diff -ur stunnel/configure.ac stunnel-4.20/configure.ac
--- stunnel/configure.ac	2006-11-11 15:58:01.000000000 +0100
+++ stunnel-4.20/configure.ac	2007-08-27 16:28:05.000000000 +0200
@@ -48,12 +48,24 @@
 AC_CHECK_FILE("/dev/ptmx", AC_DEFINE(HAVE_DEV_PTMX))
 AC_CHECK_FILE("/dev/ptc", AC_DEFINE(HAVE_DEV_PTS_AND_PTC))
 
+# Crypto implementation
+AC_ARG_WITH([nss],
+    [  --with-nss              Use nss_compat_ossl instead of OpenSSL],
+    [], [with_nss=no])
+if test "x$with_nss" != xno
+then AC_DEFINE([WITH_NSS], [1], [Define to 1 if you are using nss_compat_ossl])
+    PKG_CHECK_MODULES([NSS], [nss])
+    LIBS="$LIBS -lnss_compat_ossl"
+fi
+
 AC_MSG_NOTICE([**************************************** entropy])
 
-AC_ARG_WITH(egd-socket,
-    [  --with-egd-socket=FILE  Entropy Gathering Daemon socket pathname],
-    [EGD_SOCKET="$withval"]
-)
+if test "x$with_nss" = xno
+then AC_ARG_WITH(egd-socket,
+	[  --with-egd-socket=FILE  Entropy Gathering Daemon socket pathname],
+	[EGD_SOCKET="$withval"]
+    )
+fi
 if test -n "$EGD_SOCKET"
 then AC_DEFINE_UNQUOTED(EGD_SOCKET, "$EGD_SOCKET")
 fi
@@ -227,69 +239,79 @@
     return 1
 }
 
-# Check for SSL directory
-AC_MSG_CHECKING([for SSL directory])
-AC_ARG_WITH(ssl,
-[  --with-ssl=DIR          location of installed SSL libraries/include files],
-    [
-        # Check the specified localtion only
-        checkssldir "$withval"
-    ],
-    [
-        # Search default localtions of SSL library
-        for maindir in /usr/local /usr/lib /usr/pkg /usr /var/ssl /opt; do
-            for dir in $maindir $maindir/openssl $maindir/ssl; do
-                checkssldir $dir && break 2
-            done
-        done
-    ]
-)
-if test -z "$ssldir"
-then AC_MSG_RESULT([Not found])
-    echo
-    echo "Couldn't find your SSL library installation dir"
-    echo "Use --with-ssl option to fix this problem"
-    echo
-    exit 1
-fi
-AC_MSG_RESULT([$ssldir])
-AC_SUBST(ssldir)
-AC_DEFINE_UNQUOTED(ssldir, "$ssldir")
-
-# Add SSL includes and libraries
-CFLAGS="$CFLAGS -I$ssldir/include"
-LIBS="$LIBS -L$ssldir/lib -lssl -lcrypto"
-
-# Check for obsolete RSAref library
-AC_MSG_CHECKING([for obsolete RSAref library])
-saved_LIBS="$LIBS"
-LIBS="$saved_LIBS -lRSAglue -L$prefix/lib -lrsaref"
-AC_LINK_IFELSE(
-    [AC_LANG_PROGRAM([[]], [[]])],
-    [AC_MSG_RESULT([yes])],
-    [AC_MSG_RESULT([no]); LIBS="$saved_LIBS"]
-)
+if test "x$with_nss" = "xno"
+then
+    # Check for SSL directory
+    AC_MSG_CHECKING([for SSL directory])
+    AC_ARG_WITH(ssl,
+    [  --with-ssl=DIR          location of installed SSL libraries/include files],
+	[
+	    # Check the specified localtion only
+	    checkssldir "$withval"
+	],
+	[
+	    # Search default localtions of SSL library
+	    for maindir in /usr/local /usr/lib /usr/pkg /usr /var/ssl /opt; do
+		for dir in $maindir $maindir/openssl $maindir/ssl; do
+		    checkssldir $dir && break 2
+		done
+	    done
+	]
+    )
+    if test -z "$ssldir"
+    then AC_MSG_RESULT([Not found])
+	echo
+	echo "Couldn't find your SSL library installation dir"
+	echo "Use --with-ssl option to fix this problem"
+	echo
+	exit 1
+    fi
+    AC_MSG_RESULT([$ssldir])
+    AC_SUBST(ssldir)
+    AC_DEFINE_UNQUOTED(ssldir, "$ssldir")
+
+    # Add SSL includes and libraries
+    CFLAGS="$CFLAGS -I$ssldir/include"
+    LIBS="$LIBS -L$ssldir/lib -lssl -lcrypto"
 
