Bug 1204404

Description of problem: Flaws in the method for disabling SSL2 will likely render future version Firefox unusable.

Bug 1001841 was cloned as Bug 1189952 for Fedora to do the same work there.
While testing, I found that Firefox stopped working. 

Kai Engert's description and diagnosis of the problem can be found on https://bugzilla.redhat.com/show_bug.cgi?id=1189952#c11
which I copy here:

Kai Engert (:kaie) 2015-02-18 13:27:20 EST
Elio said, he ran into an issue with Firefox on Fedora.

The NSS changes that disable SSL2 caused Firefox to break completely.
No web pages could be loaded.

The Firefox error console indicated that several services couldn't be created (a sort of internal failure).

I found that Firefox calls NSS_SetDomesticPolicy(), which is NSS code that iterates over all the ciphers, and enables each of them.

However, the suggested change to NSS returns an error, as soon as an attempt is made to enable SSL 2 ciphers. This causes NSS to return a failure, which is forwarded to the application, which concludes that NSS failed to initialize.

Because NSS_SetDomesticPolicy() is an NSS internal function, it should be adjusted to not fail (or not trying to enable SSL 2 ciphers at all).

However, looking at the function SSL_CipherPolicySet() which your patch changes, a different strategy might be better.

SSL_CipherPolicySet() has code which says:
  If the cipher is one that has been removed, then don't enable it,
  and return success.

You could do the same for the SSL 2 ciphers.

However, an even better idea comes to mind:

Please consider to change the existing function ssl_IsRemovedCipherSuite()
to include the SSL 2 ciphers you are disabling.

Then you wouldn't need to change function SSL_CipherPolicySet() at all.