issuer: CN=DigiCert Assured ID Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Serial Number:0b:93:1c:3a:d6:39:67:ea:67:23:bf:c3:af:9a:f4:4b
 # Subject: CN=DigiCert Assured ID Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Not Valid Before: Thu Aug 01 12:00:00 2013
 # Not Valid After : Fri Jan 15 12:00:00 2038
 # Fingerprint (SHA-256): 7D:05:EB:B6:82:33:9F:8C:94:51:EE:09:4E:EB:FE:FA:79:53:A1:14:ED:B2:F4:49:49:45:2F:AB:7D:2F:C1:85
@@ -15001,18 +14813,16 @@ CKA_VALUE MULTILINE_OCTAL
 \165\164\117\310\043\343\160\362\165\162\336\174\211\360\317\221
 \162\141\236\136\020\222\131\126\271\203\307\020\347\070\351\130
 \046\066\175\325\344\064\206\071\002\060\174\066\123\360\060\345
 \142\143\072\231\342\266\243\073\233\064\372\036\332\020\222\161
 \136\221\023\247\335\244\156\222\314\062\326\365\041\146\307\057
 \352\226\143\152\145\105\222\225\001\264
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "DigiCert Assured ID Root G3"
 # Issuer: CN=DigiCert Assured ID Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Serial Number:0b:a1:5a:fa:1d:df:a0:b5:49:44:af:cd:24:a0:6c:ec
 # Subject: CN=DigiCert Assured ID Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Not Valid Before: Thu Aug 01 12:00:00 2013
 # Not Valid After : Fri Jan 15 12:00:00 2038
 # Fingerprint (SHA-256): 7E:37:CB:8B:4C:47:09:0C:AB:36:55:1B:A6:F4:5D:B8:40:68:0F:BA:16:6A:95:2D:B1:00:71:7F:43:05:3F:C2
@@ -15142,18 +14952,16 @@ CKA_VALUE MULTILINE_OCTAL
 \040\125\327\363\024\105\345\340\104\364\352\207\225\062\223\016
 \376\123\106\372\054\235\377\213\042\271\113\331\011\105\244\336
 \244\270\232\130\335\033\175\122\237\216\131\103\210\201\244\236
 \046\325\157\255\335\015\306\067\175\355\003\222\033\345\167\137
 \166\356\074\215\304\135\126\133\242\331\146\156\263\065\067\345
 \062\266
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "DigiCert Global Root G2"
 # Issuer: CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Serial Number:03:3a:f1:e6:a7:11:a9:a0:bb:28:64:b1:1d:09:fa:e5
 # Subject: CN=DigiCert Global Root G2,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Not Valid Before: Thu Aug 01 12:00:00 2013
 # Not Valid After : Fri Jan 15 12:00:00 2038
 # Fingerprint (SHA-256): CB:3C:CB:B7:60:31:E5:E0:13:8F:8D:D3:9A:23:F9:DE:47:FF:C3:5E:43:C1:14:4C:EA:27:D4:6A:5A:B1:CB:5F
@@ -15262,18 +15070,16 @@ CKA_VALUE MULTILINE_OCTAL
 \364\210\066\214\210\047\273\346\210\215\120\205\247\143\371\236
 \062\336\146\223\017\361\314\261\011\217\335\154\253\372\153\177
 \240\002\060\071\146\133\302\144\215\270\236\120\334\250\325\111
 \242\355\307\334\321\111\177\027\001\270\310\206\217\116\214\210
 \053\250\232\251\212\305\321\000\275\370\124\342\232\345\133\174
 \263\047\027
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "DigiCert Global Root G3"
 # Issuer: CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Serial Number:05:55:56:bc:f2:5e:a4:35:35:c3:a4:0f:d5:ab:45:72
 # Subject: CN=DigiCert Global Root G3,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Not Valid Before: Thu Aug 01 12:00:00 2013
 # Not Valid After : Fri Jan 15 12:00:00 2038
 # Fingerprint (SHA-256): 31:AD:66:48:F8:10:41:38:C7:38:F3:9E:A4:32:01:33:39:3E:3A:18:CC:02:29:6E:F9:7C:2A:C9:EF:67:31:D0
@@ -15435,18 +15241,16 @@ CKA_VALUE MULTILINE_OCTAL
 \375\211\135\274\205\142\035\062\322\240\053\124\355\232\127\301
 \333\372\020\317\031\267\213\112\033\217\001\266\047\225\123\350
 \266\211\155\133\274\150\324\043\350\213\121\242\126\371\360\246
 \200\240\326\036\263\274\017\017\123\165\051\252\352\023\167\344
 \336\214\201\041\255\007\020\107\021\255\207\075\007\321\165\274
 \317\363\146\176
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "DigiCert Trusted Root G4"
 # Issuer: CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Serial Number:05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
 # Subject: CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
 # Not Valid Before: Thu Aug 01 12:00:00 2013
 # Not Valid After : Fri Jan 15 12:00:00 2038
 # Fingerprint (SHA-256): 55:2F:7B:DC:F1:A7:AF:9E:6C:E6:72:01:7F:4F:12:AB:F7:72:40:C7:8E:76:1A:C2:03:D1:D9:D2:0A:C8:99:88
@@ -15616,18 +15420,16 @@ CKA_VALUE MULTILINE_OCTAL
 \274\214\357\027\337\267\111\013\321\362\156\060\013\032\016\116
 \166\355\021\374\365\351\126\262\175\277\307\155\012\223\214\245
 \320\300\266\035\276\072\116\224\242\327\156\154\013\302\212\174
 \372\040\363\304\344\345\315\015\250\313\221\222\261\174\205\354
 \265\024\151\146\016\202\347\315\316\310\055\246\121\177\041\301
 \065\123\205\006\112\135\237\255\273\033\137\164
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "COMODO RSA Certification Authority"
 # Issuer: CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 # Serial Number:4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
 # Subject: CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
 # Not Valid Before: Tue Jan 19 00:00:00 2010
 # Not Valid After : Mon Jan 18 23:59:59 2038
 # Fingerprint (SHA-256): 52:F0:E1:C4:E5:8E:C6:29:29:1B:60:31:7F:07:46:71:B8:5D:7E:A8:0D:5B:07:27:34:63:53:4B:32:B4:02:34
@@ -15800,18 +15602,16 @@ CKA_VALUE MULTILINE_OCTAL
 \260\260\013\340\234\114\303\034\326\374\343\151\265\107\106\201
 \057\242\202\253\323\143\104\160\304\215\377\055\063\272\255\217
 \173\265\160\210\256\076\031\317\100\050\330\374\310\220\273\135
 \231\042\365\122\346\130\305\037\210\061\103\356\210\035\327\306
 \216\074\103\152\035\247\030\336\175\075\026\361\142\371\312\220
 \250\375
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "USERTrust RSA Certification Authority"
 # Issuer: CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
 # Serial Number:01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
 # Subject: CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
 # Not Valid Before: Mon Feb 01 00:00:00 2010
 # Not Valid After : Mon Jan 18 23:59:59 2038
 # Fingerprint (SHA-256): E7:93:C9:B0:2F:D8:AA:13:E2:1C:31:22:8A:CC:B0:81:19:64:3B:74:9C:89:89:64:B1:74:6D:46:C3:D4:CB:D2
@@ -15931,18 +15731,16 @@ CKA_VALUE MULTILINE_OCTAL
 \317\073\252\102\021\144\240\235\224\071\002\021\171\134\173\035
 \372\144\271\356\026\102\263\277\212\302\011\304\354\344\261\115
 \002\061\000\351\052\141\107\214\122\112\113\116\030\160\366\326
 \104\326\156\365\203\272\155\130\275\044\331\126\110\352\357\304
 \242\106\201\210\152\072\106\321\251\233\115\311\141\332\321\135
 \127\152\030
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "USERTrust ECC Certification Authority"
 # Issuer: CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
 # Serial Number:5c:8b:99:c5:5a:94:c5:d2:71:56:de:cd:89:80:cc:26
 # Subject: CN=USERTrust ECC Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
 # Not Valid Before: Mon Feb 01 00:00:00 2010
 # Not Valid After : Mon Jan 18 23:59:59 2038
 # Fingerprint (SHA-256): 4F:F4:60:D5:4B:9C:86:DA:BF:BC:FC:57:12:E0:40:0D:2B:ED:3F:BC:4D:4F:BD:AA:86:E0:6A:DC:D2:A9:AD:7A
@@ -16045,18 +15843,16 @@ CKA_VALUE MULTILINE_OCTAL
 \012\006\010\052\206\110\316\075\004\003\002\003\110\000\060\105
 \002\041\000\334\222\241\240\023\246\317\003\260\346\304\041\227
 \220\372\024\127\055\003\354\356\074\323\156\312\250\154\166\274
 \242\336\273\002\040\047\250\205\047\065\233\126\306\243\362\107
 \322\267\156\033\002\000\027\252\147\246\025\221\336\372\224\354
 \173\013\370\237\204
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "GlobalSign ECC Root CA - R4"
 # Issuer: CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R4
 # Serial Number:2a:38:a4:1c:96:0a:04:de:42:b2:28:a5:0b:e8:34:98:02
 # Subject: CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R4
 # Not Valid Before: Tue Nov 13 00:00:00 2012
 # Not Valid After : Tue Jan 19 03:14:07 2038
 # Fingerprint (SHA-256): BE:C9:49:11:C2:95:56:76:DB:6C:0A:55:09:86:D7:6E:3B:A0:05:66:7C:44:2C:97:62:B4:FB:B7:73:DE:22:8C
@@ -16160,18 +15956,16 @@ CKA_VALUE MULTILINE_OCTAL
 \232\342\175\022\311\355\174\144\323\313\005\045\213\126\331\240
 \347\136\135\116\013\203\234\133\166\051\240\011\046\041\152\142
 \002\060\161\322\265\217\134\352\073\341\170\011\205\250\165\222
 \073\310\134\375\110\357\015\164\042\250\010\342\156\305\111\316
 \307\014\274\247\141\151\361\367\073\341\052\313\371\053\363\146
 \220\067
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "GlobalSign ECC Root CA - R5"
 # Issuer: CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R5
 # Serial Number:60:59:49:e0:26:2e:bb:55:f9:0a:77:8a:71:f9:4a:d8:6c
 # Subject: CN=GlobalSign,O=GlobalSign,OU=GlobalSign ECC Root CA - R5
 # Not Valid Before: Tue Nov 13 00:00:00 2012
 # Not Valid After : Tue Jan 19 03:14:07 2038
 # Fingerprint (SHA-256): 17:9F:BC:14:8A:3D:D0:0F:D2:4E:A1:34:58:CC:43:BF:A7:F5:9C:81:82:D7:83:A5:13:F6:EB:EC:10:0C:89:24
@@ -16327,18 +16121,16 @@ CKA_VALUE MULTILINE_OCTAL
 \157\140\221\244\202\205\133\126\101\274\320\104\253\152\023\276
 \321\054\130\267\022\063\130\262\067\143\334\023\365\224\035\077
 \100\121\365\117\365\072\355\310\305\353\302\036\035\026\225\172
 \307\176\102\161\223\156\113\025\267\060\337\252\355\127\205\110
 \254\035\152\335\071\151\344\341\171\170\276\316\005\277\241\014
 \367\200\173\041\147\047\060\131
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Staat der Nederlanden Root CA - G3"
 # Issuer: CN=Staat der Nederlanden Root CA - G3,O=Staat der Nederlanden,C=NL
 # Serial Number: 10003001 (0x98a239)
 # Subject: CN=Staat der Nederlanden Root CA - G3,O=Staat der Nederlanden,C=NL
 # Not Valid Before: Thu Nov 14 11:28:42 2013
 # Not Valid After : Mon Nov 13 23:00:00 2028
 # Fingerprint (SHA-256): 3C:4F:B0:B9:5A:B8:B3:00:32:F4:32:B8:6F:53:5F:E1:72:C1:85:D0:FD:39:86:58:37:CF:36:18:7F:A6:F4:28
@@ -16493,18 +16285,16 @@ CKA_VALUE MULTILINE_OCTAL
 \040\055\206\016\365\322\333\322\172\212\113\315\245\350\116\361
 \136\046\045\001\131\043\240\176\322\366\176\041\127\327\047\274
 \025\127\114\244\106\301\340\203\036\014\114\115\037\117\006\031
 \342\371\250\364\072\202\241\262\171\103\171\326\255\157\172\047
 \220\003\244\352\044\207\077\331\275\331\351\362\137\120\111\034
 \356\354\327\056
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Staat der Nederlanden EV Root CA"
 # Issuer: CN=Staat der Nederlanden EV Root CA,O=Staat der Nederlanden,C=NL
 # Serial Number: 10000013 (0x98968d)
 # Subject: CN=Staat der Nederlanden EV Root CA,O=Staat der Nederlanden,C=NL
 # Not Valid Before: Wed Dec 08 11:19:29 2010
 # Not Valid After : Thu Dec 08 11:10:28 2022
 # Fingerprint (SHA-256): 4D:24:91:41:4C:FE:95:67:46:EC:4C:EF:A6:CF:6F:72:E2:8A:13:29:43:2F:9D:8A:90:7A:C4:CB:5D:AD:C1:5A
@@ -16657,18 +16447,16 @@ CKA_VALUE MULTILINE_OCTAL
 \231\111\116\370\245\200\333\045\017\034\143\142\212\311\063\147
 \153\074\020\203\306\255\336\250\315\026\216\215\360\007\067\161
 \237\362\253\374\101\365\301\213\354\000\067\135\011\345\116\200
 \357\372\261\134\070\006\245\033\112\341\334\070\055\074\334\253
 \037\220\032\325\112\234\356\321\160\154\314\356\364\127\370\030
 \272\204\156\207
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "IdenTrust Commercial Root CA 1"
 # Issuer: CN=IdenTrust Commercial Root CA 1,O=IdenTrust,C=US
 # Serial Number:0a:01:42:80:00:00:01:45:23:c8:44:b5:00:00:00:02
 # Subject: CN=IdenTrust Commercial Root CA 1,O=IdenTrust,C=US
 # Not Valid Before: Thu Jan 16 18:12:23 2014
 # Not Valid After : Mon Jan 16 18:12:23 2034
 # Fingerprint (SHA-256): 5D:56:49:9B:E4:D2:E0:8B:CF:CA:D0:8A:3E:38:72:3D:50:50:3B:DE:70:69:48:E4:2F:55:60:30:19:E5:28:AE
@@ -16821,18 +16609,16 @@ CKA_VALUE MULTILINE_OCTAL
 \031\244\035\247\371\113\103\067\334\150\132\117\317\353\302\144
 \164\336\264\025\331\364\124\124\032\057\034\327\227\161\124\220
 \216\331\040\235\123\053\177\253\217\342\352\060\274\120\067\357
 \361\107\265\175\174\054\004\354\150\235\264\111\104\020\364\162
 \113\034\144\347\374\346\153\220\335\151\175\151\375\000\126\245
 \267\254\266\255\267\312\076\001\357\234
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "IdenTrust Public Sector Root CA 1"
 # Issuer: CN=IdenTrust Public Sector Root CA 1,O=IdenTrust,C=US
 # Serial Number:0a:01:42:80:00:00:01:45:23:cf:46:7c:00:00:00:02
 # Subject: CN=IdenTrust Public Sector Root CA 1,O=IdenTrust,C=US
 # Not Valid Before: Thu Jan 16 17:53:32 2014
 # Not Valid After : Mon Jan 16 17:53:32 2034
 # Fingerprint (SHA-256): 30:D0:89:5A:9A:44:8A:26:20:91:63:55:22:D1:F5:20:10:B5:86:7A:CA:E1:2C:78:EF:95:8F:D4:F4:38:9F:2F
@@ -16982,18 +16768,16 @@ CKA_VALUE MULTILINE_OCTAL
 \234\013\244\235\232\041\363\360\233\013\060\170\333\301\334\207
 \103\376\274\143\232\312\305\302\034\311\307\215\377\073\022\130
 \010\346\266\075\354\172\054\116\373\203\226\316\014\074\151\207
 \124\163\244\163\302\223\377\121\020\254\025\124\001\330\374\005
 \261\211\241\177\164\203\232\111\327\334\116\173\212\110\157\213
 \105\366
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Entrust Root Certification Authority - G2"
 # Issuer: CN=Entrust Root Certification Authority - G2,OU="(c) 2009 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 # Serial Number: 1246989352 (0x4a538c28)
 # Subject: CN=Entrust Root Certification Authority - G2,OU="(c) 2009 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 # Not Valid Before: Tue Jul 07 17:25:54 2009
 # Not Valid After : Sat Dec 07 17:55:54 2030
 # Fingerprint (SHA-256): 43:DF:57:74:B0:3E:7F:EF:5F:E4:0D:93:1A:7B:ED:F1:BB:2E:6B:42:73:8C:4E:6D:38:41:10:3D:3A:A7:F3:39
@@ -17129,18 +16913,16 @@ CKA_VALUE MULTILINE_OCTAL
 \107\337\034\256\123\231\027\266\157\034\175\341\277\021\224\321
 \003\210\165\344\215\211\244\212\167\106\336\155\141\357\002\365
 \373\265\337\314\376\116\377\376\251\346\247\002\060\133\231\327
 \205\067\006\265\173\010\375\353\047\213\112\224\371\341\372\247
 \216\046\010\350\174\222\150\155\163\330\157\046\254\041\002\270
 \231\267\046\101\133\045\140\256\320\110\032\356\006
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Entrust Root Certification Authority - EC1"
 # Issuer: CN=Entrust Root Certification Authority - EC1,OU="(c) 2012 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 # Serial Number:00:a6:8b:79:29:00:00:00:00:50:d0:91:f9
 # Subject: CN=Entrust Root Certification Authority - EC1,OU="(c) 2012 Entrust, Inc. - for authorized use only",OU=See www.entrust.net/legal-terms,O="Entrust, Inc.",C=US
 # Not Valid Before: Tue Dec 18 15:25:36 2012
 # Not Valid After : Fri Dec 18 15:55:36 2037
 # Fingerprint (SHA-256): 02:ED:0E:B2:8C:14:DA:45:16:5C:56:67:91:70:0D:64:51:D7:FB:56:F0:B2:AB:1D:3B:8E:B0:70:E5:6E:DF:F5
@@ -17304,18 +17086,16 @@ CKA_VALUE MULTILINE_OCTAL
 \000\012\000\013\021\225\332\126\105\003\210\012\237\147\320\325
 \171\261\250\215\100\155\015\302\172\100\372\363\137\144\107\222
 \313\123\271\273\131\316\117\375\320\025\123\001\330\337\353\331
 \346\166\357\320\043\273\073\251\171\263\325\002\051\315\211\243
 \226\017\112\065\347\116\102\300\165\315\007\317\346\054\353\173
 \056
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "CFCA EV ROOT"
 # Issuer: CN=CFCA EV ROOT,O=China Financial Certification Authority,C=CN
 # Serial Number: 407555286 (0x184accd6)
 # Subject: CN=CFCA EV ROOT,O=China Financial Certification Authority,C=CN
 # Not Valid Before: Wed Aug 08 03:07:01 2012
 # Not Valid After : Mon Dec 31 03:07:01 2029
 # Fingerprint (SHA-256): 5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD
@@ -17445,18 +17225,16 @@ CKA_VALUE MULTILINE_OCTAL
 \150\361\145\115\316\174\005\337\123\145\251\245\360\261\227\004
 \160\025\106\003\230\324\322\277\124\264\240\130\175\122\157\332
 \126\046\142\324\330\333\211\061\157\034\360\042\302\323\142\034
 \065\315\114\151\025\124\032\220\230\336\353\036\137\312\167\307
 \313\216\075\103\151\234\232\130\320\044\073\337\033\100\226\176
 \065\255\201\307\116\161\272\210\023
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "OISTE WISeKey Global Root GB CA"
 # Issuer: CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
 # Serial Number:76:b1:20:52:74:f0:85:87:46:b3:f8:23:1a:f6:c2:c0
 # Subject: CN=OISTE WISeKey Global Root GB CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
 # Not Valid Before: Mon Dec 01 15:00:32 2014
 # Not Valid After : Thu Dec 01 15:10:31 2039
 # Fingerprint (SHA-256): 6B:9C:08:E8:6E:B0:F7:67:CF:AD:65:CD:98:B6:21:49:E5:49:4A:67:F5:84:5E:7B:D1:ED:01:9F:27:B8:6B:D6
@@ -17582,18 +17360,16 @@ CKA_VALUE MULTILINE_OCTAL
 \311\205\240\045\040\067\373\216\316\014\064\204\341\074\201\262
 \167\116\103\245\210\137\206\147\241\075\346\264\134\141\266\076
 \333\376\267\050\305\242\007\256\265\312\312\215\052\022\357\227
 \355\302\060\244\311\052\172\373\363\115\043\033\231\063\064\240
 \056\365\251\013\077\324\135\341\317\204\237\342\031\302\137\212
 \326\040\036\343\163\267
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "SZAFIR ROOT CA2"
 # Issuer: CN=SZAFIR ROOT CA2,O=Krajowa Izba Rozliczeniowa S.A.,C=PL
 # Serial Number:3e:8a:5d:07:ec:55:d2:32:d5:b7:e3:b6:5f:01:eb:2d:dc:e4:d6:e4
 # Subject: CN=SZAFIR ROOT CA2,O=Krajowa Izba Rozliczeniowa S.A.,C=PL
 # Not Valid Before: Mon Oct 19 07:43:30 2015
 # Not Valid After : Fri Oct 19 07:43:30 2035
 # Fingerprint (SHA-256): A1:33:9D:33:28:1A:0B:56:E5:57:D3:D3:2B:1C:E7:F9:36:7E:B0:94:BD:5F:A7:2A:7E:50:04:C8:DE:D7:CA:FE
@@ -17762,18 +17538,16 @@ CKA_VALUE MULTILINE_OCTAL
 \247\031\157\236\102\020\230\165\346\225\213\140\274\355\305\022
 \327\212\316\325\230\134\126\226\003\305\356\167\006\065\377\317
 \344\356\077\023\141\356\333\332\055\205\360\315\256\235\262\030
 \011\105\303\222\241\162\027\374\107\266\240\013\054\361\304\336
 \103\150\010\152\137\073\360\166\143\373\314\006\054\246\306\342