-AC_CHECK_HEADER([$ssldir/include/openssl/engine.h],
-    [AC_DEFINE([HAVE_OSSL_ENGINE_H])],
-    [AC_MSG_WARN([Openssl engine header not found])])
+    # Check for obsolete RSAref library
+    AC_MSG_CHECKING([for obsolete RSAref library])
+    saved_LIBS="$LIBS"
+    LIBS="$saved_LIBS -lRSAglue -L$prefix/lib -lrsaref"
+    AC_LINK_IFELSE(
+	[AC_LANG_PROGRAM([[]], [[]])],
+	[AC_MSG_RESULT([yes])],
+	[AC_MSG_RESULT([no]); LIBS="$saved_LIBS"]
+    )
+
+    AC_CHECK_HEADER([$ssldir/include/openssl/engine.h],
+	[AC_DEFINE([HAVE_OSSL_ENGINE_H])],
+	[AC_MSG_WARN([Openssl engine header not found])])
+fi
 
 AC_MSG_NOTICE([**************************************** optional features])
 # Use RSA?
-AC_MSG_CHECKING([whether to disable RSA support])
-AC_ARG_ENABLE(rsa,
-[  --disable-rsa           Disable RSA support],
-    [AC_MSG_RESULT([yes]); AC_DEFINE(NO_RSA)],
-    [AC_MSG_RESULT([no])]
-)
+if test "x$with_nss" != xno
+then AC_DEFINE([NO_RSA])
+else
+    AC_MSG_CHECKING([whether to disable RSA support])
+    AC_ARG_ENABLE(rsa,
+    [  --disable-rsa           Disable RSA support],
+	[AC_MSG_RESULT([yes]); AC_DEFINE(NO_RSA)],
+	[AC_MSG_RESULT([no])]
+    )
+fi
 
 # Use DH?
-AC_MSG_CHECKING([whether to enable DH support])
-AC_ARG_ENABLE(dh,
-[  --enable-dh             Enable DH support],
-    [AC_MSG_RESULT([yes]); USE_DH=1; AC_DEFINE(USE_DH)],
-    [AC_MSG_RESULT([no])]
-)
+if test "x$with_nss" = xno
+then
+    AC_MSG_CHECKING([whether to enable DH support])
+    AC_ARG_ENABLE(dh,
+    [  --enable-dh             Enable DH support],
+	[AC_MSG_RESULT([yes]); USE_DH=1; AC_DEFINE(USE_DH)],
+	[AC_MSG_RESULT([no])]
+    )
+fi
 AC_SUBST(USE_DH)
 
 # Use IPv6?
diff -ur stunnel/src/common.h stunnel-4.20/src/common.h
--- stunnel/src/common.h	2006-11-17 10:03:18.000000000 +0100
+++ stunnel-4.20/src/common.h	2007-08-23 23:52:12.000000000 +0200
@@ -307,7 +307,9 @@
 
 /**************************************** OpenSSL headers */
 
-#ifdef HAVE_OPENSSL
+#ifdef WITH_NSS
+#include <nss_compat_ossl/nss_compat_ossl.h>
+#elif defined(HAVE_OPENSSL)
 #include <openssl/lhash.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
diff -ur stunnel/src/ctx.c stunnel-4.20/src/ctx.c
--- stunnel/src/ctx.c	2006-11-15 19:54:18.000000000 +0100
+++ stunnel-4.20/src/ctx.c	2007-08-27 16:28:58.000000000 +0200
p@@ -68,15 +68,16 @@
 /**************************************** initialize section->ctx */
 
