much thanks to both Tuomo Soini (foobar.fi) and Pat Riehecky (scientificlinux.org)

Fix tests by updating PayPalEE.cert to valid one
Fix tests to expect small primes failing rhbz#1884793
Fix Cannot compile code with nss headers and -Werror=strict-prototypes

Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
Explicitly enable upgradedb/sharedb test cycles

Disable TLS 1.3 by default

Rebase to NSS 3.53.1

Increase timeout on ssl_gtest so that slow platforms can complete when

back out out-of-bounds patch (patch for nss-softokn).
Fix segfault on empty or malformed ecdh keys (#1777712)

Fix out-of-bounds write in NSC_EncryptUpdate (#1775911,#1775910)

Fix pkix name constraints processing to only process the common name if the

Fix certutil man page
Fix extracting a public key from a private key for dh, ec, and dsa

Disable TLS 1.3 under FIPS mode
Disable RSASSA-PKCS1-v1_5 in TLS 1.3
Fix post-handshake auth transcript calculation if

Skip sysinit gtests properly
Fix shell syntax error in tests/ssl/ssl.sh
Regenerate manual pages

Rebase to NSS 3.44
Restore fix-min-library-version-in-SSLVersionRange.patch to keep
Skip TLS 1.3 tests under FIPS mode

Ignore system policy when running %check

Fix policy string

Don't override date in man-pages
Revert the change to use XDG basedirs (mozilla#818686)
Enable SSL2 compatible ClientHello by default
Disable SSL3 and RC4 by default