 \016\265\271\276\044\217
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Certum Trusted Network CA 2"
 # Issuer: CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 # Serial Number:21:d6:d0:4a:4f:25:0f:c9:32:37:fc:aa:5e:12:8d:e9
 # Subject: CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
 # Not Valid Before: Thu Oct 06 08:39:56 2011
 # Not Valid After : Sat Oct 06 08:39:56 2046
 # Fingerprint (SHA-256): B6:76:F2:ED:DA:E8:77:5C:D3:6C:B0:F6:3C:D1:D4:60:39:61:F4:9E:62:65:BA:01:3A:2F:03:07:B6:D0:B8:04
@@ -17951,18 +17725,16 @@ CKA_VALUE MULTILINE_OCTAL
 \172\027\305\326\112\065\211\267\101\325\174\206\177\125\115\203
 \112\245\163\040\300\072\257\220\361\232\044\216\331\216\161\312
 \173\270\206\332\262\217\231\076\035\023\015\022\021\356\324\253
 \360\351\025\166\002\344\340\337\252\040\036\133\141\205\144\100
 \251\220\227\015\255\123\322\132\035\207\152\000\227\145\142\264
 \276\157\152\247\365\054\102\355\062\255\266\041\236\276\274
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Hellenic Academic and Research Institutions RootCA 2015"
 # Issuer: CN=Hellenic Academic and Research Institutions RootCA 2015,O=Hellenic Academic and Research Institutions Cert. Authority,L=Athens,C=GR
 # Serial Number: 0 (0x0)
 # Subject: CN=Hellenic Academic and Research Institutions RootCA 2015,O=Hellenic Academic and Research Institutions Cert. Authority,L=Athens,C=GR
 # Not Valid Before: Tue Jul 07 10:11:21 2015
 # Not Valid After : Sat Jun 30 10:11:21 2040
 # Fingerprint (SHA-256): A0:40:92:9A:02:CE:53:B4:AC:F4:F2:FF:C6:98:1C:E4:49:6F:75:5E:6D:45:FE:0B:2A:69:2B:CD:52:52:3F:36
@@ -18089,18 +17861,16 @@ CKA_VALUE MULTILINE_OCTAL
 \225\044\300\032\047\234\062\073\300\300\325\272\251\347\370\004
 \103\123\205\356\122\041\336\235\365\045\203\076\236\130\113\057
 \327\147\023\016\041\002\060\005\341\165\001\336\150\355\052\037
 \115\114\011\010\015\354\113\255\144\027\050\347\165\316\105\145
 \162\041\027\313\042\101\016\214\023\230\070\232\124\155\233\312
 \342\174\352\002\130\042\221
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Hellenic Academic and Research Institutions ECC RootCA 2015"
 # Issuer: CN=Hellenic Academic and Research Institutions ECC RootCA 2015,O=Hellenic Academic and Research Institutions Cert. Authority,L=Athens,C=GR
 # Serial Number: 0 (0x0)
 # Subject: CN=Hellenic Academic and Research Institutions ECC RootCA 2015,O=Hellenic Academic and Research Institutions Cert. Authority,L=Athens,C=GR
 # Not Valid Before: Tue Jul 07 10:37:12 2015
 # Not Valid After : Sat Jun 30 10:37:12 2040
 # Fingerprint (SHA-256): 44:B5:45:AA:8A:25:E6:5A:73:CA:15:DC:27:FC:36:D2:4C:1C:B9:95:3A:06:65:39:B1:15:82:DC:48:7B:48:33
@@ -18260,18 +18030,16 @@ CKA_VALUE MULTILINE_OCTAL
 \231\021\256\235\101\301\162\165\204\276\002\101\102\137\147\044
 \110\224\321\233\047\276\007\077\271\270\117\201\164\121\341\172
 \267\355\235\043\342\276\340\325\050\004\023\074\061\003\236\335
 \172\154\217\306\007\030\306\177\336\107\216\077\050\236\004\006
 \317\245\124\064\167\275\354\211\233\351\027\103\337\133\333\137
 \376\216\036\127\242\315\100\235\176\142\042\332\336\030\047
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "ISRG Root X1"
 # Issuer: CN=ISRG Root X1,O=Internet Security Research Group,C=US
 # Serial Number:00:82:10:cf:b0:d2:40:e3:59:44:63:e0:bb:63:82:8b:00
 # Subject: CN=ISRG Root X1,O=Internet Security Research Group,C=US
 # Not Valid Before: Thu Jun 04 11:04:38 2015
 # Not Valid After : Mon Jun 04 11:04:38 2035
 # Fingerprint (SHA-256): 96:BC:EC:06:26:49:76:F3:74:60:77:9A:CF:28:C5:A7:CF:E8:A3:C0:AA:E1:1A:8F:FC:EE:05:C0:BD:DF:08:C6
@@ -18425,18 +18193,16 @@ CKA_VALUE MULTILINE_OCTAL
 \274\254\035\225\267\151\141\362\103\221\164\346\240\323\012\044
 \106\241\010\257\326\332\105\031\226\324\123\035\133\204\171\360
 \300\367\107\357\213\217\305\006\256\235\114\142\235\377\106\004
 \370\323\311\266\020\045\100\165\376\026\252\311\112\140\206\057
 \272\357\060\167\344\124\342\270\204\231\130\200\252\023\213\121
 \072\117\110\366\213\266\263
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "AC RAIZ FNMT-RCM"
 # Issuer: OU=AC RAIZ FNMT-RCM,O=FNMT-RCM,C=ES
 # Serial Number:5d:93:8d:30:67:36:c8:06:1d:1a:c7:54:84:69:07
 # Subject: OU=AC RAIZ FNMT-RCM,O=FNMT-RCM,C=ES
 # Not Valid Before: Wed Oct 29 15:59:56 2008
 # Not Valid After : Tue Jan 01 00:00:00 2030
 # Fingerprint (SHA-256): EB:C5:57:0C:29:01:8C:4D:67:B1:AA:12:7B:AF:12:F7:03:B4:61:1E:BC:17:B7:DA:B5:57:38:94:17:9B:93:FA
@@ -18552,18 +18318,16 @@ CKA_VALUE MULTILINE_OCTAL
 \131\302\002\134\046\140\051\317\043\031\026\216\210\103\245\324
 \344\313\010\373\043\021\103\350\103\051\162\142\241\251\135\136
 \010\324\220\256\270\330\316\024\302\320\125\362\206\366\304\223
 \103\167\146\141\300\271\350\101\327\227\170\140\003\156\112\162
 \256\245\321\175\272\020\236\206\154\033\212\271\131\063\370\353
 \304\220\276\361\271
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Amazon Root CA 1"
 # Issuer: CN=Amazon Root CA 1,O=Amazon,C=US
 # Serial Number:06:6c:9f:cf:99:bf:8c:0a:39:e2:f0:78:8a:43:e6:96:36:5b:ca
 # Subject: CN=Amazon Root CA 1,O=Amazon,C=US
 # Not Valid Before: Tue May 26 00:00:00 2015
 # Not Valid After : Sun Jan 17 00:00:00 2038
 # Fingerprint (SHA-256): 8E:CD:E6:88:4F:3D:87:B1:12:5B:A3:1A:C3:FC:B1:3D:70:16:DE:7F:57:CC:90:4F:E1:CB:97:C6:AE:98:19:6E
@@ -18711,18 +18475,16 @@ CKA_VALUE MULTILINE_OCTAL
 \352\315\360\215\113\070\234\031\232\033\050\124\270\211\220\357
 \312\165\201\076\036\362\144\044\307\030\257\116\377\107\236\007
 \366\065\145\244\323\012\126\377\365\027\144\154\357\250\042\045
 \111\223\266\337\000\027\332\130\176\135\356\305\033\260\321\321
 \137\041\020\307\371\363\272\002\012\047\007\305\361\326\307\323
 \340\373\011\140\154
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Amazon Root CA 2"
 # Issuer: CN=Amazon Root CA 2,O=Amazon,C=US
 # Serial Number:06:6c:9f:d2:96:35:86:9f:0a:0f:e5:86:78:f8:5b:26:bb:8a:37
 # Subject: CN=Amazon Root CA 2,O=Amazon,C=US
 # Not Valid Before: Tue May 26 00:00:00 2015
 # Not Valid After : Sat May 26 00:00:00 2040
 # Fingerprint (SHA-256): 1B:A5:B2:AA:8C:65:40:1A:82:96:01:18:F8:0B:EC:4F:62:30:4D:83:CE:C4:71:3A:19:C3:9C:01:1E:A4:6D:B4
@@ -18813,18 +18575,16 @@ CKA_VALUE MULTILINE_OCTAL
 \261\170\300\060\012\006\010\052\206\110\316\075\004\003\002\003
 \111\000\060\106\002\041\000\340\205\222\243\027\267\215\371\053
 \006\245\223\254\032\230\150\141\162\372\341\241\320\373\034\170
 \140\246\103\231\305\270\304\002\041\000\234\002\357\361\224\234
 \263\226\371\353\306\052\370\266\054\376\072\220\024\026\327\214
 \143\044\110\034\337\060\175\325\150\073
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Amazon Root CA 3"
 # Issuer: CN=Amazon Root CA 3,O=Amazon,C=US
 # Serial Number:06:6c:9f:d5:74:97:36:66:3f:3b:0b:9a:d9:e8:9e:76:03:f2:4a
 # Subject: CN=Amazon Root CA 3,O=Amazon,C=US
 # Not Valid Before: Tue May 26 00:00:00 2015
 # Not Valid After : Sat May 26 00:00:00 2040
 # Fingerprint (SHA-256): 18:CE:6C:FE:7B:F1:4E:60:B2:E3:47:B8:DF:E8:68:CB:31:D0:2E:BB:3A:DA:27:15:69:F5:03:43:B4:6D:B3:A4
@@ -18919,18 +18679,16 @@ CKA_VALUE MULTILINE_OCTAL
 \326\353\235\176\220\215\053\317\146\125\303\054\343\050\251\160
 \012\107\016\360\067\131\022\377\055\231\224\050\116\052\117\065
 \115\063\132\002\061\000\352\165\000\116\073\304\072\224\022\221
 \311\130\106\235\041\023\162\247\210\234\212\344\114\112\333\226
 \324\254\213\153\153\111\022\123\063\255\327\344\276\044\374\265
 \012\166\324\245\274\020
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Amazon Root CA 4"
 # Issuer: CN=Amazon Root CA 4,O=Amazon,C=US
 # Serial Number:06:6c:9f:d7:c1:bb:10:4c:29:43:e5:71:7b:7b:2c:c8:1a:c1:0e
 # Subject: CN=Amazon Root CA 4,O=Amazon,C=US
 # Not Valid Before: Tue May 26 00:00:00 2015
 # Not Valid After : Sat May 26 00:00:00 2040
 # Fingerprint (SHA-256): E3:5D:28:41:9E:D0:20:25:CF:A6:90:38:CD:62:39:62:45:8D:A5:C6:95:FB:DE:A3:C2:2B:0B:FB:25:89:70:92
@@ -19088,18 +18846,16 @@ CKA_VALUE MULTILINE_OCTAL
 \307\320\226\266\332\341\112\144\006\156\140\115\275\102\116\377
 \170\332\044\312\033\264\327\226\071\154\256\361\016\252\247\175
 \110\213\040\114\317\144\326\270\227\106\260\116\321\052\126\072
 \240\223\275\257\200\044\340\012\176\347\312\325\312\350\205\125
 \334\066\052\341\224\150\223\307\146\162\104\017\200\041\062\154
 \045\307\043\200\203\012\353
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "LuxTrust Global Root 2"
 # Issuer: CN=LuxTrust Global Root 2,O=LuxTrust S.A.,C=LU
 # Serial Number:0a:7e:a6:df:4b:44:9e:da:6a:24:85:9e:e6:b8:15:d3:16:7f:bb:b1
 # Subject: CN=LuxTrust Global Root 2,O=LuxTrust S.A.,C=LU
 # Not Valid Before: Thu Mar 05 13:21:57 2015
 # Not Valid After : Mon Mar 05 13:21:57 2035
 # Fingerprint (SHA-256): 54:45:5F:71:29:C2:0B:14:47:C4:18:F9:97:16:8F:24:C5:8F:C5:02:3B:F5:DA:5B:E2:EB:6E:1D:D8:90:2E:D5
@@ -19239,18 +18995,16 @@ CKA_VALUE MULTILINE_OCTAL
 \003\147\204\235\306\303\316\044\142\307\114\066\317\260\006\104
 \267\365\137\002\335\331\124\351\057\220\116\172\310\116\203\100
 \014\232\227\074\067\277\277\354\366\360\264\205\167\050\301\013
 \310\147\202\020\027\070\242\267\006\352\233\277\072\370\351\043
 \007\277\164\340\230\070\025\125\170\356\162\000\134\031\243\364
 \322\063\340\377\275\321\124\071\051\017
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Symantec Class 1 Public Primary Certification Authority - G6"
 # Issuer: CN=Symantec Class 1 Public Primary Certification Authority - G6,OU=Symantec Trust Network,O=Symantec Corporation,C=US
 # Serial Number:24:32:75:f2:1d:2f:d2:09:33:f7:b4:6a:ca:d0:f3:98
 # Subject: CN=Symantec Class 1 Public Primary Certification Authority - G6,OU=Symantec Trust Network,O=Symantec Corporation,C=US
 # Not Valid Before: Tue Oct 18 00:00:00 2011
 # Not Valid After : Tue Dec 01 23:59:59 2037
 # Fingerprint (SHA-256): 9D:19:0B:2E:31:45:66:68:5B:E8:A8:89:E2:7A:A8:C7:D7:AE:1D:8A:AD:DB:A3:C1:EC:F9:D2:48:63:CD:34:B9
@@ -19395,18 +19149,16 @@ CKA_VALUE MULTILINE_OCTAL
 \026\077\317\002\032\335\341\154\153\007\141\152\166\025\051\231
 \177\033\335\210\200\301\277\265\217\163\305\246\226\043\204\246
 \050\206\044\063\152\001\056\127\163\045\266\136\277\217\346\035
 \141\250\100\051\147\035\207\233\035\177\233\237\231\315\061\326
 \124\276\142\273\071\254\150\022\110\221\040\245\313\261\335\376
 \157\374\132\344\202\125\131\257\061\251
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Symantec Class 2 Public Primary Certification Authority - G6"
 # Issuer: CN=Symantec Class 2 Public Primary Certification Authority - G6,OU=Symantec Trust Network,O=Symantec Corporation,C=US
 # Serial Number:64:82:9e:fc:37:1e:74:5d:fc:97:ff:97:c8:b1:ff:41
 # Subject: CN=Symantec Class 2 Public Primary Certification Authority - G6,OU=Symantec Trust Network,O=Symantec Corporation,C=US
 # Not Valid Before: Tue Oct 18 00:00:00 2011
 # Not Valid After : Tue Dec 01 23:59:59 2037
 # Fingerprint (SHA-256): CB:62:7D:18:B5:8A:D5:6D:DE:33:1A:30:45:6B:C6:5C:60:1A:4E:9B:18:DE:DC:EA:08:E7:DA:AA:07:81:5F:F0
@@ -19530,18 +19282,16 @@ CKA_VALUE MULTILINE_OCTAL
 \066\343\042\372\056\050\111\015\356\060\176\063\363\354\077\161
 \136\314\125\211\170\231\254\262\375\334\034\134\063\216\051\271
 \153\027\310\021\150\265\334\203\007\002\061\000\234\310\104\332
 \151\302\066\303\124\031\020\205\002\332\235\107\357\101\347\154
 \046\235\011\075\367\155\220\321\005\104\057\260\274\203\223\150
 \362\014\105\111\071\277\231\004\034\323\020\240
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Symantec Class 1 Public Primary Certification Authority - G4"
 # Issuer: CN=Symantec Class 1 Public Primary Certification Authority - G4,OU=Symantec Trust Network,O=Symantec Corporation,C=US
 # Serial Number:21:6e:33:a5:cb:d3:88:a4:6f:29:07:b4:27:3c:c4:d8
 # Subject: CN=Symantec Class 1 Public Primary Certification Authority - G4,OU=Symantec Trust Network,O=Symantec Corporation,C=US
 # Not Valid Before: Wed Oct 05 00:00:00 2011
 # Not Valid After : Mon Jan 18 23:59:59 2038
 # Fingerprint (SHA-256): 36:3F:3C:84:9E:AB:03:B0:A2:A0:F6:36:D7:B8:6D:04:D3:AC:7F:CF:E2:6A:0A:91:21:AB:97:95:F6:E1:76:DF
@@ -19665,18 +19415,16 @@ CKA_VALUE MULTILINE_OCTAL
 \311\021\102\026\150\151\114\134\270\047\030\266\230\361\300\177
 \220\155\207\323\214\106\027\360\076\117\374\352\260\010\304\172
 \113\274\010\057\307\342\247\157\145\002\061\000\326\131\336\206
 \316\137\016\312\124\325\306\320\025\016\374\213\224\162\324\216
 \000\130\123\317\176\261\113\015\345\120\206\353\236\153\337\377
 \051\246\330\107\331\240\226\030\333\362\105\263
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Symantec Class 2 Public Primary Certification Authority - G4"
 # Issuer: CN=Symantec Class 2 Public Primary Certification Authority - G4,OU=Symantec Trust Network,O=Symantec Corporation,C=US
 # Serial Number:34:17:65:12:40:3b:b7:56:80:2d:80:cb:79:55:a6:1e
 # Subject: CN=Symantec Class 2 Public Primary Certification Authority - G4,OU=Symantec Trust Network,O=Symantec Corporation,C=US
 # Not Valid Before: Wed Oct 05 00:00:00 2011
 # Not Valid After : Mon Jan 18 23:59:59 2038
 # Fingerprint (SHA-256): FE:86:3D:08:22:FE:7A:23:53:FA:48:4D:59:24:E8:75:65:6D:3D:C9:FB:58:77:1F:6F:61:6F:9D:57:1B:C5:92
@@ -19812,18 +19560,16 @@ CKA_VALUE MULTILINE_OCTAL
 \207\330\374\264\151\154\213\240\103\007\140\170\227\351\331\223
 \174\302\106\274\233\067\122\243\355\212\074\023\251\173\123\113
 \111\232\021\005\054\013\156\126\254\037\056\202\154\340\151\147
 \265\016\155\055\331\344\300\025\361\077\372\030\162\341\025\155
 \047\133\055\060\050\053\237\110\232\144\053\231\357\362\165\111
 \137\134
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "D-TRUST Root CA 3 2013"
 # Issuer: CN=D-TRUST Root CA 3 2013,O=D-Trust GmbH,C=DE
 # Serial Number: 1039788 (0xfddac)
 # Subject: CN=D-TRUST Root CA 3 2013,O=D-Trust GmbH,C=DE
 # Not Valid Before: Fri Sep 20 08:25:51 2013
 # Not Valid After : Wed Sep 20 08:25:51 2028
 # Fingerprint (SHA-256): A1:A8:6D:04:12:1E:B8:7F:02:7C:66:F5:33:03:C2:8E:57:39:F9:43:FC:84:B3:8A:D6:AF:00:90:35:DD:94:57
@@ -19976,18 +19722,16 @@ CKA_VALUE MULTILINE_OCTAL
 \325\042\245\015\212\361\223\016\076\124\016\260\330\311\116\334
 \362\061\062\126\352\144\371\352\265\235\026\146\102\162\363\177
 \323\261\061\103\374\244\216\027\361\155\043\253\224\146\370\255
 \373\017\010\156\046\055\177\027\007\011\262\214\373\120\300\237
 \226\215\317\266\375\000\235\132\024\232\277\002\104\365\301\302
 \237\042\136\242\017\241\343
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1"
 # Issuer: CN=TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1,OU=Kamu Sertifikasyon Merkezi - Kamu SM,O=Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK,L=Gebze - Kocaeli,C=TR
 # Serial Number: 1 (0x1)
 # Subject: CN=TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1,OU=Kamu Sertifikasyon Merkezi - Kamu SM,O=Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK,L=Gebze - Kocaeli,C=TR
 # Not Valid Before: Mon Nov 25 08:25:55 2013
 # Not Valid After : Sun Oct 25 08:25:55 2043
 # Fingerprint (SHA-256): 46:ED:C3:68:90:46:D5:3A:45:3F:B3:10:4A:B8:0D:CA:EC:65:8B:26:60:EA:16:29:DD:7E:86:79:90:64:87:16
@@ -20153,18 +19897,16 @@ CKA_VALUE MULTILINE_OCTAL
 \042\314\206\000\176\146\203\014\102\364\275\064\222\303\032\352
 \117\312\176\162\115\013\160\214\246\110\273\246\241\024\366\373
 \130\104\231\024\256\252\013\223\151\240\051\045\112\245\313\053
 \335\212\146\007\026\170\025\127\161\033\354\365\107\204\363\236
 \061\067\172\325\177\044\255\344\274\375\375\314\156\203\350\014
 \250\267\101\154\007\335\275\074\206\227\057\322
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "GDCA TrustAUTH R5 ROOT"
 # Issuer: CN=GDCA TrustAUTH R5 ROOT,O="GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.",C=CN
 # Serial Number:7d:09:97:fe:f0:47:ea:7a
 # Subject: CN=GDCA TrustAUTH R5 ROOT,O="GUANG DONG CERTIFICATE AUTHORITY CO.,LTD.",C=CN
 # Not Valid Before: Wed Nov 26 05:13:15 2014
 # Not Valid After : Mon Dec 31 15:59:59 2040
 # Fingerprint (SHA-256): BF:FF:8F:D0:44:33:48:7D:6A:8A:A6:0C:1A:29:76:7A:9F:C2:BB:B0:5E:42:0F:71:3A:13:B9:92:89:1D:38:93
@@ -20310,18 +20052,16 @@ CKA_VALUE MULTILINE_OCTAL
 \061\301\373\176\166\333\323\205\343\130\262\167\172\166\073\154
 \057\120\034\347\333\366\147\171\037\365\202\225\232\007\247\024
 \257\217\334\050\041\147\011\322\326\115\132\034\031\034\216\167
 \134\303\224\044\075\062\153\113\176\324\170\224\203\276\067\115
 \316\137\307\036\116\074\340\211\063\225\013\017\245\062\326\074
 \132\171\054\031
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "TrustCor RootCert CA-1"
 # Issuer: CN=TrustCor RootCert CA-1,OU=TrustCor Certificate Authority,O=TrustCor Systems S. de R.L.,L=Panama City,ST=Panama,C=PA
 # Serial Number:00:da:9b:ec:71:f3:03:b0:19
 # Subject: CN=TrustCor RootCert CA-1,OU=TrustCor Certificate Authority,O=TrustCor Systems S. de R.L.,L=Panama City,ST=Panama,C=PA
 # Not Valid Before: Thu Feb 04 12:32:16 2016
 # Not Valid After : Mon Dec 31 17:23:16 2029
 # Fingerprint (SHA-256): D4:0E:9C:86:CD:8F:E4:68:C1:77:69:59:F4:9E:A7:74:FA:54:86:84:B6:C4:06:F3:90:92:61:F4:DC:E2:57:5C
@@ -20503,18 +20243,16 @@ CKA_VALUE MULTILINE_OCTAL
 \273\024\062\124\014\002\051\223\036\222\206\366\177\357\347\222
 \005\016\131\335\231\010\056\056\372\234\000\122\323\305\146\051
 \344\247\227\104\244\016\050\201\023\065\305\366\157\144\346\101
 \304\325\057\314\064\105\045\317\101\000\226\075\112\056\302\226
 \230\117\116\112\234\227\267\333\037\222\062\310\377\017\121\156
 \326\354\011
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "TrustCor RootCert CA-2"
