(mozilla-projects-nss-nss-3-14-1-release-notes)=

# NSS 3.14.1 release notes

## [Introduction](#introduction)

:::{container}
Network Security Services (NSS) 3.14.1 is a patch release for NSS 3.14. The bug fixes in NSS
3.14.1 are described in the "Bugs Fixed" section below.

NSS 3.14.1 is licensed under the MPL 2.0.
:::

## [Distribution Information](#distribution_information)

:::{container}
The CVS tag is NSS_3_14_1_RTM. NSS 3.14.1 requires NSPR 4.9.4 or newer.

NSS 3.14.1 source distributions are also available on ftp.mozilla.org for secure HTTPS download:

- Source tarballs:
  <https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_14_1_RTM/src/>
:::

(new-in-nss-3-14-1)=

## [New in NSS 3.14.1](#new_in_nss_3.14.1)

### [New Functionality](#new_functionality)

:::{container}

- NSS now has the ability to create signed OCSP responses.

  - The ability to create signed OCSP responses has been added in NSS 3.14.1. Note that this
    code is used primarily for purposes of testing.

```{rubric} New Functions
```

- *in ocspt.h*

  - CERT_CreateOCSPSingleResponseGood
  - CERT_CreateOCSPSingleResponseUnknown
  - CERT_CreateOCSPSingleResponseRevoked
  - CERT_CreateEncodedOCSPSuccessResponse
  - CERT_CreateEncodedOCSPErrorResponse

```{rubric} New Types
```

- *in ocspt.h*

  - CERTOCSPResponderIDType
:::

(notable-changes-in-nss-3-14-1)=

### [Notable Changes in NSS 3.14.1](#notable_changes_in_nss_3.14.1)

:::{container}

- Windows CE support has been removed from the code base.
- [Bug 812399](https://bugzilla.mozilla.org/show_bug.cgi?id=812399) - In NSS 3.14, a
  regression caused [Bug 641052](https://bugzilla.mozilla.org/show_bug.cgi?id=641052) /
  CVE-2011-3640 to be re-introduced under certain situations. This regression only affected
  applications that initialize NSS via the NSS_NoDB_Init function. NSS 3.14.1 includes the
  complete fix for this issue.
- [Bug 357025](https://bugzilla.mozilla.org/show_bug.cgi?id=357025) - NSS 3.14 added support
  for tokens that make use of CKA_ALWAYS_AUTHENTICATE. However, when authenticating with such
  tokens, it was possible for an internal lock to be acquired twice, causing a hang. This hang
  has been fixed in NSS 3.14.1.
- [Bug 802429](https://bugzilla.mozilla.org/show_bug.cgi?id=802429) - In previous versions of
  NSS, the "cipherOrder" slot configuration flag was not respected, causing the most recently
  added slot that supported the requested PKCS#11 mechanism to be used instead. NSS now
  correctly respects the supplied cipherOrder.
  Applications which use multiple PKCS#11 modules, which do not indicate which tokens should be
  used by default for particular algorithms, and which do make use of cipherOrder may now find
  that cryptographic operations occur on a different PKCS#11 token.
- [Bug 802429](https://bugzilla.mozilla.org/show_bug.cgi?id=802429) - The NSS softoken is now
  the default token for SHA-256 and SHA-512. In previous versions of NSS, these algorithms would
  be handled by the most recently added PKCS#11 token that supported them.
- [Bug 611451](https://bugzilla.mozilla.org/show_bug.cgi?id=611451) - When built with the
  current version of Apple XCode on Mac OS X, the NSS shared libraries will now only export the
  public NSS functions.
- [Bug 810582](https://bugzilla.mozilla.org/show_bug.cgi?id=810582) - TLS False Start is now
  only used with servers that negotiate a cipher suite that supports forward secrecy.
  **Note**: The criteria for False Start may change again in future NSS releases.
:::

(bugs-fixed-in-nss-3-14-1)=

## [Bugs fixed in NSS 3.14.1](#bugs_fixed_in_nss_3.14.1)

:::{container}
The following Bugzilla query returns all of the bugs fixed in NSS 3.14.1:

<https://bugzilla.mozilla.org/buglist.cgi?list_id=5216669;resolution=FIXED;query_format=advanced;bug_status=RESOLVED;bug_status=VERIFIED;target_milestone=3.14.1;product=NSS>
:::

## [Compatability](#compatability)

:::{container}
NSS 3.14.1 shared libraries are backward compatible with all older NSS 3.x shared libraries. A
program linked with older NSS 3.x shared libraries will work with NSS 3.14.1 shared libraries
without recompiling or relinking. Furthermore, applications that restrict their use of NSS APIs
to the functions listed in NSS Public Functions will remain compatible with future versions of
the NSS shared libraries.
:::

## [Feedback](#feedback)

:::{container}
Bugs discovered in this release should be reported by filing a bug report at
<https://bugzilla.mozilla.org> with the Product of NSS.
:::
