neon should be ported to use NSS library for cryptography. See the tracking bug for details and links on how it could be done.
neon has an library-agnostic SSL interface which is currently implemented for both OpenSSL and GnuTLS. To be able to port neon to NSS, NSS needs to be able to work in a mode where a central certificate database is not required. I couldn't work out how to do this with the current API.
NSS can be initialized to work without a centralized database. The open ssl compatibility libraries currently uses this method. That being said, doing so can leave the application deficient compared to other applications. Certainly for the first step, that's probably sufficient. As we enable the shared database code, applications that don't play in that shared database will be viewed as deficient or lacking.
Can you explain how? I think I was supposed to call NSS_NoDB_Init() to initialize, right? I couldn't see any way to get a CERTCertDBHandle * pointer other than calling the CERT_GetDefaultCertDB() function, so virtually all the state neon needs to manipulate is process-global (e.g. the cert verification callback) - which is not possible for a library interface.
The other thing I stumbled on when looking at this was that the export policy would have to be set (again as process-global state) at startup somehow. How would an application (or worse, a library) be expected to decide what export policy to use? Is this supposed to be user-configurable?
*** Bug 346661 has been marked as a duplicate of this bug. ***