 void context_init(LOCAL_OPTIONS *section) { /* init SSL context */
-    struct stat st; /* buffer for stat */
-
     /* check if certificate exists */
     if(!section->key) /* key file not specified */
         section->key=section->cert;
+#ifndef WITH_NSS
 #ifdef HAVE_OSSL_ENGINE_H
     if(!section->engine)
 #endif
     if(section->option.cert) {
+        struct stat st; /* buffer for stat */
+
         if(stat(section->key, &st)) {
             ioerror(section->key);
             exit(1);
@@ -86,6 +87,7 @@
             s_log(LOG_WARNING, "Wrong permissions on %s", section->key);
 #endif /* defined USE_WIN32 */
     }
+#endif /* !WITH_NSS */
     /* create SSL context */
     if(section->option.client) {
         section->ctx=SSL_CTX_new(section->client_method());
@@ -99,12 +101,14 @@
             s_log(LOG_WARNING, "Diffie-Hellman initialization failed");
 #endif /* USE_DH */
     }
+#ifndef WITH_NSS
     if(section->ssl_options) {
         s_log(LOG_DEBUG, "Configuration SSL options: 0x%08lX",
             section->ssl_options);
         s_log(LOG_DEBUG, "SSL options set: 0x%08lX",
             SSL_CTX_set_options(section->ctx, section->ssl_options));
     }
+#endif
     if(section->cipher_list) {
         if (!SSL_CTX_set_cipher_list(section->ctx, section->cipher_list)) {
             sslerror("SSL_CTX_set_cipher_list");
@@ -366,8 +370,13 @@
             where & SSL_CB_READ ? "read" : "write",
             SSL_alert_type_string_long(ret),
             SSL_alert_desc_string_long(ret));
-    else if(where==SSL_CB_HANDSHAKE_DONE)
+    else if(where==SSL_CB_HANDSHAKE_DONE) {
+#ifndef WITH_NSS
         print_stats(s->ctx);
+#else
+        print_stats(s);
+#endif
+    }
 }
 
 static void print_stats(SSL_CTX *ctx) { /* print statistics */
diff -ur stunnel/src/Makefile.am stunnel-4.20/src/Makefile.am
--- stunnel/src/Makefile.am	2006-11-04 23:23:22.000000000 +0100
+++ stunnel-4.20/src/Makefile.am	2007-08-23 23:29:59.000000000 +0200
@@ -27,7 +27,8 @@
 
 # Additional compiler flags
 
-AM_CPPFLAGS = -DLIBDIR='"$(libdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' -DPIDFILE='"$(prefix)/var/run/stunnel/stunnel.pid"'
+AM_CPPFLAGS = -DLIBDIR='"$(libdir)"' -DCONFDIR='"$(sysconfdir)/stunnel"' -DPIDFILE='"$(prefix)/var/run/stunnel/stunnel.pid"' $(NSS_CFLAGS)
+AM_LDFLAGS = $(NSS_LIBS)
 
 # Win32 executable
 
diff -ur stunnel/src/options.c stunnel-4.20/src/options.c
--- stunnel/src/options.c	2007-08-23 22:39:27.000000000 +0200
+++ stunnel-4.20/src/options.c	2007-08-26 19:16:03.000000000 +0200
@@ -51,12 +51,16 @@
 #endif
 
 static int parse_debug_level(char *);
+#ifndef WITH_NSS
 static int parse_ssl_option(char *);
+#endif
 static int print_socket_options(void);
 static void print_option(char *, int, OPT_UNION *);
 static int parse_socket_option(char *);
+#if !defined(WITH_NSS) && SSLEAY_VERSION_NUMBER >= 0x00907000L
 static char *parse_ocsp_url(LOCAL_OPTIONS *, char *);
 static unsigned long parse_ocsp_flag(char *);
+#endif /* !WITH_NSS && OpenSSL-0.9.7 */
 
 GLOBAL_OPTIONS options;
 LOCAL_OPTIONS local_options;
@@ -72,8 +76,6 @@
     "Specified option name is not valid here";
 
 static char *global_options(CMD cmd, char *opt, char *arg) {
-    char *tmpstr;
-
     if(cmd==CMD_DEFAULT || cmd==CMD_HELP) {
         log_raw("Global options");
     }
@@ -98,6 +100,7 @@
 #endif /* HAVE_CHROOT */
 
     /* compression */
+#ifndef WITH_NSS
     switch(cmd) {
     case CMD_INIT:
         options.compression=COMP_NONE;
@@ -119,6 +122,7 @@
             "compression");
         break;
     }
+#endif
 