 # Issuer: CN=TrustCor RootCert CA-2,OU=TrustCor Certificate Authority,O=TrustCor Systems S. de R.L.,L=Panama City,ST=Panama,C=PA
 # Serial Number:25:a1:df:ca:33:cb:59:02
 # Subject: CN=TrustCor RootCert CA-2,OU=TrustCor Certificate Authority,O=TrustCor Systems S. de R.L.,L=Panama City,ST=Panama,C=PA
 # Not Valid Before: Thu Feb 04 12:32:23 2016
 # Not Valid After : Sun Dec 31 17:26:39 2034
 # Fingerprint (SHA-256): 07:53:E9:40:37:8C:1B:D5:E3:83:6E:39:5D:AE:A5:CB:83:9E:50:46:F1:BD:0E:AE:19:51:CF:10:FE:C7:C9:65
@@ -20661,18 +20399,16 @@ CKA_VALUE MULTILINE_OCTAL
 \300\150\066\330\306\361\117\200\104\062\371\341\321\321\035\252
 \336\250\253\234\004\257\255\040\016\144\230\115\245\153\300\110
 \130\226\151\115\334\007\214\121\223\242\337\237\017\075\213\140
 \264\202\215\252\010\116\142\105\340\371\013\322\340\340\074\133
 \336\134\161\047\045\302\346\003\201\213\020\123\343\307\125\242
 \264\237\327\346
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "TrustCor ECA-1"
 # Issuer: CN=TrustCor ECA-1,OU=TrustCor Certificate Authority,O=TrustCor Systems S. de R.L.,L=Panama City,ST=Panama,C=PA
 # Serial Number:00:84:82:2c:5f:1c:62:d0:40
 # Subject: CN=TrustCor ECA-1,OU=TrustCor Certificate Authority,O=TrustCor Systems S. de R.L.,L=Panama City,ST=Panama,C=PA
 # Not Valid Before: Thu Feb 04 12:32:33 2016
 # Not Valid After : Mon Dec 31 17:28:07 2029
 # Fingerprint (SHA-256): 5A:88:5D:B1:9C:01:D9:12:C5:75:93:88:93:8C:AF:BB:DF:03:1A:B2:D4:8E:91:EE:15:58:9B:42:97:1D:03:9C
@@ -20842,18 +20578,16 @@ CKA_VALUE MULTILINE_OCTAL
 \262\300\240\143\141\220\272\125\150\067\164\152\266\222\333\237
 \241\206\042\266\145\047\016\354\266\237\102\140\344\147\302\265
 \332\101\013\304\323\213\141\033\274\372\037\221\053\327\104\007
 \136\272\051\254\331\305\351\357\123\110\132\353\200\361\050\130
 \041\315\260\006\125\373\047\077\123\220\160\251\004\036\127\047
 \271
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "SSL.com Root Certification Authority RSA"
 # Issuer: CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
 # Serial Number:7b:2c:9b:d3:16:80:32:99
 # Subject: CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
 # Not Valid Before: Fri Feb 12 17:39:39 2016
 # Not Valid After : Tue Feb 12 17:39:39 2041
 # Fingerprint (SHA-256): 85:66:6A:56:2E:E0:BE:5C:E9:25:C1:D8:89:0A:6F:76:A8:7E:C1:6D:4D:7D:5F:29:EA:74:19:CF:20:12:3B:69
@@ -20968,18 +20702,16 @@ CKA_VALUE MULTILINE_OCTAL
 \221\334\355\345\374\120\153\021\106\106\263\034\041\000\142\273
 \276\303\347\350\315\007\231\371\015\013\135\162\076\304\252\002
 \060\037\274\272\013\342\060\044\373\174\155\200\125\012\231\076
 \200\015\063\345\146\243\263\243\273\245\325\213\217\011\054\246
 \135\176\342\360\007\010\150\155\322\174\151\156\137\337\345\152
 \145
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "SSL.com Root Certification Authority ECC"
 # Issuer: CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US
 # Serial Number:75:e6:df:cb:c1:68:5b:a8
 # Subject: CN=SSL.com Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US
 # Not Valid Before: Fri Feb 12 18:14:03 2016
 # Not Valid After : Tue Feb 12 18:14:03 2041
 # Fingerprint (SHA-256): 34:17:BB:06:CC:60:07:DA:1B:96:1C:92:0B:8A:B4:CE:3F:AD:82:0E:4A:A3:0B:9A:CB:C4:A7:4E:BD:CE:BC:65
@@ -21149,18 +20881,16 @@ CKA_VALUE MULTILINE_OCTAL
 \165\206\123\030\172\012\056\011\034\066\237\221\375\202\212\042
 \113\321\016\120\045\335\313\003\014\027\311\203\000\010\116\065
 \115\212\213\355\360\002\224\146\054\104\177\313\225\047\226\027
 \255\011\060\254\266\161\027\156\213\027\366\034\011\324\055\073
 \230\245\161\323\124\023\331\140\363\365\113\146\117\372\361\356
 \040\022\215\264\254\127\261\105\143\241\254\166\251\302\373
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "SSL.com EV Root Certification Authority RSA R2"
 # Issuer: CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
 # Serial Number:56:b6:29:cd:34:bc:78:f6
 # Subject: CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
 # Not Valid Before: Wed May 31 18:14:37 2017
 # Not Valid After : Fri May 30 18:14:37 2042
 # Fingerprint (SHA-256): 2E:7B:F1:6C:C2:24:85:A7:BB:E2:AA:86:96:75:07:61:B0:AE:39:BE:3B:2F:E9:D0:CC:6D:4E:F7:34:91:42:5C
@@ -21278,18 +21008,16 @@ CKA_VALUE MULTILINE_OCTAL
 \312\324\153\044\363\260\075\207\106\130\032\354\261\337\157\373
 \126\272\160\153\307\070\314\350\261\214\117\017\367\361\147\166
 \016\203\320\036\121\217\002\060\075\366\043\050\046\114\306\140
 \207\223\046\233\262\065\036\272\326\367\074\321\034\316\372\045
 \074\246\032\201\025\133\363\022\017\154\356\145\212\311\207\250
 \371\007\340\142\232\214\134\112
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "SSL.com EV Root Certification Authority ECC"
 # Issuer: CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US
 # Serial Number:2c:29:9c:5b:16:ed:05:95
 # Subject: CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US
 # Not Valid Before: Fri Feb 12 18:15:23 2016
 # Not Valid After : Tue Feb 12 18:15:23 2041
 # Fingerprint (SHA-256): 22:A2:C1:F7:BD:ED:70:4C:C1:E7:01:B5:F4:08:C3:10:88:0F:E9:56:B5:DE:2A:4A:44:F9:9C:87:3A:25:A7:C8
@@ -21446,18 +21174,16 @@ CKA_VALUE MULTILINE_OCTAL
 \134\222\360\171\367\234\204\272\164\055\141\001\040\176\176\321
 \362\117\007\131\137\213\055\103\122\353\106\014\224\341\365\146
 \107\171\167\325\124\133\037\255\044\067\313\105\132\116\240\104
 \110\310\330\260\231\305\025\204\011\366\326\111\111\300\145\270
 \346\032\161\156\240\250\361\202\350\105\076\154\326\002\327\012
 \147\203\005\132\311\244\020
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "GlobalSign Root CA - R6"
 # Issuer: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R6
 # Serial Number:45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
 # Subject: CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R6
 # Not Valid Before: Wed Dec 10 00:00:00 2014
 # Not Valid After : Sun Dec 10 00:00:00 2034
 # Fingerprint (SHA-256): 2C:AB:EA:FE:37:D0:6C:A2:2A:BA:73:91:C0:03:3D:25:98:29:52:C4:53:64:73:49:76:3A:3A:B5:AD:6C:CF:69
@@ -21565,18 +21291,16 @@ CKA_VALUE MULTILINE_OCTAL
 \347\262\347\310\014\214\214\303\335\171\214\033\143\325\311\122
 \224\116\115\202\112\163\036\262\200\204\251\045\300\114\132\155
 \111\051\140\170\023\342\176\110\353\144\002\061\000\333\064\040
 \062\010\377\232\111\002\266\210\336\024\257\135\154\231\161\215
 \032\077\213\327\340\242\066\206\034\007\202\072\166\123\375\302
 \242\355\357\173\260\200\117\130\017\113\123\071\275
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "OISTE WISeKey Global Root GC CA"
 # Issuer: CN=OISTE WISeKey Global Root GC CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
 # Serial Number:21:2a:56:0c:ae:da:0c:ab:40:45:bf:2b:a2:2d:3a:ea
 # Subject: CN=OISTE WISeKey Global Root GC CA,OU=OISTE Foundation Endorsed,O=WISeKey,C=CH
 # Not Valid Before: Tue May 09 09:48:34 2017
 # Not Valid After : Fri May 09 09:58:33 2042
 # Fingerprint (SHA-256): 85:60:F9:1C:36:24:DA:BA:95:70:B5:FE:A0:DB:E3:6F:F1:1A:83:23:BE:94:86:85:4F:B3:F3:4A:55:71:19:8D
@@ -21730,18 +21454,16 @@ CKA_VALUE MULTILINE_OCTAL
 \373\357\366\121\004\211\154\350\251\164\241\273\027\263\265\375
 \111\017\174\074\354\203\030\040\103\116\325\223\272\264\064\261
 \037\026\066\037\014\346\144\071\026\114\334\340\376\035\310\251
 \142\075\100\352\312\305\064\002\264\256\211\210\063\065\334\054
 \023\163\330\047\361\320\162\356\165\073\042\336\230\150\146\133
 \361\306\143\107\125\034\272\245\010\121\165\246\110\045
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "GTS Root R1"
 # Issuer: CN=GTS Root R1,O=Google Trust Services LLC,C=US
 # Serial Number:6e:47:a9:c5:4b:47:0c:0d:ec:33:d0:89:b9:1c:f4:e1
 # Subject: CN=GTS Root R1,O=Google Trust Services LLC,C=US
 # Not Valid Before: Wed Jun 22 00:00:00 2016
 # Not Valid After : Sun Jun 22 00:00:00 2036
 # Fingerprint (SHA-256): 2A:57:54:71:E3:13:40:BC:21:58:1C:BD:2C:F1:3E:15:84:63:20:3E:CE:94:BC:F9:D3:CC:19:6B:F0:9A:54:72
@@ -21893,18 +21615,16 @@ CKA_VALUE MULTILINE_OCTAL
 \213\015\176\153\040\301\300\236\341\145\330\152\243\246\350\205
 \213\072\007\010\034\272\365\217\125\232\030\165\176\345\354\201
 \146\321\041\163\241\065\104\013\200\075\133\234\136\157\052\027
 \226\321\203\043\210\146\155\346\206\342\160\062\057\122\042\347
 \310\347\177\304\054\140\135\057\303\257\236\105\005\303\204\002
 \267\375\054\010\122\117\202\335\243\360\324\206\011\002
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "GTS Root R2"
 # Issuer: CN=GTS Root R2,O=Google Trust Services LLC,C=US
 # Serial Number:6e:47:a9:c6:5a:b3:e7:20:c5:30:9a:3f:68:52:f2:6f
 # Subject: CN=GTS Root R2,O=Google Trust Services LLC,C=US
 # Not Valid Before: Wed Jun 22 00:00:00 2016
 # Not Valid After : Sun Jun 22 00:00:00 2036
 # Fingerprint (SHA-256): C4:5D:7B:B0:8E:6D:67:E6:2E:42:35:11:0B:56:4E:5F:78:FD:92:EF:05:8C:84:0A:EA:4E:64:55:D7:58:5C:60
@@ -22003,18 +21723,16 @@ CKA_VALUE MULTILINE_OCTAL
 \174\043\300\225\245\054\334\276\211\157\043\271\243\335\145\000
 \122\136\221\254\310\235\162\164\202\123\013\175\251\100\275\150
 \140\305\341\270\124\073\301\066\027\045\330\301\275\002\061\000
 \236\065\222\164\205\045\121\365\044\354\144\122\044\120\245\037
 \333\350\313\311\166\354\354\202\156\365\205\030\123\350\270\343
 \232\051\252\226\323\203\043\311\244\173\141\263\314\002\350\135
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "GTS Root R3"
 # Issuer: CN=GTS Root R3,O=Google Trust Services LLC,C=US
 # Serial Number:6e:47:a9:c7:6c:a9:73:24:40:89:0f:03:55:dd:8d:1d
 # Subject: CN=GTS Root R3,O=Google Trust Services LLC,C=US
 # Not Valid Before: Wed Jun 22 00:00:00 2016
 # Not Valid After : Sun Jun 22 00:00:00 2036
 # Fingerprint (SHA-256): 15:D5:B8:77:46:19:EA:7D:54:CE:1C:A6:D0:B0:C4:03:E0:37:A9:17:F1:31:E8:A0:4E:1E:6B:7A:71:BA:BC:E5
@@ -22113,18 +21831,16 @@ CKA_VALUE MULTILINE_OCTAL
 \010\304\160\334\236\120\164\041\350\215\172\041\303\117\226\156
 \025\321\042\065\141\055\372\010\067\356\031\155\255\333\262\314
 \175\007\064\365\140\031\054\265\064\331\157\040\002\060\003\161
 \261\272\243\140\013\206\355\232\010\152\225\150\237\342\263\341
 \223\144\174\136\223\246\337\171\055\215\205\343\224\317\043\135
 \161\314\362\260\115\326\376\231\310\224\251\165\242\343
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "GTS Root R4"
 # Issuer: CN=GTS Root R4,O=Google Trust Services LLC,C=US
 # Serial Number:6e:47:a9:c8:8b:94:b6:e8:bb:3b:2a:d8:a2:b2:c1:99
 # Subject: CN=GTS Root R4,O=Google Trust Services LLC,C=US
 # Not Valid Before: Wed Jun 22 00:00:00 2016
 # Not Valid After : Sun Jun 22 00:00:00 2036
 # Fingerprint (SHA-256): 71:CC:A5:39:1F:9E:79:4B:04:80:25:30:B3:63:E1:21:DA:8A:30:43:BB:26:66:2F:EA:4D:CA:7F:C9:51:A4:BD
@@ -22273,18 +21989,16 @@ CKA_VALUE MULTILINE_OCTAL
 \046\211\273\326\063\057\120\325\376\232\211\272\030\062\222\124
 \306\133\340\235\371\136\345\015\042\233\366\332\342\310\041\262
 \142\041\252\206\100\262\056\144\323\137\310\343\176\021\147\105
 \037\005\376\343\242\357\263\250\263\363\175\217\370\014\037\042
 \037\055\160\264\270\001\064\166\060\000\345\043\170\247\126\327
 \120\037\212\373\006\365\302\031\360\320
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "UCA Global G2 Root"
 # Issuer: CN=UCA Global G2 Root,O=UniTrust,C=CN
 # Serial Number:5d:df:b1:da:5a:a3:ed:5d:be:5a:65:20:65:03:90:ef
 # Subject: CN=UCA Global G2 Root,O=UniTrust,C=CN
 # Not Valid Before: Fri Mar 11 00:00:00 2016
 # Not Valid After : Mon Dec 31 00:00:00 2040
 # Fingerprint (SHA-256): 9B:EA:11:C9:76:FE:01:47:64:C1:BE:56:A6:F9:14:B5:A5:60:31:7A:BD:99:88:39:33:82:E5:16:1A:A0:49:3C
@@ -22435,18 +22149,16 @@ CKA_VALUE MULTILINE_OCTAL
 \307\375\025\076\300\027\252\373\043\156\046\106\313\372\371\261
 \162\153\151\317\042\204\013\142\017\254\331\031\000\224\242\166
 \074\324\055\232\355\004\236\055\006\142\020\067\122\034\205\162
 \033\047\345\314\306\061\354\067\354\143\131\233\013\035\166\314
 \176\062\232\210\225\010\066\122\273\336\166\137\166\111\111\255
 \177\275\145\040\262\311\301\053\166\030\166\237\126\261
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "UCA Extended Validation Root"
 # Issuer: CN=UCA Extended Validation Root,O=UniTrust,C=CN
 # Serial Number:4f:d2:2b:8f:f5:64:c8:33:9e:4f:34:58:66:23:70:60
 # Subject: CN=UCA Extended Validation Root,O=UniTrust,C=CN
 # Not Valid Before: Fri Mar 13 00:00:00 2015
 # Not Valid After : Fri Dec 31 00:00:00 2038
 # Fingerprint (SHA-256): D4:3A:F9:B3:54:73:75:5C:96:84:FC:06:D7:D8:CB:70:EE:5C:28:E7:73:FB:29:4E:B4:1E:E7:17:22:92:4D:24
@@ -22616,18 +22328,16 @@ CKA_VALUE MULTILINE_OCTAL
 \215\146\122\151\176\113\150\014\307\036\067\047\203\245\214\307
 \002\344\024\315\111\001\260\163\263\375\306\220\072\157\322\154
 \355\073\356\354\221\276\242\103\135\213\000\112\146\045\104\160
 \336\100\017\370\174\025\367\242\316\074\327\136\023\214\201\027
 \030\027\321\275\361\167\020\072\324\145\071\301\047\254\127\054
 \045\124\377\242\332\117\212\141\071\136\256\075\112\214\275
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Certigna Root CA"
 # Issuer: CN=Certigna Root CA,OU=0002 48146308100036,O=Dhimyotis,C=FR
 # Serial Number:00:ca:e9:1b:89:f1:55:03:0d:a3:e6:41:6d:c4:e3:a6:e1
 # Subject: CN=Certigna Root CA,OU=0002 48146308100036,O=Dhimyotis,C=FR
 # Not Valid Before: Tue Oct 01 08:32:27 2013
 # Not Valid After : Sat Oct 01 08:32:27 2033
 # Fingerprint (SHA-256): D4:8D:3D:23:EE:DB:50:A4:59:E5:51:97:60:1C:27:77:4B:9D:7B:18:C9:4D:5A:05:95:11:A1:02:50:B9:31:68
@@ -22755,18 +22465,16 @@ CKA_VALUE MULTILINE_OCTAL
 \263\043\065\200\101\215\154\304\067\173\201\057\200\241\100\102
 \205\351\331\070\215\350\241\123\315\001\277\151\350\132\006\362
 \105\013\220\372\256\341\277\235\362\256\127\074\245\256\262\126
 \364\213\145\100\351\375\061\201\054\364\071\011\330\356\153\247
 \264\246\035\025\245\230\367\001\201\330\205\175\363\121\134\161
 \210\336\272\314\037\200\176\112
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "emSign Root CA - G1"
 # Issuer: CN=emSign Root CA - G1,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
 # Serial Number:31:f5:e4:62:0c:6c:58:ed:d6:d8
 # Subject: CN=emSign Root CA - G1,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
 # Not Valid Before: Sun Feb 18 18:30:00 2018
 # Not Valid After : Wed Feb 18 18:30:00 2043
 # Fingerprint (SHA-256): 40:F6:AF:03:46:A9:9A:A1:CD:1D:55:5A:4E:9C:CE:62:C7:F9:63:46:03:EE:40:66:15:83:3D:C8:C8:D0:03:67
@@ -22874,18 +22582,16 @@ CKA_VALUE MULTILINE_OCTAL
 \203\010\027\220\312\037\212\114\350\015\033\172\261\255\325\201
 \011\107\357\073\254\010\004\174\134\231\261\355\107\007\322\002
 \061\000\235\272\125\374\251\112\350\355\355\346\166\001\102\173
 \310\370\140\331\215\121\213\125\073\373\214\173\353\145\011\303
 \370\226\315\107\250\202\362\026\125\167\044\176\022\020\225\004
 \054\243
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "emSign ECC Root CA - G3"
 # Issuer: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
 # Serial Number:3c:f6:07:a9:68:70:0e:da:8b:84
 # Subject: CN=emSign ECC Root CA - G3,O=eMudhra Technologies Limited,OU=emSign PKI,C=IN
 # Not Valid Before: Sun Feb 18 18:30:00 2018
 # Not Valid After : Wed Feb 18 18:30:00 2043
 # Fingerprint (SHA-256): 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B
@@ -23009,18 +22715,16 @@ CKA_VALUE MULTILINE_OCTAL
 \274\002\053\323\304\100\344\212\007\061\036\233\316\046\231\023
 \373\021\352\232\042\014\021\031\307\136\033\201\120\060\310\226
 \022\156\347\313\101\177\221\073\242\107\267\124\200\033\334\000
 \314\232\220\352\303\303\120\006\142\014\060\300\025\110\247\250
 \131\174\341\256\042\242\342\012\172\017\372\142\253\122\114\341
 \361\337\312\276\203\015\102
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "emSign Root CA - C1"
 # Issuer: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US
 # Serial Number:00:ae:cf:00:ba:c4:cf:32:f8:43:b2
 # Subject: CN=emSign Root CA - C1,O=eMudhra Inc,OU=emSign PKI,C=US
 # Not Valid Before: Sun Feb 18 18:30:00 2018
 # Not Valid After : Wed Feb 18 18:30:00 2043
 # Fingerprint (SHA-256): 12:56:09:AA:30:1D:A0:A2:49:B9:7A:82:39:CB:6A:34:21:6F:44:DC:AC:9F:39:54:B1:42:92:F2:E8:C8:60:8F
@@ -23122,18 +22826,16 @@ CKA_VALUE MULTILINE_OCTAL
 \002\211\375\266\114\142\272\103\116\023\204\162\265\256\335\034
 \336\326\265\334\126\217\130\100\132\055\336\040\114\042\203\312
 \223\250\176\356\022\100\307\326\207\117\370\337\205\002\060\034
 \024\144\344\174\226\203\021\234\260\321\132\141\113\246\017\111
 \323\000\374\241\374\344\245\377\177\255\327\060\320\307\167\177
 \276\201\007\125\060\120\040\024\365\127\070\012\250\061\121
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "emSign ECC Root CA - C3"
 # Issuer: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US
 # Serial Number:7b:71:b6:82:56:b8:12:7c:9c:a8
 # Subject: CN=emSign ECC Root CA - C3,O=eMudhra Inc,OU=emSign PKI,C=US
 # Not Valid Before: Sun Feb 18 18:30:00 2018
 # Not Valid After : Wed Feb 18 18:30:00 2043
 # Fingerprint (SHA-256): BC:4D:80:9B:15:18:9D:78:DB:3E:1D:8C:F4:F9:72:6A:79:5D:A1:64:3C:A5:F1:35:8E:1D:DB:0E:DC:0D:7E:B3
@@ -23299,18 +23001,16 @@ CKA_VALUE MULTILINE_OCTAL
 \262\042\312\026\072\120\127\304\133\103\147\305\145\142\003\111
 \001\353\103\331\330\370\236\255\317\261\143\016\105\364\240\132
 \054\233\055\305\246\300\255\250\107\364\047\114\070\015\056\033
 \111\073\122\364\350\210\203\053\124\050\324\362\065\122\264\062
 \203\142\151\144\014\221\234\237\227\352\164\026\375\037\021\006
 \232\233\364
 END
 CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
 
