NSS should export CheckCrlTimes() and CERT_CompareAVA()
This is an open issue at upstream:
Currently, libreswan has to copy some of the nss code to work around this bug:
(technically this is a license violation too, since nss is MPL, and libreswan is GPL)
SEC_CheckCrlTimes() is already fixed in rhel7, and CERT_CompareAV() is fixed in upstream nss, so it would just need a backport to rhel7
oops. a non-clean compile tricked me into thinking this was fixed in 3.28 on fedora but it was not. The header contains the entry, but the library .so does not actually export this. I've created a new upstream bug report for this:
Paul, the symbol has been exported in F26 and Rawhide in these packages (or later):
This worked great. libreswan in rawhide updated.
I'm marking this bug as a duplicate of bug 1422165, which contains a patch that includes this export.
*** This bug has been marked as a duplicate of bug 1422165 ***