     /* debug */
     switch(cmd) {
@@ -147,7 +151,7 @@
     }
 
     /* EGD is only supported when compiled with OpenSSL 0.9.5a or later */
-#if SSLEAY_VERSION_NUMBER >= 0x0090581fL
+#if !defined(WITH_NSS) && SSLEAY_VERSION_NUMBER >= 0x0090581fL
     switch(cmd) {
     case CMD_INIT:
         options.egd_sock=NULL;
@@ -166,7 +170,7 @@
         log_raw("%-15s = path to Entropy Gathering Daemon socket", "EGD");
         break;
     }
-#endif /* OpenSSL 0.9.5a */
+#endif /* !WITH_NSS && OpenSSL 0.9.5a */
 
 #ifdef HAVE_OSSL_ENGINE_H
     /* engine */
@@ -188,6 +192,8 @@
 
     /* engineCtrl */
     switch(cmd) {
+        char *tmpstr;
+
     case CMD_INIT:
         break;
     case CMD_EXEC:
@@ -449,8 +455,6 @@
 
 static char *service_options(CMD cmd, LOCAL_OPTIONS *section,
         char *opt, char *arg) {
-    int tmpnum;
-
     if(cmd==CMD_DEFAULT || cmd==CMD_HELP) {
         log_raw(" ");
         log_raw("Service-level options");
@@ -624,6 +628,7 @@
         break;
     }
 
+#ifndef WITH_NSS
     /* CRLpath */
     switch(cmd) {
     case CMD_INIT:
@@ -663,6 +668,7 @@
         log_raw("%-15s = CRL file", "CRLfile");
         break;
     }
+#endif
 
     /* delay */
     switch(cmd) {
@@ -805,7 +811,7 @@
         break;
     }
 
-#if SSLEAY_VERSION_NUMBER >= 0x00907000L
+#if !defined(WITH_NSS) && SSLEAY_VERSION_NUMBER >= 0x00907000L
     /* OCSP */
     switch(cmd) {
     case CMD_INIT:
@@ -830,7 +836,9 @@
     case CMD_INIT:
         section->ocsp_flags=0;
         break;
-    case CMD_EXEC:
+    case CMD_EXEC: {
+	int tmpnum;
+
         if(strcasecmp(opt, "OCSPflag"))
             break;
         tmpnum=parse_ocsp_flag(arg);
@@ -838,20 +846,24 @@
             return "Illegal OCSP flag";
         section->ocsp_flags|=tmpnum;
         return NULL;
+    }
     case CMD_DEFAULT:
         break;
     case CMD_HELP:
         log_raw("%-15s = OCSP server flags", "OCSPflag");
         break;
     }
-#endif /* OpenSSL-0.9.7 */
+#endif /* !WITH_NSS && OpenSSL-0.9.7 */
 
     /* options */
+#ifndef WITH_NSS
     switch(cmd) {
     case CMD_INIT:
         section->ssl_options=0;
         break;
-    case CMD_EXEC:
+    case CMD_EXEC: {
+	int tmpnum;
+
         if(strcasecmp(opt, "options"))
             break;
         tmpnum=parse_ssl_option(arg);
@@ -859,6 +871,7 @@
             return "Illegal SSL option";
         section->ssl_options|=tmpnum;
         return NULL; /* OK */
+    }
     case CMD_DEFAULT:
         break;
     case CMD_HELP:
@@ -866,6 +879,7 @@
         log_raw("%18sset an SSL option", "");
         break;
     }
+#endif
 
     /* protocol */
     switch(cmd) {
@@ -1537,6 +1551,7 @@
     return 1; /* OK */
 }
 
+#ifndef WITH_NSS
 /* Parse out SSL options stuff */
 
 static int parse_ssl_option(char *arg) {
@@ -1580,6 +1595,7 @@
             return option->value;
     return 0; /* FAILED */
 }
+#endif /* !WITH_NSS */
 