 # Trust for "Hongkong Post Root CA 3"
 # Issuer: CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK
 # Serial Number:08:16:5f:8a:4c:a5:ec:00:c9:93:40:df:c4:c6:ae:23:b8:1c:5a:a4
 # Subject: CN=Hongkong Post Root CA 3,O=Hongkong Post,L=Hong Kong,ST=Hong Kong,C=HK
 # Not Valid Before: Sat Jun 03 02:29:46 2017
 # Not Valid After : Tue Jun 03 02:29:46 2042
 # Fingerprint (SHA-256): 5A:2F:C0:3F:0C:83:B0:90:BB:FA:40:60:4B:09:88:44:6C:76:36:18:3D:F9:84:6E:17:10:1A:44:7F:B8:EF:D6
--- a/security/nss/lib/ckfw/builtins/manifest.mn
+++ b/security/nss/lib/ckfw/builtins/manifest.mn
@@ -1,17 +1,15 @@
 # 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 CORE_DEPTH = ../../..
 
-DIRS = testlib
-
 MODULE = nss
 MAPFILE = $(OBJDIR)/nssckbi.def
 
 EXPORTS =		\
 	nssckbi.h	\
 	$(NULL)
 
 CSRCS =			\
--- a/security/nss/lib/ckfw/builtins/nssckbi.h
+++ b/security/nss/lib/ckfw/builtins/nssckbi.h
@@ -41,18 +41,18 @@
  *   made on that branch.
  *
  * NSS_BUILTINS_LIBRARY_VERSION_MINOR is a CK_BYTE.  It's not clear
  * whether we may use its full range (0-255) or only 0-99 because
  * of the comment in the CK_VERSION type definition.
  * It's recommend to switch back to 0 after having reached version 98/99.
  */
 #define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 2
-#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 38
-#define NSS_BUILTINS_LIBRARY_VERSION "2.38"
+#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 36
+#define NSS_BUILTINS_LIBRARY_VERSION "2.36"
 
 /* These version numbers detail the semantic changes to the ckfw engine. */
 #define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1
 #define NSS_BUILTINS_HARDWARE_VERSION_MINOR 0
 
