Unfortunately, an inherent problem with this approach has been the difficulty of upgrading CA certificates in the field. In addition, NSS is now open source. Vendors' products may have their own requirements for which trusted roots they include. Users may need to run several different products with different requirements at the same time.

Finally, some products, like servers, may need to ship without long lists of built-in trusted root certificates because these products often operate within their own heirarchy.

For these reasons, we would like to be able to change the built-in trusted root certificates on the fly without releasing a new product.

What Has Changed

• Make sure that the built-in module is installed in the same directory where the key and certificate databases live. NSS will find it and install it, looking under the following names:
  
  roots.dll   libroots.so   libroots.sl
  nssckbi.dll libnssckbi.so libnssckbi.sl
  mozckbi.dll libmozckbi.so libmozckbi.sl
  netckbi.dll libnetckbi.so libnetckbi.sl
  
  or
  
  
• Use the SECMOD_AddNewModule() call in your application if the built-in module isn't loaded.

	 ttlibnssckbi.so
	 nssckbi.dll
	 libnssckbi.sl

	 /*
	 * initialize NSS as normal....
	 */


	/*
	 * check to see if you have a rootcert module installed
	 */

	hasroot = PR_FALSE;
	list = PK11_GetAllTokens(CK_INVALID_MECH,PR_FALSE,PR_FALSE, &pwdata);
	if (list) for (le->list->head; le; le->next) {
	   if (PK11_HasRootCerts(le->slot) {
		hasroot = PR_TRUE;
		break;
	   }
	}

	if (!hasroot) {
		dll_path = yourFindrootCertModuleInYourInstallTree();
		SECMOD_AddNewModule("Root Certs",dll_path, 0, 0);
	}

	rv = CERT_TraversePermCerts(handle, <your_callback>, &numCerts);

	list = PK11_GetAllTokens(CK_INVALID_MECH,PR_FALSE,PR_FALSE, &pwdata);
	if (list) for (le = list->head; le; le->next) {
	    rv = PK11_CertsInSlot(le->slot, <your_callback>, <your_params>);
	}