 /* These version numbers detail the semantic changes to ckbi itself
  * (new PKCS #11 objects), etc. */
 #define NSS_BUILTINS_FIRMWARE_VERSION_MAJOR 1
deleted file mode 100644
--- a/security/nss/lib/ckfw/builtins/testlib/Makefile
+++ /dev/null
@@ -1,52 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include manifest.mn
-include $(CORE_DEPTH)/coreconf/config.mk
-include config.mk
-
-EXTRA_LIBS =                                       \
-	$(DIST)/lib/$(LIB_PREFIX)nssckfw.$(LIB_SUFFIX) \
-	$(DIST)/lib/$(LIB_PREFIX)nssb.$(LIB_SUFFIX)    \
-	$(NULL)
-
-# If the OS_TARGET is WIN%, the path of shared libs could be different.
-ifeq (,$(filter-out WIN%,$(OS_TARGET)))
-# If using GCC, just inform the name of the libs.
-ifdef NS_USE_GCC
-EXTRA_SHARED_LIBS +=  \
-	-L$(NSPR_LIB_DIR) \
-	-lplc4            \
-	-lplds4           \
-	-lnspr4           \
-	$(NULL)
-else # NS_USE_GCC - If not using GCC, inform the absolute path.
-EXTRA_SHARED_LIBS += 				\
-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib  \
-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
-	$(NULL)
-endif # NS_USE_GCC
-else # OS_TARGET != WIN
-EXTRA_SHARED_LIBS +=  \
-	-L$(NSPR_LIB_DIR) \
-	-lplc4            \
-	-lplds4           \
-	-lnspr4           \
-	$(NULL)
-endif # OS_TARGET
-
-include $(CORE_DEPTH)/coreconf/rules.mk
-
-CFLAGS += -I$(CORE_DEPTH)/lib/ckfw/builtins
-
-# Generate certdata-testlib.c.
-ifndef NSS_CERTDATA-TESTLIB_TXT
-NSS_CERTDATA-TESTLIB_TXT = certdata-testlib.txt
-endif
-
-$(OBJDIR)/certdata-testlib.c: $(NSS_CERTDATA-TESTLIB_TXT)
-	@$(MAKE_OBJDIR)
-	$(PERL) ../certdata.perl $(NSS_CERTDATA-TESTLIB_TXT) $@
deleted file mode 100644
--- a/security/nss/lib/ckfw/builtins/testlib/builtins-testlib.gyp
+++ /dev/null
@@ -1,64 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-{
-  'includes': [
-    '../../../../coreconf/config.gypi'
-  ],
-  'targets': [
-    {
-      'target_name': 'nssckbi-testlib',
-      'type': 'shared_library',
-      'sources': [
-        '../anchor.c',
-        '../bfind.c',
-        '../binst.c',
-        '../bobject.c',
-        '../bsession.c',
-        '../bslot.c',
-        '../btoken.c',
-        '../ckbiver.c',
-        '../constants.c',
-        '<(certdata-testlib_c)',
-      ],
-      'dependencies': [
-        '<(DEPTH)/exports.gyp:nss_exports',
-        '<(DEPTH)/lib/ckfw/ckfw.gyp:nssckfw',
-        '<(DEPTH)/lib/base/base.gyp:nssb'
-      ],
-      'actions': [
-        {
-          'msvs_cygwin_shell': 0,
-          'action': [
-            'python',
-            '../certdata.py',
-            'certdata-testlib.txt',
-            '<@(_outputs)',
-          ],
-          'inputs': [
-            '../certdata.py',
-            '../certdata.perl',
-            'certdata-testlib.txt'
-          ],
-          'outputs': [
-            '<(certdata-testlib_c)'
-          ],
-          'action_name': 'generate_certdata-testlib_c'
-        }
-      ],
-      'variables': {
-        'mapfile': '../nssckbi.def',
-        'certdata-testlib_c': '<(INTERMEDIATE_DIR)/certdata-testlib.c',
-      }
-    }
-  ],
-  'target_defaults': {
-    'include_dirs': [
-      '.',
-      '..'
-    ]
-  },
-  'variables': {
-    'module': 'nss',
-  }
-}
deleted file mode 100644
--- a/security/nss/lib/ckfw/builtins/testlib/certdata-testlib.txt
+++ /dev/null
@@ -1,479 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#
-# certdata-testlib.txt
-#
-# To safely test the Distrust Fields it was generated a testlib called:
-# DLL_PREFIX+nssckbi-testlib+DLL_SUFFIX
-# Example: libnssckbi-testlib.so, for Linux.
-#
-# This testlib is populated with three expired and self-signed certificates, as
-# defined in this file. The only purpose of this testlib is to provide content
-# to gtests defined in softoken_nssckbi_testlib_gtest.cc.
-#
-# The certificate and private key used here are stored in this same folder,
-# in txt files named like: "testcert_<name>.txt".
-#
-# We have three certificates here:
-# 1 - no_distrust:
-#   - Both distrust fields are set with CK_FALSE, the default.
-#
-# 2 - ok_distrust:
-#   - Each distrust field is set with a different and valid date.
-#
-# 3 - err_distrust:
-#   - The server/tls distrust field is set with CK_TRUE. These fields must be
-#     CK_FALSE when no schedule is set. Otherwise, must hold a valid encoded
-      timestamp.
-#   - The email distrust field is set with an incomplete and invalid encoded
-#     timestamp.
-#
-# These fields are filled when the cert is loaded and cannot be changed.
-#
-BEGINDATA
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_BUILTIN_ROOT_LIST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Test with Invalid NSS Builtin Trusted Roots"
-
-#
-# Certificate "Distrust Fields Test - no_distrust"
-#
-# Issuer: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST no_distrust
-# Serial Number:73:f8:bc:37:a3:4a:5f:26:13:64:dc:4e:c6:58:4e:94:2a:24:22:b1
-# Subject: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST no_distrust
-# Not Valid Before: Tue Jul 16 06:32:42 2019
-# Not Valid After : Fri Jul 26 06:32:42 2019
-# Fingerprint (SHA-256): 53:AD:AE:B1:D4:D8:B6:34:59:60:26:FA:0D:56:B0:98:0A:E0:8D:E3:90:E5:13:FA:E9:BE:EA:5D:D5:E6:79:02
-# Fingerprint (SHA1): 11:80:28:5A:A4:79:45:A2:AB:2F:A3:27:28:6A:CA:DB:0F:D7:30:FC
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Distrust Fields Test - no_distrust"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\146\061\031\060\027\006\003\125\004\003\014\020\124\105\123
-\124\040\156\157\137\144\151\163\164\162\165\163\164\061\014\060
-\012\006\003\125\004\013\014\003\116\123\123\061\020\060\016\006
-\003\125\004\013\014\007\115\157\172\151\154\154\141\061\015\060
-\013\006\003\125\004\007\014\004\124\105\123\124\061\015\060\013
-\006\003\125\004\010\014\004\124\105\123\124\061\013\060\011\006
-\003\125\004\006\023\002\104\105
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\146\061\031\060\027\006\003\125\004\003\014\020\124\105\123
-\124\040\156\157\137\144\151\163\164\162\165\163\164\061\014\060
-\012\006\003\125\004\013\014\003\116\123\123\061\020\060\016\006
-\003\125\004\013\014\007\115\157\172\151\154\154\141\061\015\060
-\013\006\003\125\004\007\014\004\124\105\123\124\061\015\060\013
-\006\003\125\004\010\014\004\124\105\123\124\061\013\060\011\006
-\003\125\004\006\023\002\104\105
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\024\163\370\274\067\243\112\137\046\023\144\334\116\306\130
-\116\224\052\044\042\261
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\255\060\202\002\225\240\003\002\001\002\002\024\163
-\370\274\067\243\112\137\046\023\144\334\116\306\130\116\224\052
-\044\042\261\060\015\006\011\052\206\110\206\367\015\001\001\013
-\005\000\060\146\061\031\060\027\006\003\125\004\003\014\020\124
-\105\123\124\040\156\157\137\144\151\163\164\162\165\163\164\061
-\014\060\012\006\003\125\004\013\014\003\116\123\123\061\020\060
-\016\006\003\125\004\013\014\007\115\157\172\151\154\154\141\061
-\015\060\013\006\003\125\004\007\014\004\124\105\123\124\061\015
-\060\013\006\003\125\004\010\014\004\124\105\123\124\061\013\060
-\011\006\003\125\004\006\023\002\104\105\060\036\027\015\061\071
-\060\067\061\066\060\066\063\062\064\062\132\027\015\061\071\060
-\067\062\066\060\066\063\062\064\062\132\060\146\061\031\060\027
-\006\003\125\004\003\014\020\124\105\123\124\040\156\157\137\144
-\151\163\164\162\165\163\164\061\014\060\012\006\003\125\004\013
-\014\003\116\123\123\061\020\060\016\006\003\125\004\013\014\007
-\115\157\172\151\154\154\141\061\015\060\013\006\003\125\004\007
-\014\004\124\105\123\124\061\015\060\013\006\003\125\004\010\014
-\004\124\105\123\124\061\013\060\011\006\003\125\004\006\023\002
-\104\105\060\202\001\042\060\015\006\011\052\206\110\206\367\015
-\001\001\001\005\000\003\202\001\017\000\060\202\001\012\002\202
-\001\001\000\307\367\273\061\133\151\242\334\233\052\044\123\006
-\275\040\214\266\303\135\365\220\104\106\076\100\144\062\366\325
-\270\307\223\230\002\227\150\304\102\146\246\167\113\324\031\136
-\132\140\006\247\062\145\074\257\115\330\256\244\325\003\176\203
-\375\332\345\365\140\163\173\230\224\122\135\144\176\075\151\012
-\275\044\307\317\343\126\332\221\240\171\141\372\107\137\210\362
-\020\231\212\120\103\051\010\233\357\005\201\350\375\202\104\106
-\072\270\323\151\164\013\201\355\004\304\002\017\042\071\022\072
-\223\061\266\353\220\057\130\221\255\024\166\125\241\212\054\132
-\056\120\222\072\332\275\356\037\232\026\344\336\043\052\074\112
-\006\246\100\266\254\065\301\167\276\170\027\127\054\302\254\146
-\171\327\314\305\264\077\044\101\347\105\337\267\051\110\041\113
-\302\043\214\036\015\357\330\167\037\204\353\362\021\232\254\220
-\271\171\170\306\077\016\353\045\376\171\154\125\323\326\363\136
-\230\333\160\242\231\016\300\041\221\045\262\053\035\243\351\363
-\233\013\073\002\233\030\152\324\132\270\203\240\163\167\272\142
-\052\326\053\002\003\001\000\001\243\123\060\121\060\035\006\003
-\125\035\016\004\026\004\024\272\015\343\222\236\200\244\163\217
-\005\277\352\147\036\243\071\077\241\274\346\060\037\006\003\125
-\035\043\004\030\060\026\200\024\272\015\343\222\236\200\244\163
-\217\005\277\352\147\036\243\071\077\241\274\346\060\017\006\003
-\125\035\023\001\001\377\004\005\060\003\001\001\377\060\015\006
-\011\052\206\110\206\367\015\001\001\013\005\000\003\202\001\001
-\000\251\350\344\354\346\066\155\375\144\242\257\175\265\332\166
-\233\334\141\326\230\160\122\303\221\002\257\313\252\330\003\330
-\012\133\050\343\171\110\243\115\314\026\275\006\005\200\222\147
-\166\250\275\323\024\367\317\255\034\264\240\003\114\023\044\171
-\126\011\012\104\256\306\327\034\376\136\323\056\035\222\041\031
-\350\372\052\242\025\362\236\176\232\002\300\010\013\127\256\314
-\315\042\132\030\333\064\245\203\174\212\065\250\364\025\070\167
-\177\312\033\301\377\273\046\215\340\007\204\260\210\056\275\351
-\353\127\053\050\165\322\146\223\064\324\233\152\112\152\000\314
-\360\205\057\172\037\061\066\104\312\324\362\156\265\114\130\241
-\262\333\056\212\044\264\023\314\144\062\172\151\167\007\273\104
-\253\173\054\025\073\174\027\167\176\362\037\232\067\073\220\257
-\257\001\013\125\156\350\234\207\261\370\301\143\106\131\062\146
-\041\227\107\340\262\042\034\030\043\336\257\115\027\250\024\171
-\121\210\336\232\174\052\134\002\100\014\225\336\224\017\177\015
-\354\253\245\347\057\340\214\070\003\375\266\023\017\001\373\236
-\030
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_FALSE
-CKA_NSS_EMAIL_DISTRUST_AFTER CK_BBOOL CK_FALSE
-
-# Trust for "Distrust Fields Test - no_distrust"
-# Issuer: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST no_distrust
-# Serial Number:73:f8:bc:37:a3:4a:5f:26:13:64:dc:4e:c6:58:4e:94:2a:24:22:b1
-# Subject: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST no_distrust
-# Not Valid Before: Tue Jul 16 06:32:42 2019
-# Not Valid After : Fri Jul 26 06:32:42 2019
-# Fingerprint (SHA-256): 53:AD:AE:B1:D4:D8:B6:34:59:60:26:FA:0D:56:B0:98:0A:E0:8D:E3:90:E5:13:FA:E9:BE:EA:5D:D5:E6:79:02
-# Fingerprint (SHA1): 11:80:28:5A:A4:79:45:A2:AB:2F:A3:27:28:6A:CA:DB:0F:D7:30:FC
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Distrust Fields Test - no_distrust"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\021\200\050\132\244\171\105\242\253\057\243\047\050\152\312\333
-\017\327\060\374
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\130\367\262\151\111\255\236\234\203\221\335\036\366\326\325\026
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\146\061\031\060\027\006\003\125\004\003\014\020\124\105\123
-\124\040\156\157\137\144\151\163\164\162\165\163\164\061\014\060
-\012\006\003\125\004\013\014\003\116\123\123\061\020\060\016\006
-\003\125\004\013\014\007\115\157\172\151\154\154\141\061\015\060
-\013\006\003\125\004\007\014\004\124\105\123\124\061\015\060\013
-\006\003\125\004\010\014\004\124\105\123\124\061\013\060\011\006
-\003\125\004\006\023\002\104\105
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\024\163\370\274\067\243\112\137\046\023\144\334\116\306\130
-\116\224\052\044\042\261
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "Distrust Fields Test - ok_distrust"
-#
-# Issuer: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST ok_distrust
-# Serial Number:3a:44:dc:9d:54:3f:5f:aa:b8:26:4f:1d:f8:5a:47:36:29:3a:1b:bc
-# Subject: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST ok_distrust
-# Not Valid Before: Tue Jul 16 06:32:42 2019
-# Not Valid After : Fri Jul 26 06:32:42 2019
-# Fingerprint (SHA-256): BA:43:4C:9D:21:8E:E7:15:8E:4D:11:7E:5B:4B:EF:57:D3:01:6C:D7:E5:6B:7B:6C:85:62:35:44:44:59:FE:5B
-# Fingerprint (SHA1): F6:4F:33:50:3D:DB:1C:3D:BE:BE:79:9F:D6:B6:21:3A:AA:D1:55:4F
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Distrust Fields Test - ok_distrust"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\146\061\031\060\027\006\003\125\004\003\014\020\124\105\123
-\124\040\157\153\137\144\151\163\164\162\165\163\164\061\014\060
-\012\006\003\125\004\013\014\003\116\123\123\061\020\060\016\006
-\003\125\004\013\014\007\115\157\172\151\154\154\141\061\015\060
-\013\006\003\125\004\007\014\004\124\105\123\124\061\015\060\013
-\006\003\125\004\010\014\004\124\105\123\124\061\013\060\011\006
-\003\125\004\006\023\002\104\105
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\146\061\031\060\027\006\003\125\004\003\014\020\124\105\123
-\124\040\157\153\137\144\151\163\164\162\165\163\164\061\014\060
-\012\006\003\125\004\013\014\003\116\123\123\061\020\060\016\006
-\003\125\004\013\014\007\115\157\172\151\154\154\141\061\015\060
-\013\006\003\125\004\007\014\004\124\105\123\124\061\015\060\013
-\006\003\125\004\010\014\004\124\105\123\124\061\013\060\011\006
-\003\125\004\006\023\002\104\105
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\024\072\104\334\235\124\077\137\252\270\046\117\035\370\132
-\107\066\051\072\033\274
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\255\060\202\002\225\240\003\002\001\002\002\024\072
-\104\334\235\124\077\137\252\270\046\117\035\370\132\107\066\051
-\072\033\274\060\015\006\011\052\206\110\206\367\015\001\001\013
-\005\000\060\146\061\031\060\027\006\003\125\004\003\014\020\124
-\105\123\124\040\157\153\137\144\151\163\164\162\165\163\164\061
-\014\060\012\006\003\125\004\013\014\003\116\123\123\061\020\060
-\016\006\003\125\004\013\014\007\115\157\172\151\154\154\141\061
-\015\060\013\006\003\125\004\007\014\004\124\105\123\124\061\015
-\060\013\006\003\125\004\010\014\004\124\105\123\124\061\013\060
-\011\006\003\125\004\006\023\002\104\105\060\036\027\015\061\071
-\060\067\061\066\060\066\063\062\064\062\132\027\015\061\071\060
-\067\062\066\060\066\063\062\064\062\132\060\146\061\031\060\027
-\006\003\125\004\003\014\020\124\105\123\124\040\157\153\137\144
-\151\163\164\162\165\163\164\061\014\060\012\006\003\125\004\013
-\014\003\116\123\123\061\020\060\016\006\003\125\004\013\014\007
-\115\157\172\151\154\154\141\061\015\060\013\006\003\125\004\007
-\014\004\124\105\123\124\061\015\060\013\006\003\125\004\010\014
-\004\124\105\123\124\061\013\060\011\006\003\125\004\006\023\002
-\104\105\060\202\001\042\060\015\006\011\052\206\110\206\367\015
-\001\001\001\005\000\003\202\001\017\000\060\202\001\012\002\202
-\001\001\000\272\036\174\330\225\102\315\034\063\337\145\114\060
-\061\036\024\065\051\216\357\013\150\107\361\256\217\363\066\326
-\124\247\034\227\202\315\151\263\237\125\340\377\047\125\050\016
-\152\210\355\141\202\062\263\233\300\152\220\356\200\026\124\001
-\163\305\024\357\315\374\220\267\370\170\316\022\056\216\161\145
-\341\324\121\271\026\306\026\250\121\201\107\254\231\142\046\012
-\043\260\242\356\051\303\206\277\341\377\304\117\066\373\340\073
-\143\076\347\363\157\130\317\271\165\333\127\015\316\267\117\055
-\232\240\271\116\250\160\364\271\224\203\215\137\267\066\271\377
-\177\014\337\033\326\312\374\320\247\053\107\345\355\127\067\007
-\322\220\200\376\053\266\132\044\160\266\154\062\265\375\262\176
-\362\362\257\031\364\147\251\071\337\331\146\057\005\222\377\360
-\001\247\252\155\106\035\235\065\222\346\351\301\204\335\344\012
-\361\366\061\044\030\103\331\116\113\137\121\036\253\042\314\260
-\005\231\251\002\102\002\161\071\337\330\304\150\215\220\164\346
-\170\245\366\360\237\353\362\113\203\362\277\320\074\064\364\022
-\031\105\025\002\003\001\000\001\243\123\060\121\060\035\006\003
-\125\035\016\004\026\004\024\034\100\252\220\333\317\113\002\023
-\153\030\071\246\014\327\332\262\164\374\075\060\037\006\003\125
-\035\043\004\030\060\026\200\024\034\100\252\220\333\317\113\002
-\023\153\030\071\246\014\327\332\262\164\374\075\060\017\006\003
-\125\035\023\001\001\377\004\005\060\003\001\001\377\060\015\006
-\011\052\206\110\206\367\015\001\001\013\005\000\003\202\001\001
-\000\042\041\036\227\272\132\106\356\112\272\302\204\014\360\134
-\331\034\364\137\063\334\045\076\321\034\117\361\311\254\177\017
-\236\076\121\327\155\046\347\241\205\367\254\061\211\276\011\117
-\057\364\175\370\016\226\062\004\211\153\047\356\343\064\350\250
-\231\007\041\164\014\374\216\235\206\203\156\310\013\360\342\237
-\103\025\274\237\325\106\321\163\123\036\363\051\136\074\205\102
-\270\127\146\303\060\022\057\104\073\102\030\325\123\376\037\106
-\143\113\011\164\167\374\075\327\362\002\265\127\234\367\302\114
-\371\374\251\106\221\343\004\047\227\125\316\024\046\366\370\207
-\077\025\236\122\116\020\241\072\211\140\100\043\010\105\105\351
-\304\130\373\313\345\272\232\334\230\011\013\335\261\230\202\353
-\155\003\353\233\152\241\212\064\246\152\300\246\356\357\106\071
-\347\211\144\275\212\014\035\247\112\221\131\070\230\122\367\317
-\134\060\254\155\061\234\364\077\161\256\236\175\077\242\240\353
-\161\360\355\362\337\215\172\055\123\332\352\264\026\124\012\363
-\040\124\052\027\300\076\174\012\272\370\377\264\170\150\343\226
-\105
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-# For Server Distrust After: Wed Jun 17 00:00:00 2020
-CKA_NSS_SERVER_DISTRUST_AFTER MULTILINE_OCTAL
-\062\060\060\066\061\067\060\060\060\060\060\060\132
-END
-# For Email Distrust After: Sun Oct 14 08:53:20 2007
-CKA_NSS_EMAIL_DISTRUST_AFTER MULTILINE_OCTAL
-\060\067\061\060\061\064\060\070\065\063\062\060\132
-END
-
-# Trust for "Distrust Fields Test - ok_distrust"
-# Issuer: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST ok_distrust
-# Serial Number:3a:44:dc:9d:54:3f:5f:aa:b8:26:4f:1d:f8:5a:47:36:29:3a:1b:bc
-# Subject: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST ok_distrust
-# Not Valid Before: Tue Jul 16 06:32:42 2019
-# Not Valid After : Fri Jul 26 06:32:42 2019
-# Fingerprint (SHA-256): BA:43:4C:9D:21:8E:E7:15:8E:4D:11:7E:5B:4B:EF:57:D3:01:6C:D7:E5:6B:7B:6C:85:62:35:44:44:59:FE:5B
-# Fingerprint (SHA1): F6:4F:33:50:3D:DB:1C:3D:BE:BE:79:9F:D6:B6:21:3A:AA:D1:55:4F
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Distrust Fields Test - ok_distrust"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\366\117\063\120\075\333\034\075\276\276\171\237\326\266\041\072
-\252\321\125\117
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\045\304\210\204\375\245\150\220\305\310\325\205\077\365\302\146
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\146\061\031\060\027\006\003\125\004\003\014\020\124\105\123
-\124\040\157\153\137\144\151\163\164\162\165\163\164\061\014\060
-\012\006\003\125\004\013\014\003\116\123\123\061\020\060\016\006
-\003\125\004\013\014\007\115\157\172\151\154\154\141\061\015\060
-\013\006\003\125\004\007\014\004\124\105\123\124\061\015\060\013
-\006\003\125\004\010\014\004\124\105\123\124\061\013\060\011\006
-\003\125\004\006\023\002\104\105
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\024\072\104\334\235\124\077\137\252\270\046\117\035\370\132
-\107\066\051\072\033\274
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
-
-#
-# Certificate "Distrust Fields Test - err_distrust"
-#
-# Issuer: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST err_distrust
-# Serial Number:60:fe:b3:a1:c8:c1:30:fc:02:f0:90:9b:6b:b7:08:5e:78:e5:fb:dc
-# Subject: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST err_distrust
-# Not Valid Before: Tue Jul 16 06:32:42 2019
-# Not Valid After : Fri Jul 26 06:32:42 2019
-# Fingerprint (SHA-256): E0:80:A0:7E:D7:53:52:FB:71:B5:05:03:80:C3:DB:92:C7:90:3D:26:3F:26:D5:BF:E5:87:FC:7C:46:EC:F6:35
-# Fingerprint (SHA1): D4:54:DB:63:51:FB:68:61:DA:CD:61:D9:1B:F8:51:EB:CE:34:41:3D
-CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Distrust Fields Test - err_distrust"
-CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
-CKA_SUBJECT MULTILINE_OCTAL
-\060\147\061\032\060\030\006\003\125\004\003\014\021\124\105\123
-\124\040\145\162\162\137\144\151\163\164\162\165\163\164\061\014
-\060\012\006\003\125\004\013\014\003\116\123\123\061\020\060\016
-\006\003\125\004\013\014\007\115\157\172\151\154\154\141\061\015
-\060\013\006\003\125\004\007\014\004\124\105\123\124\061\015\060
-\013\006\003\125\004\010\014\004\124\105\123\124\061\013\060\011
-\006\003\125\004\006\023\002\104\105
-END
-CKA_ID UTF8 "0"
-CKA_ISSUER MULTILINE_OCTAL
-\060\147\061\032\060\030\006\003\125\004\003\014\021\124\105\123
-\124\040\145\162\162\137\144\151\163\164\162\165\163\164\061\014
-\060\012\006\003\125\004\013\014\003\116\123\123\061\020\060\016
-\006\003\125\004\013\014\007\115\157\172\151\154\154\141\061\015
-\060\013\006\003\125\004\007\014\004\124\105\123\124\061\015\060
-\013\006\003\125\004\010\014\004\124\105\123\124\061\013\060\011
-\006\003\125\004\006\023\002\104\105
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\024\140\376\263\241\310\301\060\374\002\360\220\233\153\267
-\010\136\170\345\373\334
-END
-CKA_VALUE MULTILINE_OCTAL
-\060\202\003\257\060\202\002\227\240\003\002\001\002\002\024\140
-\376\263\241\310\301\060\374\002\360\220\233\153\267\010\136\170
-\345\373\334\060\015\006\011\052\206\110\206\367\015\001\001\013
-\005\000\060\147\061\032\060\030\006\003\125\004\003\014\021\124
-\105\123\124\040\145\162\162\137\144\151\163\164\162\165\163\164
-\061\014\060\012\006\003\125\004\013\014\003\116\123\123\061\020
-\060\016\006\003\125\004\013\014\007\115\157\172\151\154\154\141
-\061\015\060\013\006\003\125\004\007\014\004\124\105\123\124\061
-\015\060\013\006\003\125\004\010\014\004\124\105\123\124\061\013
-\060\011\006\003\125\004\006\023\002\104\105\060\036\027\015\061
-\071\060\067\061\066\060\066\063\062\064\062\132\027\015\061\071
-\060\067\062\066\060\066\063\062\064\062\132\060\147\061\032\060
-\030\006\003\125\004\003\014\021\124\105\123\124\040\145\162\162
-\137\144\151\163\164\162\165\163\164\061\014\060\012\006\003\125
-\004\013\014\003\116\123\123\061\020\060\016\006\003\125\004\013
-\014\007\115\157\172\151\154\154\141\061\015\060\013\006\003\125
-\004\007\014\004\124\105\123\124\061\015\060\013\006\003\125\004
-\010\014\004\124\105\123\124\061\013\060\011\006\003\125\004\006
-\023\002\104\105\060\202\001\042\060\015\006\011\052\206\110\206
-\367\015\001\001\001\005\000\003\202\001\017\000\060\202\001\012
-\002\202\001\001\000\321\114\327\160\070\075\364\033\323\322\310
-\337\270\071\333\312\356\066\304\105\170\071\227\203\335\012\013
-\107\004\165\264\325\014\054\103\051\007\017\224\166\330\057\051
-\342\232\254\326\232\070\331\265\140\205\234\202\074\320\375\103
-\303\343\216\056\215\317\155\142\311\354\245\047\050\257\046\365
-\156\124\272\245\172\016\122\145\054\326\357\136\112\364\352\012
-\360\112\207\363\316\036\254\155\214\216\362\261\021\270\016\171
-\011\323\105\072\206\344\141\267\256\065\367\315\022\225\133\165
-\351\066\167\326\262\122\370\233\222\107\067\307\272\145\242\157
-\377\054\262\175\172\161\140\032\335\161\323\037\307\261\315\245
-\377\044\110\201\124\142\337\146\162\032\344\366\101\235\252\263
-\226\153\343\046\300\231\240\025\241\031\202\232\374\221\176\240
-\061\234\071\330\116\171\150\046\307\102\160\104\377\320\147\263
-\165\312\377\246\235\175\001\063\246\003\273\247\254\123\321\063
-\373\316\220\012\056\200\314\354\341\037\065\370\112\322\065\346
-\363\067\023\034\365\011\267\320\247\227\332\276\175\246\060\010
-\117\253\217\234\337\002\003\001\000\001\243\123\060\121\060\035
-\006\003\125\035\016\004\026\004\024\121\202\330\003\344\310\170
-\002\314\331\364\031\015\224\214\027\241\373\266\000\060\037\006
-\003\125\035\043\004\030\060\026\200\024\121\202\330\003\344\310
-\170\002\314\331\364\031\015\224\214\027\241\373\266\000\060\017
-\006\003\125\035\023\001\001\377\004\005\060\003\001\001\377\060
-\015\006\011\052\206\110\206\367\015\001\001\013\005\000\003\202
-\001\001\000\162\225\235\140\215\374\232\051\167\366\325\002\006
-\370\057\245\115\123\201\060\371\363\301\340\132\123\100\026\372
-\012\277\245\017\030\047\005\244\057\243\057\374\331\317\063\177
-\117\204\065\314\313\046\140\345\151\256\107\160\253\027\022\137
-\271\022\310\365\273\273\171\346\123\224\215\004\035\032\365\243
-\047\030\246\342\022\121\155\315\117\320\244\313\240\061\136\030
-\310\005\112\006\244\176\042\054\235\221\145\123\156\276\001\163
-\043\233\071\147\143\031\377\035\031\223\224\176\025\065\225\052
-\015\357\036\360\306\152\056\171\341\071\151\330\064\110\100\172
-\126\160\243\166\277\133\102\210\341\032\203\002\003\042\073\252
-\116\376\043\112\377\337\231\301\314\227\016\111\106\131\260\045
-\315\266\000\015\337\301\213\276\141\250\344\261\152\024\350\361
-\246\301\242\066\335\330\263\373\230\211\320\047\235\266\254\347
-\371\101\126\046\111\001\250\373\233\031\371\304\374\167\271\144
-\025\277\276\355\216\067\024\012\121\231\256\205\335\264\207\047
-\231\317\306\103\273\262\234\240\153\152\063\071\151\254\113\314
-\336\067\230
-END
-CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE
-CKA_NSS_SERVER_DISTRUST_AFTER CK_BBOOL CK_TRUE
-# For Email Distrust After: Sun Oct 14 08:53:20 2007 # Missing \132 at end
-CKA_NSS_EMAIL_DISTRUST_AFTER MULTILINE_OCTAL
-\060\067\061\060\061\064\060\070\065\063\062\060
-END
-
-# Trust for "Distrust Fields Test - err_distrust"
-# Issuer: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST err_distrust
-# Serial Number:60:fe:b3:a1:c8:c1:30:fc:02:f0:90:9b:6b:b7:08:5e:78:e5:fb:dc
-# Subject: C=DE,ST=TEST,L=TEST,OU=Mozilla,OU=NSS,CN=TEST err_distrust
-# Not Valid Before: Tue Jul 16 06:32:42 2019
-# Not Valid After : Fri Jul 26 06:32:42 2019
-# Fingerprint (SHA-256): E0:80:A0:7E:D7:53:52:FB:71:B5:05:03:80:C3:DB:92:C7:90:3D:26:3F:26:D5:BF:E5:87:FC:7C:46:EC:F6:35
-# Fingerprint (SHA1): D4:54:DB:63:51:FB:68:61:DA:CD:61:D9:1B:F8:51:EB:CE:34:41:3D
-CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
-CKA_TOKEN CK_BBOOL CK_TRUE
-CKA_PRIVATE CK_BBOOL CK_FALSE
-CKA_MODIFIABLE CK_BBOOL CK_FALSE
-CKA_LABEL UTF8 "Distrust Fields Test - err_distrust"
-CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\324\124\333\143\121\373\150\141\332\315\141\331\033\370\121\353
-\316\064\101\075
-END
-CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\105\150\314\050\103\366\315\141\322\277\363\133\217\305\124\273
-END
-CKA_ISSUER MULTILINE_OCTAL
-\060\147\061\032\060\030\006\003\125\004\003\014\021\124\105\123
-\124\040\145\162\162\137\144\151\163\164\162\165\163\164\061\014
-\060\012\006\003\125\004\013\014\003\116\123\123\061\020\060\016
-\006\003\125\004\013\014\007\115\157\172\151\154\154\141\061\015
-\060\013\006\003\125\004\007\014\004\124\105\123\124\061\015\060
-\013\006\003\125\004\010\014\004\124\105\123\124\061\013\060\011
-\006\003\125\004\006\023\002\104\105
-END
-CKA_SERIAL_NUMBER MULTILINE_OCTAL
-\002\024\140\376\263\241\310\301\060\374\002\360\220\233\153\267
-\010\136\170\345\373\334
-END
-CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
-CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
deleted file mode 100644
--- a/security/nss/lib/ckfw/builtins/testlib/config.mk
+++ /dev/null
@@ -1,38 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#
-#  Override TARGETS variable so that only shared libraries
-#  are specifed as dependencies within rules.mk.
-#
-
-TARGETS        = $(SHARED_LIBRARY)
-LIBRARY        =
-IMPORT_LIBRARY =
-PROGRAM        =
-
-ifeq (,$(filter-out WIN%,$(OS_TARGET)))
-	SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
-	RES = $(OBJDIR)/$(LIBRARY_NAME).res
-	RESNAME = $(LIBRARY_NAME).rc
-endif
-
-ifdef BUILD_IDG
-	DEFINES += -DNSSDEBUG
-endif
-
-# Needed for compilation of $(OBJDIR)/certdata.c
-INCLUDES += -I.
-
-#
-# To create a loadable module on Darwin, we must use -bundle.
-#
-ifeq ($(OS_TARGET),Darwin)
-DSO_LDOPTS = -bundle
-endif
-
-ifdef USE_GCOV
-DSO_LDOPTS += --coverage
-endif
deleted file mode 100644
--- a/security/nss/lib/ckfw/builtins/testlib/manifest.mn
+++ /dev/null
@@ -1,25 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-CORE_DEPTH = ../../../..
-
-MODULE = nss
-
-CSRCS =			\
-	../anchor.c		\
-	../bfind.c		\
-	../binst.c		\
-	../bobject.c		\
-	../bsession.c		\
-	../bslot.c		\
-	../btoken.c		\
-	../ckbiver.c		\
-	../constants.c		\
-	certdata-testlib.c	\
-	$(NULL)
-
-REQUIRES = nspr
-
-LIBRARY_NAME = nssckbi-testlib
deleted file mode 100644
--- a/security/nss/lib/ckfw/builtins/testlib/nssckbi-testlib.rc
+++ /dev/null
@@ -1,52 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "../nssckbi.h"
-#include <winver.h>
-
-#define MY_LIBNAME "nssckbi-testlib"
-#define MY_FILEDESCRIPTION "A Test of NSS Builtin Trusted Roots (testlib)"
-#define MY_FILEFLAGS_1 0x0L
-
-#ifdef WINNT
-#define MY_FILEOS VOS_NT_WINDOWS32
-#else
-#define MY_FILEOS VOS__WINDOWS32
-#endif
-
-#define MY_INTERNAL_NAME MY_LIBNAME
-
-/////////////////////////////////////////////////////////////////////////////
-//
-// Version-information resource
-//
-
-VS_VERSION_INFO VERSIONINFO
- FILEVERSION NSS_BUILTINS_LIBRARY_VERSION_MAJOR,NSS_BUILTINS_LIBRARY_VERSION_MINOR,0,0
- PRODUCTVERSION NSS_BUILTINS_LIBRARY_VERSION_MAJOR,NSS_BUILTINS_LIBRARY_VERSION_MINOR,0,0
- FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
- FILEFLAGS MY_FILEFLAGS_1
- FILEOS MY_FILEOS
- FILETYPE VFT_DLL
- FILESUBTYPE 0x0L // not used
-
-BEGIN
-    BLOCK "StringFileInfo"
-    BEGIN
-        BLOCK "040904B0" // Lang=US English, CharSet=Unicode
-        BEGIN
-            VALUE "CompanyName", "Mozilla Foundation\0"
-            VALUE "FileDescription", MY_FILEDESCRIPTION "\0"
-            VALUE "FileVersion", NSS_BUILTINS_LIBRARY_VERSION "\0"
-            VALUE "InternalName", MY_INTERNAL_NAME "\0"
-            VALUE "OriginalFilename", MY_INTERNAL_NAME ".dll\0"
-            VALUE "ProductName", "Network Security Services\0"
-            VALUE "ProductVersion", NSS_BUILTINS_LIBRARY_VERSION "\0"
-        END
-    END
-    BLOCK "VarFileInfo"
-    BEGIN
-        VALUE "Translation", 0x409, 1200
-    END
-END
deleted file mode 100644
--- a/security/nss/lib/ckfw/builtins/testlib/testcert_err_distrust.txt
+++ /dev/null
@@ -1,50 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrzCCApegAwIBAgIUYP6zocjBMPwC8JCba7cIXnjl+9wwDQYJKoZIhvcNAQEL
-BQAwZzEaMBgGA1UEAwwRVEVTVCBlcnJfZGlzdHJ1c3QxDDAKBgNVBAsMA05TUzEQ
-MA4GA1UECwwHTW96aWxsYTENMAsGA1UEBwwEVEVTVDENMAsGA1UECAwEVEVTVDEL
-MAkGA1UEBhMCREUwHhcNMTkwNzE2MDYzMjQyWhcNMTkwNzI2MDYzMjQyWjBnMRow
-GAYDVQQDDBFURVNUIGVycl9kaXN0cnVzdDEMMAoGA1UECwwDTlNTMRAwDgYDVQQL
-DAdNb3ppbGxhMQ0wCwYDVQQHDARURVNUMQ0wCwYDVQQIDARURVNUMQswCQYDVQQG
-EwJERTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANFM13A4PfQb09LI
-37g528ruNsRFeDmXg90KC0cEdbTVDCxDKQcPlHbYLynimqzWmjjZtWCFnII80P1D
-w+OOLo3PbWLJ7KUnKK8m9W5UuqV6DlJlLNbvXkr06grwSofzzh6sbYyO8rERuA55
-CdNFOobkYbeuNffNEpVbdek2d9ayUvibkkc3x7plom//LLJ9enFgGt1x0x/Hsc2l
-/yRIgVRi32ZyGuT2QZ2qs5Zr4ybAmaAVoRmCmvyRfqAxnDnYTnloJsdCcET/0Gez
-dcr/pp19ATOmA7unrFPRM/vOkAougMzs4R81+ErSNebzNxMc9Qm30KeX2r59pjAI
-T6uPnN8CAwEAAaNTMFEwHQYDVR0OBBYEFFGC2APkyHgCzNn0GQ2UjBeh+7YAMB8G
-A1UdIwQYMBaAFFGC2APkyHgCzNn0GQ2UjBeh+7YAMA8GA1UdEwEB/wQFMAMBAf8w
-DQYJKoZIhvcNAQELBQADggEBAHKVnWCN/Jopd/bVAgb4L6VNU4Ew+fPB4FpTQBb6
-Cr+lDxgnBaQvoy/82c8zf0+ENczLJmDlaa5HcKsXEl+5Esj1u7t55lOUjQQdGvWj
-Jxim4hJRbc1P0KTLoDFeGMgFSgakfiIsnZFlU26+AXMjmzlnYxn/HRmTlH4VNZUq
-De8e8MZqLnnhOWnYNEhAelZwo3a/W0KI4RqDAgMiO6pO/iNK/9+ZwcyXDklGWbAl
-zbYADd/Bi75hqOSxahTo8abBojbd2LP7mInQJ522rOf5QVYmSQGo+5sZ+cT8d7lk
-Fb++7Y43FApRma6F3bSHJ5nPxkO7spyga2ozOWmsS8zeN5g=
------END CERTIFICATE-----
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDRTNdwOD30G9PS
-yN+4OdvK7jbERXg5l4PdCgtHBHW01QwsQykHD5R22C8p4pqs1po42bVghZyCPND9
-Q8Pjji6Nz21iyeylJyivJvVuVLqleg5SZSzW715K9OoK8EqH884erG2MjvKxEbgO
-eQnTRTqG5GG3rjX3zRKVW3XpNnfWslL4m5JHN8e6ZaJv/yyyfXpxYBrdcdMfx7HN
-pf8kSIFUYt9mchrk9kGdqrOWa+MmwJmgFaEZgpr8kX6gMZw52E55aCbHQnBE/9Bn
-s3XK/6adfQEzpgO7p6xT0TP7zpAKLoDM7OEfNfhK0jXm8zcTHPUJt9Cnl9q+faYw
-CE+rj5zfAgMBAAECggEAfgyGDtqATTxZFK/PNFb8DLnsF8YywpSCYKOE6S9BaDeK
-jjmgQtVaNzy5IsOLHZ5c4PIUbt3oxPK1dmHSXoApf1Q173HmaAwuT1XqJ5k1kyTv
-7SVrnMIqCoB3V0Eh0cC+GPEFRMpuVL90FptElI0z0ztFsmZjsCo8D+E2IM6h25UQ
-MiZmJNb2qk+64Ef9yiKyUBA15y7zBUOIsRMDQlREpHA0T6N2YC1b98r73RHYHc8O
-+rQixX4ZtB0gl97nKdOjEX9ECfwd5nUXVUFNMthozYMy2VmpU9eH3zP33vcZNvaD
-5GX2lvSkWLXEb6Zc/yWdBPrijSVeD+qwZ6tDBPgskQKBgQD4EbzuiFLEoFE/IdCD
-zP1cj28kmUU6oQJDk2TNlsQ3q6jbSoMCXqEfVF9RFcTkvCnV1GkrwjoM8vhYaL+x
-OCGRIvOqzsDwvyd3lbsDM3pVw6j64zRjR1JkdOK23sCj10cVEYYqDozVHILPYmEL
-hEEYk7FqfPY1uqKL6zGnWhX81wKBgQDX/c6i8kOJjO7YWoG4Z2hPUJJCM/q3Ws1b
-XK2m6qddYPV5zOv2geknAC71WqOgVnLM/pNrPpd2p1kMjRPqKKUL0z7XONp8+6ii
-9EB+CEwUB/1kA/GFl5sAcOv9uGqMrXeWoAzeoyeBE/MscfANY0tROfvXvpYhYl3S
-SlCfy0UXOQKBgFfKJzufQPNW7QnTlLBgJjXQiPvBxi82dc+mZOEg/vXYqRxaJTz8
-cjbdLBJNCu4L7R5AWqviw5p7jgnzoAs+mxp67RLAsqVAcN4wPgum9x9M7AtFxu9v
-eSgV+XnQIQqakAxTtFBD7/Enct+jqEZkGolxEzNlX9ip4QZ1SJA6IFfnAoGBAJLN
-F6faXxrbJe74vNgXuGbIDVBfwdTjK1YgTIp5TF2EK/On2uzFaTEvx7rM6w9sEkTP
-9mRau1lS7oxASrvI+jxqTHi9VIrEBN8UgcznWMX4lDlpELvKyffnyA2/TPPmZrSC
-fZzIaW4qoAmiOxTuWt+POGNvTtzL3ZazGc8xufjJAoGAbDCQGFIEo4DVOVEgI1sM
-rmK9sOBjHO1306HL/gKqJo/CVSwLpwjErCLr1w0LUGG8SRup3VyZSTJTh15F3Pfk
-+N6nVrhCTag6vF/E3/VTZ3BwgvOLT3XqUTprntQUPXA+Dk+Fdem4dgHvknRDwz99
-APZYdtb09hSETdUJmgd376g=
------END PRIVATE KEY-----
deleted file mode 100644
--- a/security/nss/lib/ckfw/builtins/testlib/testcert_no_distrust.txt
+++ /dev/null
@@ -1,50 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrTCCApWgAwIBAgIUc/i8N6NKXyYTZNxOxlhOlCokIrEwDQYJKoZIhvcNAQEL
-BQAwZjEZMBcGA1UEAwwQVEVTVCBub19kaXN0cnVzdDEMMAoGA1UECwwDTlNTMRAw
-DgYDVQQLDAdNb3ppbGxhMQ0wCwYDVQQHDARURVNUMQ0wCwYDVQQIDARURVNUMQsw
-CQYDVQQGEwJERTAeFw0xOTA3MTYwNjMyNDJaFw0xOTA3MjYwNjMyNDJaMGYxGTAX
-BgNVBAMMEFRFU1Qgbm9fZGlzdHJ1c3QxDDAKBgNVBAsMA05TUzEQMA4GA1UECwwH
-TW96aWxsYTENMAsGA1UEBwwEVEVTVDENMAsGA1UECAwEVEVTVDELMAkGA1UEBhMC
-REUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDH97sxW2mi3JsqJFMG
-vSCMtsNd9ZBERj5AZDL21bjHk5gCl2jEQmamd0vUGV5aYAanMmU8r03YrqTVA36D
-/drl9WBze5iUUl1kfj1pCr0kx8/jVtqRoHlh+kdfiPIQmYpQQykIm+8Fgej9gkRG
-OrjTaXQLge0ExAIPIjkSOpMxtuuQL1iRrRR2VaGKLFouUJI62r3uH5oW5N4jKjxK
-BqZAtqw1wXe+eBdXLMKsZnnXzMW0PyRB50XftylIIUvCI4weDe/Ydx+E6/IRmqyQ
-uXl4xj8O6yX+eWxV09bzXpjbcKKZDsAhkSWyKx2j6fObCzsCmxhq1Fq4g6Bzd7pi
-KtYrAgMBAAGjUzBRMB0GA1UdDgQWBBS6DeOSnoCkc48Fv+pnHqM5P6G85jAfBgNV
-HSMEGDAWgBS6DeOSnoCkc48Fv+pnHqM5P6G85jAPBgNVHRMBAf8EBTADAQH/MA0G
-CSqGSIb3DQEBCwUAA4IBAQCp6OTs5jZt/WSir3212nab3GHWmHBSw5ECr8uq2APY
-Clso43lIo03MFr0GBYCSZ3aovdMU98+tHLSgA0wTJHlWCQpErsbXHP5e0y4dkiEZ
-6PoqohXynn6aAsAIC1euzM0iWhjbNKWDfIo1qPQVOHd/yhvB/7smjeAHhLCILr3p
-61crKHXSZpM01JtqSmoAzPCFL3ofMTZEytTybrVMWKGy2y6KJLQTzGQyeml3B7tE
-q3ssFTt8F3d+8h+aNzuQr68BC1Vu6JyHsfjBY0ZZMmYhl0fgsiIcGCPer00XqBR5
-UYjemnwqXAJADJXelA9/Deyrpecv4Iw4A/22Ew8B+54Y
------END CERTIFICATE-----
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDH97sxW2mi3Jsq
-JFMGvSCMtsNd9ZBERj5AZDL21bjHk5gCl2jEQmamd0vUGV5aYAanMmU8r03YrqTV
-A36D/drl9WBze5iUUl1kfj1pCr0kx8/jVtqRoHlh+kdfiPIQmYpQQykIm+8Fgej9
-gkRGOrjTaXQLge0ExAIPIjkSOpMxtuuQL1iRrRR2VaGKLFouUJI62r3uH5oW5N4j
-KjxKBqZAtqw1wXe+eBdXLMKsZnnXzMW0PyRB50XftylIIUvCI4weDe/Ydx+E6/IR
-mqyQuXl4xj8O6yX+eWxV09bzXpjbcKKZDsAhkSWyKx2j6fObCzsCmxhq1Fq4g6Bz
-d7piKtYrAgMBAAECggEALCE4t3DEBEQJHii8Be2xBDzFKrQprVePH2i9conB6JFi
-55eAcGdy/eOv4VPj5a/xZ+6QNu89D8ei6ruFrR1VtJANRA8PohP3NllBti+/hCFw
-eGxPefnfL8cq/yNawF0SEBpyMMsw2ZdM0r1v0cvdxBIuoOeAZh/XkH1t+N7iYwLm
-Kbkfzp7qVPDxghavODEX2GnWptNONomglHj/DcQtpCJfff9SgqtG8j9M+YX2mzfb
-yoPy3scOvknfGqMlCtz5ilGHMXACq1JqzPfAz2FPVSB5ROHLQyt8PQQVfp8QSrkk
-4LTqR7Z0H5NRxj35sfJn1C1J/wFw3bkmy5CxgyCtwQKBgQDyYl3yIlm6U9i4c7b8
-3aNzsdDcbRYi+Dvvi59QVNqf03Fct+PP2ThBTbpw0TTsWh947PJli1JUnLamGpeO
-3ZUnpEFctXFWInX0ghsATc0zdxjWeX6VoIf+9tSqO5yCmqtZxslZUXTcvDi1XAK7
-1FPsrHvsiFzD2b3b930MpT7qoQKBgQDTM2N0NdJ1hQneOBp3wvrAlzRXxBYsaM83
-O32ek3ZFVAwpqNPt6w8PjcCRq0ej8w6v4EeR1Hqc4Mol0TnzTbIoYMB+eyqsGjTi
-7rL0Z9f+dDzGNlGssCplu72oHLF8TJq9aoh36wUMH8hc473M2ZCrjcUAudrWYEkc
-0GIr0hZ5SwKBgHi6XDbVu0Ger8y3/kYXE2n2AKU6RJNod1oKfnDhwv9mrwlSossN
-VALa92loGuc6wIBX7Sh866YvZJ55klHbtoZHPzMxQOF5Sq1d/Jr7JaFjyeBSJaXb
-jsGFKkocZQl8hqqx4+p0MzQbIFfdG5N439B73UHkbegzVWjx7bxVtm/hAoGBAMl5
-kVuP6JhRdKt3i9BJwZmt5LIBDkIJLfv7lYeMFtxmJEAtnRavESv+RwDviyUcvhsL
-clrsfpdfXZgb8xNmQBmCyr8d0gRh76e4nCDJW2STEFLqCJobaCaqpW9VB/+SuF8P
-3OXA3ozFWQc7/pkHx5nQYWmi4t909Oo25B/3h5bnAoGBAIzm30BPZpMLyGvPCFIJ
-O2Rycvb4bDUU0J8cAVnvsAP6POWBYD0H6rHioZnRz6V3ZBibg+jvzXBiRAqm4n2e
-yRduP/3m6a3BKhYyplZEV1cUCnnUvQtusWiv61E/mDnPGco3sljUfCbvo1h1Juuq
-io2guvIg0tE5WSQr9spqy+o8
------END PRIVATE KEY-----
deleted file mode 100644
--- a/security/nss/lib/ckfw/builtins/testlib/testcert_ok_distrust.txt
+++ /dev/null
@@ -1,50 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDrTCCApWgAwIBAgIUOkTcnVQ/X6q4Jk8d+FpHNik6G7wwDQYJKoZIhvcNAQEL
-BQAwZjEZMBcGA1UEAwwQVEVTVCBva19kaXN0cnVzdDEMMAoGA1UECwwDTlNTMRAw
-DgYDVQQLDAdNb3ppbGxhMQ0wCwYDVQQHDARURVNUMQ0wCwYDVQQIDARURVNUMQsw
-CQYDVQQGEwJERTAeFw0xOTA3MTYwNjMyNDJaFw0xOTA3MjYwNjMyNDJaMGYxGTAX
-BgNVBAMMEFRFU1Qgb2tfZGlzdHJ1c3QxDDAKBgNVBAsMA05TUzEQMA4GA1UECwwH
-TW96aWxsYTENMAsGA1UEBwwEVEVTVDENMAsGA1UECAwEVEVTVDELMAkGA1UEBhMC
-REUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6HnzYlULNHDPfZUww
-MR4UNSmO7wtoR/Guj/M21lSnHJeCzWmzn1Xg/ydVKA5qiO1hgjKzm8BqkO6AFlQB
-c8UU7838kLf4eM4SLo5xZeHUUbkWxhaoUYFHrJliJgojsKLuKcOGv+H/xE82++A7
-Yz7n829Yz7l121cNzrdPLZqguU6ocPS5lIONX7c2uf9/DN8b1sr80KcrR+XtVzcH
-0pCA/iu2WiRwtmwytf2yfvLyrxn0Z6k539lmLwWS//ABp6ptRh2dNZLm6cGE3eQK
-8fYxJBhD2U5LX1EeqyLMsAWZqQJCAnE539jEaI2QdOZ4pfbwn+vyS4Pyv9A8NPQS
-GUUVAgMBAAGjUzBRMB0GA1UdDgQWBBQcQKqQ289LAhNrGDmmDNfasnT8PTAfBgNV
-HSMEGDAWgBQcQKqQ289LAhNrGDmmDNfasnT8PTAPBgNVHRMBAf8EBTADAQH/MA0G
-CSqGSIb3DQEBCwUAA4IBAQAiIR6XulpG7kq6woQM8FzZHPRfM9wlPtEcT/HJrH8P
-nj5R120m56GF96wxib4JTy/0ffgOljIEiWsn7uM06KiZByF0DPyOnYaDbsgL8OKf
-QxW8n9VG0XNTHvMpXjyFQrhXZsMwEi9EO0IY1VP+H0ZjSwl0d/w91/ICtVec98JM
-+fypRpHjBCeXVc4UJvb4hz8VnlJOEKE6iWBAIwhFRenEWPvL5bqa3JgJC92xmILr
-bQPrm2qhijSmasCm7u9GOeeJZL2KDB2nSpFZOJhS989cMKxtMZz0P3Gunn0/oqDr
-cfDt8t+Nei1T2uq0FlQK8yBUKhfAPnwKuvj/tHho45ZF
------END CERTIFICATE-----
------BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQC6HnzYlULNHDPf
-ZUwwMR4UNSmO7wtoR/Guj/M21lSnHJeCzWmzn1Xg/ydVKA5qiO1hgjKzm8BqkO6A
-FlQBc8UU7838kLf4eM4SLo5xZeHUUbkWxhaoUYFHrJliJgojsKLuKcOGv+H/xE82
-++A7Yz7n829Yz7l121cNzrdPLZqguU6ocPS5lIONX7c2uf9/DN8b1sr80KcrR+Xt
-VzcH0pCA/iu2WiRwtmwytf2yfvLyrxn0Z6k539lmLwWS//ABp6ptRh2dNZLm6cGE
-3eQK8fYxJBhD2U5LX1EeqyLMsAWZqQJCAnE539jEaI2QdOZ4pfbwn+vyS4Pyv9A8
-NPQSGUUVAgMBAAECggEATZbSIxQucgV01oeLOHfxeykidxTOY53CcixOjyjQx43S
-19O8YgZlrdOQ2R5GzEDi/QhjDJ88mvBqjPlB8g0KNw01iTnnh+0Ms2W3Oizn9TRQ
-fd78qRS5WWDp3JHRHknP0ouUmIM7uv1irKBaPUfFfLruS07lmO1koDvyDU8MrD1+
-Lr9i/7DOxpMFRTP4OBs4J22M1jdaVV7RM5/ZxHezSEJx8lpYvsBSHYYrViWx+TvL
-BQabnfntg4YbVoB+5f7kOA0f0a/WdF1q4yursLvPFb3F+w271s11PYnXp8G7Axe7
-ylcojRhvb1bque2WP7Wz3L0kCosxPkaH7W2RfHZX7QKBgQDgI7Xuo+2hnOkPZxNd
-EuA2+1gKmRnd9Gx+gBvSOxgy+bIirddWpUoSQE1cZiJu0ylERVBMXJzMi5uT1/nR
-OP9HVUY/pYDEtuHRHyF60sp8+qTiV0PxACuaYGmUSO22+p9yp0mfVNl+AkQlLbam
-pmQG3OWb7Zqpef7+v7fnccPwFwKBgQDUkz1OyUwB1Nx0GtzAiYuoVh0Oe2GM8tHI
-8kSXbFyXh5ly75Cm5gPR6dxLsLSOZxzGZMfXm13MFWVARQJgudFJFTtqRufJZcnS
-ie/OpY35eYqKqzYIwt+4U6biCLK3q77dH1Psgz0ghoH6DfDkl2eQDF9LLUxvrS5Q
-r36bBezjswKBgEAMFEWv1Ax1UOeU1aSn6yfq5HqKyyhwWrw/ETQerMiML0nXkQvy
-SVszwqdfjAFNF6Kph8t6P1f3oKo7cehGODQC+wLe4Q/VDmv6UE/Pggr6eDkxJHnu
-SYdge2ri+AJsVTmm8dO0pD1smlphWKsAKt8HKhlHaQV6ldHnqL5a9NlbAoGAK6zI
-xtwy4plyZeRzAJgB+qcetzAAXe4xzgCAuT/JUlTI4UV5SeEuXb2XxnFa13s1/UkN
-ii3guqKWt/q1v1vONR7Io1BIJSflrH0sqR94qQ4gudbtdiVbw8pkGkLBPV1rDJF4
-M7rPH1SjddXRbZXx8DWqio6XCsbhIjC8aWtxPWMCgYAClC2GhicT+Jiv5Y8gT/hc
-/DJjhQTtV1mMqek69XJ6Xsc6wEkFSXpUr8/3XoP8Sj/xrEluTJYgt/DTVbXAvLcv
-XCaERRdrpBHspFrD9lcOZRjS17QTVAzH8bt3+YidqvDnn/2Xch49hcUJTFEx7Km+
-r4Tw2QmALNeNDgRlkMJYCQ==
------END PRIVATE KEY-----
--- a/security/nss/lib/ckfw/manifest.mn
+++ b/security/nss/lib/ckfw/manifest.mn
@@ -1,16 +1,16 @@
 # 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 CORE_DEPTH = ../..
 
-DIRS = builtins
+DIRS = builtins 
 
 PRIVATE_EXPORTS = \
 	ck.h		  \
 	ckfw.h		  \
 	ckfwm.h		  \
 	ckfwtm.h	  \
 	ckmd.h		  \
 	ckt.h		  \
--- a/security/nss/lib/mozpkix/include/pkix/pkixder.h
+++ b/security/nss/lib/mozpkix/include/pkix/pkixder.h
@@ -109,27 +109,16 @@ inline Result ExpectTagAndEmptyValue(Rea
   return End(value);
 }
 
 inline Result ExpectTagAndSkipValue(Reader& input, uint8_t tag) {
   Input ignoredValue;
   return ExpectTagAndGetValue(input, tag, ignoredValue);
 }
 
-// This skips IMPLICIT OPTIONAL tags that are "primitive" (not constructed),
-// given the number in the class of the tag (i.e. the number in the brackets in
-// `issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL`).
-inline Result SkipOptionalImplicitPrimitiveTag(Reader& input,
-                                               uint8_t numberInClass) {
-  if (input.Peek(CONTEXT_SPECIFIC | numberInClass)) {
-    return ExpectTagAndSkipValue(input, CONTEXT_SPECIFIC | numberInClass);
-  }
-  return Success;
-}
-
 // Like ExpectTagAndGetValue, except the output Input will contain the
 // encoded tag and length along with the value.
 inline Result ExpectTagAndGetTLV(Reader& input, uint8_t tag,
                                  /*out*/ Input& tlv) {
   Reader::Mark mark(input.GetMark());
   Result rv = ExpectTagAndSkipValue(input, tag);
   if (rv != Success) {
     return rv;
--- a/security/nss/lib/mozpkix/lib/pkixcert.cpp
+++ b/security/nss/lib/mozpkix/lib/pkixcert.cpp
@@ -100,34 +100,39 @@ BackCert::Init()
     return rv;
   }
   rv = der::ExpectTagAndGetTLV(tbsCertificate, der::SEQUENCE,
                                subjectPublicKeyInfo);
   if (rv != Success) {
     return rv;
   }
 
+  static const uint8_t CSC = der::CONTEXT_SPECIFIC | der::CONSTRUCTED;
+
   // According to RFC 5280, all fields below this line are forbidden for
   // certificate versions less than v3.  However, for compatibility reasons,
   // we parse v1/v2 certificates in the same way as v3 certificates.  So if
   // these fields appear in a v1 certificate, they will be used.
 
   // Ignore issuerUniqueID if present.
-  rv = der::SkipOptionalImplicitPrimitiveTag(tbsCertificate, 1);
-  if (rv != Success) {
-    return rv;
+  if (tbsCertificate.Peek(CSC | 1)) {
+    rv = der::ExpectTagAndSkipValue(tbsCertificate, CSC | 1);
+    if (rv != Success) {
+      return rv;
+    }
   }
 
   // Ignore subjectUniqueID if present.
-  rv = der::SkipOptionalImplicitPrimitiveTag(tbsCertificate, 2);
-  if (rv != Success) {
-    return rv;
+  if (tbsCertificate.Peek(CSC | 2)) {
+    rv = der::ExpectTagAndSkipValue(tbsCertificate, CSC | 2);
+    if (rv != Success) {
+      return rv;
+    }
   }
 
-  static const uint8_t CSC = der::CONTEXT_SPECIFIC | der::CONSTRUCTED;
   rv = der::OptionalExtensions(
          tbsCertificate, CSC | 3,
          [this](Reader& extnID, const Input& extnValue, bool critical,
                 /*out*/ bool& understood) {
            return RememberExtension(extnID, extnValue, critical, understood);
          });
   if (rv != Success) {
     return rv;
--- a/security/nss/lib/nss/nss.def
+++ b/security/nss/lib/nss/nss.def
@@ -34,18 +34,18 @@ CERT_DestroyName;
 CERT_EnableOCSPChecking;
 CERT_FormatName;
 CERT_DestroyCertificate;
 CERT_DupCertificate;
 CERT_FreeDistNames;
 CERT_FreeNicknames;
 CERT_GetAVATag;
 CERT_GetCertEmailAddress;
+CERT_GetCertNicknames;
 CERT_GetCertIssuerAndSN;
-CERT_GetCertNicknames;
 CERT_GetCertTrust;
 CERT_GetCertUid;
 CERT_GetCommonName;
 CERT_GetCountryName;
 CERT_GetDBContentVersion;
 CERT_GetDefaultCertDB;
 CERT_GetDomainComponentName;
 CERT_GetLocalityName;
--- a/security/nss/lib/pki/pki3hack.c
+++ b/security/nss/lib/pki/pki3hack.c
@@ -820,46 +820,16 @@ fill_CERTCertificateFields(NSSCertificat
         if (trust) {
             /* we should destroy cc->trust before replacing it, but it's
                allocated in cc->arena, so memory growth will occur on each
                refresh */
             CERT_LockCertTrust(cc);
             cc->trust = trust;
             CERT_UnlockCertTrust(cc);
         }
-        /* Read the distrust fields from a nssckbi/builtins certificate and
-         * fill the fields in CERTCertificate structure when any valid date
-         * is found. */
-        if (PK11_IsReadOnly(cc->slot) && PK11_HasRootCerts(cc->slot)) {
-            /* The values are hard-coded and readonly. Read just once. */
-            if (cc->distrust == NULL) {
-                CERTCertDistrust distrustModel;
-                SECItem model = { siUTCTime, NULL, 0 };
-                distrustModel.serverDistrustAfter = model;
-                distrustModel.emailDistrustAfter = model;
-                SECStatus rServer = PK11_ReadAttribute(
-                    cc->slot, cc->pkcs11ID, CKA_NSS_SERVER_DISTRUST_AFTER,
-                    cc->arena, &distrustModel.serverDistrustAfter);
-                SECStatus rEmail = PK11_ReadAttribute(
-                    cc->slot, cc->pkcs11ID, CKA_NSS_EMAIL_DISTRUST_AFTER,
-                    cc->arena, &distrustModel.emailDistrustAfter);
-                /* Only allocate the Distrust structure if a valid date is found.
-                 * The result length of a encoded valid timestamp is exactly 13 */
-                const unsigned int kDistrustFieldSize = 13;
-                if ((rServer == SECSuccess && rEmail == SECSuccess) &&
-                    (distrustModel.serverDistrustAfter.len == kDistrustFieldSize ||
-                     distrustModel.emailDistrustAfter.len == kDistrustFieldSize)) {
-                    CERTCertDistrust *tmpPtr = PORT_ArenaAlloc(
-                        cc->arena, sizeof(CERTCertDistrust));
-                    PORT_Memcpy(tmpPtr, &distrustModel,
-                                sizeof(CERTCertDistrust));
-                    cc->distrust = tmpPtr;
-                }
-            }
-        }
     }
     if (instance) {
         nssCryptokiObject_Destroy(instance);
     }
     /* database handle is now the trust domain */
     cc->dbhandle = c->object.trustDomain;
     /* subjectList ? */
     /* istemp and isperm are supported in NSS 3.4 */
--- a/security/nss/lib/softoken/pkcs11c.c
+++ b/security/nss/lib/softoken/pkcs11c.c
@@ -1600,77 +1600,16 @@ NSC_DecryptUpdate(CK_SESSION_HANDLE hSes
                             maxout, pEncryptedPart, ulEncryptedPartLen);
     if (rv != SECSuccess) {
         return sftk_MapDecryptError(PORT_GetError());
     }
     *pulPartLen = (CK_ULONG)(outlen + padoutlen);
     return CKR_OK;
 }
 
-/* Fromssl3con.c: Constant-time helper macro that copies the MSB of x to all
- * other bits. */
-#define DUPLICATE_MSB_TO_ALL(x) ((unsigned int)((int)(x) >> (sizeof(int) * 8 - 1)))
-/* From ssl3con.c: SECStatusToMask returns, in constant time, a mask value of
- * all ones if rv == SECSuccess.  Otherwise it returns zero. */
-static unsigned int
-SECStatusToMask(SECStatus rv)
-{
-    unsigned int good;
-    /* rv ^ SECSuccess is zero iff rv == SECSuccess. Subtracting one results
-     * in the MSB being set to one iff it was zero before. */
-    good = rv ^ SECSuccess;
-    good--;
-    return DUPLICATE_MSB_TO_ALL(good);
-}
-/* Constant-time helper macro that selects l or r depending on all-1 or all-0
- * mask m */
-#define CT_SEL(m, l, r) (((m) & (l)) | (~(m) & (r)))
-/* Constant-time helper macro that returns all-1s if x is not 0; and all-0s
- * otherwise. */
-#define CT_NOT_ZERO(x) (DUPLICATE_MSB_TO_ALL(((x) | (0 - x))))
-
-/* sftk_CheckCBCPadding checks that the padding validity and return the pad length. */
-static CK_RV
-sftk_CheckCBCPadding(CK_BYTE_PTR pLastPart,
-                     unsigned int blockSize, unsigned int *outPadSize)
-{
-    PORT_Assert(outPadSize);
-
-    unsigned int padSize = (unsigned int)pLastPart[blockSize - 1];
-
-    /* If padSize <= blockSize, set goodPad to all-1s and all-0s otherwise.*/
-    unsigned int goodPad = DUPLICATE_MSB_TO_ALL(~(blockSize - padSize));
-    /* padSize should not be 0 */
-    goodPad &= CT_NOT_ZERO(padSize);
-
-    unsigned int i;
-    for (i = 0; i < blockSize; i++) {
-        /* If i < padSize, set loopMask to all-1s and all-0s otherwise.*/
-        unsigned int loopMask = DUPLICATE_MSB_TO_ALL(~(padSize - 1 - i));
-        /* Get the padding value (should be padSize) from buffer */
-        unsigned int padVal = pLastPart[blockSize - 1 - i];
-        /* Update goodPad only if i < padSize */
-        goodPad &= CT_SEL(loopMask, ~(padVal ^ padSize), goodPad);
-    }
-
-    /* If any of the final padding bytes had the wrong value, one or more
-     * of the lower eight bits of |goodPad| will be cleared. We AND the
-     * bottom 8 bits together and duplicate the result to all the bits. */
-    goodPad &= goodPad >> 4;
-    goodPad &= goodPad >> 2;
-    goodPad &= goodPad >> 1;
-    goodPad <<= sizeof(goodPad) * 8 - 1;
-    goodPad = DUPLICATE_MSB_TO_ALL(goodPad);
-
-    /* Set outPadSize to padSize or 0 */
-    *outPadSize = CT_SEL(goodPad, padSize, 0);
-    /* Return OK if the pad is valid */
-    return CT_SEL(goodPad, CKR_OK, CKR_ENCRYPTED_DATA_INVALID);
-}
-
 /* NSC_DecryptFinal finishes a multiple-part decryption operation. */
 CK_RV
 NSC_DecryptFinal(CK_SESSION_HANDLE hSession,
                  CK_BYTE_PTR pLastPart, CK_ULONG_PTR pulLastPartLen)
 {
     SFTKSession *session;
     SFTKSessionContext *context;
     unsigned int outlen;
@@ -1699,20 +1638,34 @@ NSC_DecryptFinal(CK_SESSION_HANDLE hSess
         if (context->padDataLength != 0) {
             /* this assumes that pLastPart is big enough to hold the *whole*
              * buffer!!! */
             rv = (*context->update)(context->cipherInfo, pLastPart, &outlen,
                                     maxout, context->padBuf, context->blockSize);
             if (rv != SECSuccess) {
                 crv = sftk_MapDecryptError(PORT_GetError());
             } else {
-                unsigned int padSize = 0;
-                crv = sftk_CheckCBCPadding(pLastPart, context->blockSize, &padSize);
-                /* Update pulLastPartLen, in constant time, if crv is success */
-                *pulLastPartLen = CT_SEL(SECStatusToMask(crv), outlen - padSize, *pulLastPartLen);
+                unsigned int padSize =
+                    (unsigned int)pLastPart[context->blockSize - 1];
+                if ((padSize > context->blockSize) || (padSize == 0)) {
+                    crv = CKR_ENCRYPTED_DATA_INVALID;
+                } else {
+                    unsigned int i;
+                    unsigned int badPadding = 0; /* used as a boolean */
+                    for (i = 0; i < padSize; i++) {
+                        badPadding |=
+                            (unsigned int)pLastPart[context->blockSize - 1 - i] ^
+                            padSize;
+                    }
+                    if (badPadding) {
+                        crv = CKR_ENCRYPTED_DATA_INVALID;
+                    } else {
+                        *pulLastPartLen = outlen - padSize;
+                    }
+                }
             }
         }
     }
 
     sftk_TerminateOp(session, SFTK_DECRYPT, context);
 finish:
     sftk_FreeSession(session);
     return crv;
@@ -1764,19 +1717,31 @@ NSC_Decrypt(CK_SESSION_HANDLE hSession,
         return crv == CKR_OK ? crv2 : crv;
     }
 
     rv = (*context->update)(context->cipherInfo, pData, &outlen, maxoutlen,
                             pEncryptedData, ulEncryptedDataLen);
     /* XXX need to do MUCH better error mapping than this. */
     crv = (rv == SECSuccess) ? CKR_OK : sftk_MapDecryptError(PORT_GetError());
     if (rv == SECSuccess && context->doPad) {
-        unsigned int padSize = 0;
-        crv = sftk_CheckCBCPadding(pData, context->blockSize, &padSize);
-        outlen -= padSize;
+        unsigned int padding = pData[outlen - 1];
+        if (padding > context->blockSize || !padding) {
+            crv = CKR_ENCRYPTED_DATA_INVALID;
+        } else {
+            unsigned int i;
+            unsigned int badPadding = 0; /* used as a boolean */
+            for (i = 0; i < padding; i++) {
+                badPadding |= (unsigned int)pData[outlen - 1 - i] ^ padding;
+            }
+            if (badPadding) {
+                crv = CKR_ENCRYPTED_DATA_INVALID;
+            } else {
+                outlen -= padding;
+            }
+        }
     }
     sftk_TerminateOp(session, SFTK_DECRYPT, context);
 done:
     sftk_FreeSession(session);
     if (crv == CKR_OK) {
         *pulDataLen = (CK_ULONG)outlen;
     }
     return crv;
--- a/security/nss/lib/softoken/sdb.c
+++ b/security/nss/lib/softoken/sdb.c
@@ -154,17 +154,17 @@ static const CK_ATTRIBUTE_TYPE known_att
     CKA_TRUST_DIGITAL_SIGNATURE, CKA_TRUST_NON_REPUDIATION,
     CKA_TRUST_KEY_ENCIPHERMENT, CKA_TRUST_DATA_ENCIPHERMENT,
     CKA_TRUST_KEY_AGREEMENT, CKA_TRUST_KEY_CERT_SIGN, CKA_TRUST_CRL_SIGN,
     CKA_TRUST_SERVER_AUTH, CKA_TRUST_CLIENT_AUTH, CKA_TRUST_CODE_SIGNING,
     CKA_TRUST_EMAIL_PROTECTION, CKA_TRUST_IPSEC_END_SYSTEM,
     CKA_TRUST_IPSEC_TUNNEL, CKA_TRUST_IPSEC_USER, CKA_TRUST_TIME_STAMPING,
     CKA_TRUST_STEP_UP_APPROVED, CKA_CERT_SHA1_HASH, CKA_CERT_MD5_HASH,
     CKA_NETSCAPE_DB, CKA_NETSCAPE_TRUST, CKA_NSS_OVERRIDE_EXTENSIONS,
-    CKA_PUBLIC_KEY_INFO, CKA_NSS_SERVER_DISTRUST_AFTER, CKA_NSS_EMAIL_DISTRUST_AFTER
+    CKA_PUBLIC_KEY_INFO
 };
 
 static int known_attributes_size = sizeof(known_attributes) /
                                    sizeof(known_attributes[0]);
 
 /* Magic for an explicit NULL. NOTE: ideally this should be
  * out of band data. Since it's not completely out of band, pick
  * a value that has no meaning to any existing PKCS #11 attributes.
--- a/security/nss/lib/ssl/tls13con.c
+++ b/security/nss/lib/ssl/tls13con.c
@@ -909,17 +909,17 @@ SSLExp_SendCertificateRequest(PRFileDesc
     ssl_ReleaseSSL3HandshakeLock(ss);
     return rv;
 }
 
 SECStatus
 tls13_HandlePostHelloHandshakeMessage(sslSocket *ss, PRUint8 *b, PRUint32 length)
 {
     if (ss->sec.isServer && ss->ssl3.hs.zeroRttIgnore != ssl_0rtt_ignore_none) {
-        SSL_TRC(3, ("%d: TLS13[%d]: successfully decrypted handshake after "
+        SSL_TRC(3, ("%d: TLS13[%d]: %s successfully decrypted handshake after"
                     "failed 0-RTT",
                     SSL_GETPID(), ss->fd));
         ss->ssl3.hs.zeroRttIgnore = ssl_0rtt_ignore_none;
     }
 
     /* TODO(ekr@rtfm.com): Would it be better to check all the states here? */
     switch (ss->ssl3.hs.msg_type) {
         case ssl_hs_certificate:
--- a/security/nss/lib/util/pkcs11n.h
+++ b/security/nss/lib/util/pkcs11n.h
@@ -89,18 +89,16 @@
 #define CKA_NSS_JPAKE_GX1 (CKA_NSS + 28)
 #define CKA_NSS_JPAKE_GX2 (CKA_NSS + 29)
 #define CKA_NSS_JPAKE_GX3 (CKA_NSS + 30)
 #define CKA_NSS_JPAKE_GX4 (CKA_NSS + 31)
 #define CKA_NSS_JPAKE_X2 (CKA_NSS + 32)
 #define CKA_NSS_JPAKE_X2S (CKA_NSS + 33)
 
 #define CKA_NSS_MOZILLA_CA_POLICY (CKA_NSS + 34)
-#define CKA_NSS_SERVER_DISTRUST_AFTER (CKA_NSS + 35)
-#define CKA_NSS_EMAIL_DISTRUST_AFTER (CKA_NSS + 36)
 
 /*
  * Trust attributes:
  *
  * If trust goes standard, these probably will too.  So I'll
  * put them all in one place.
  */
 
--- a/security/nss/nss.gyp
+++ b/security/nss/nss.gyp
@@ -213,17 +213,16 @@
             'gtests/freebl_gtest/freebl_gtest.gyp:freebl_gtest',
             'gtests/mozpkix_gtest/mozpkix_gtest.gyp:mozpkix_gtest',
             'gtests/nss_bogo_shim/nss_bogo_shim.gyp:nss_bogo_shim',
             'gtests/pk11_gtest/pk11_gtest.gyp:pk11_gtest',
             'gtests/smime_gtest/smime_gtest.gyp:smime_gtest',
             'gtests/softoken_gtest/softoken_gtest.gyp:softoken_gtest',
             'gtests/ssl_gtest/ssl_gtest.gyp:ssl_gtest',
             'gtests/util_gtest/util_gtest.gyp:util_gtest',
-            'lib/ckfw/builtins/testlib/builtins-testlib.gyp:nssckbi-testlib',
           ],
           'conditions': [
             [ 'OS=="linux"', {
               'dependencies': [
                 'cmd/lowhashtest/lowhashtest.gyp:lowhashtest',
               ],
             }],
             [ 'OS=="linux" and mozilla_client==0', {
--- a/security/nss/tests/cert/cert.sh
+++ b/security/nss/tests/cert/cert.sh
@@ -45,17 +45,17 @@ cert_init()
        . ../iopr/cert_iopr.sh
   fi
   SCRIPTNAME="cert.sh"
   CRL_GRP_DATE=`date -u "+%Y%m%d%H%M%SZ"`
   html_head "Certutil and Crlutil Tests"
 
   LIBDIR="${DIST}/${OBJDIR}/lib"
 
-  ROOTCERTSFILE=`ls -1 ${LIBDIR}/*nssckbi.* | head -1`
+  ROOTCERTSFILE=`ls -1 ${LIBDIR}/*nssckbi* | head -1`
   if [ ! "${ROOTCERTSFILE}" ] ; then
       html_failed "Looking for root certs module." 
       cert_log "ERROR: Root certs module not found."
       Exit 5 "Fatal - Root certs module not found."
   else
       html_passed "Looking for root certs module."
   fi