 /* Parse out the socket options stuff */
 
@@ -1757,6 +1773,8 @@
     return 0; /* FAILED */
 }
 
+
+#if !defined(WITH_NSS) && SSLEAY_VERSION_NUMBER >= 0x00907000L
 /* Parse out OCSP URL */
 
 static char *parse_ocsp_url(LOCAL_OPTIONS *section, char *arg) {
@@ -1807,5 +1825,6 @@
             return option->value;
     return 0; /* FAILED */
 }
+#endif /* !WITH_NSS && OpenSSL-0.9.7 */
 
 /* End of options.c */
diff -ur stunnel/src/protocol.c stunnel-4.20/src/protocol.c
--- stunnel/src/protocol.c	2007-08-28 00:50:46.000000000 +0200
+++ stunnel-4.20/src/protocol.c	2007-08-28 01:39:59.000000000 +0200
@@ -30,6 +30,9 @@
 
 #include "common.h"
 #include "prototypes.h"
+#ifdef WITH_NSS
+#include <plbase64.h>
+#endif
 
 /* \n is not a character expected in the string */
 #define LINE "%[^\n]"
@@ -70,8 +73,10 @@
             imap_client(c);
         else if(!strcmp(c->opt->protocol, "nntp"))
             nntp_client(c);
+#ifndef WITH_NSS
         else if(!strcmp(c->opt->protocol, "connect"))
             connect_client(c);
+#endif
         else {
             s_log(LOG_ERR, "Protocol %s not supported in client mode",
                 c->opt->protocol);
@@ -529,8 +534,9 @@
 }
 
 static char *base64(int encode, char *in, int len) {
-    BIO *bio, *b64;
     char *out;
+#ifndef WITH_NSS
+    BIO *bio, *b64;
 
     b64=BIO_new(BIO_f_base64());
     BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
@@ -553,6 +559,23 @@
     }
     BIO_read(bio, out, len);
     BIO_free_all(bio);
+#else
+    if (encode) {
+	out = calloc(((len + 2) / 3) * 4 + 1, 1);
+	if (!out) {
+	    log_raw("Fatal memory allocation error");
+	    exit(2);
+	}
+	PL_Base64Encode(in, len, out);
+    } else {
+	out = calloc(((len * 3 + 3) / 4) + 1, 1);
+	if (!out) {
+	    log_raw("Fatal memory allocation error");
+	    exit(2);
+	}
+	PL_Base64Decode(in, len, out);
+    }
+#endif
     return out;
 }
 
diff -ur stunnel/src/ssl.c stunnel-4.20/src/ssl.c
--- stunnel/src/ssl.c	2006-11-05 14:04:58.000000000 +0100
+++ stunnel-4.20/src/ssl.c	2007-08-25 18:14:13.000000000 +0200
@@ -32,7 +32,9 @@
 #include "prototypes.h"
 
     /* Global OpenSSL initalization: compression, engine, entropy */
+#ifndef WITH_NSS
 static void init_compression(void);
+#endif
 static int init_prng(void);
 static int prng_seeded(int);
 static int add_rand_file(char *);
@@ -55,12 +57,15 @@
 }
 
 void ssl_configure(void) { /* configure global SSL settings */
+#ifndef WITH_NSS
     if(options.compression!=COMP_NONE)
         init_compression();
+#endif
     if(!init_prng())
         s_log(LOG_DEBUG, "PRNG seeded successfully");
 }
 
+#ifndef WITH_NSS
 static void init_compression(void) {
     int id=0;
     COMP_METHOD *cm=NULL;
@@ -91,6 +96,7 @@
     }
     s_log(LOG_INFO, "Compression enabled using %s method", name);
 }
+#endif
 
 static int init_prng(void) {
     int totbytes=0;
@@ -133,7 +139,7 @@
     s_log(LOG_DEBUG, "RAND_screen failed to sufficiently seed PRNG");
 #else
 
-#if SSLEAY_VERSION_NUMBER>=0x0090581fL
+#if !defined(WITH_NSS) && SSLEAY_VERSION_NUMBER>=0x0090581fL
     if(options.egd_sock) {
         if((bytes=RAND_egd(options.egd_sock))==-1) {
             s_log(LOG_WARNING, "EGD Socket %s failed", options.egd_sock);
@@ -157,7 +163,7 @@
     }
 #endif /* EGD_SOCKET */
 
-#endif /* OpenSSL-0.9.5a */
+#endif /* !WITH_NSS && OpenSSL-0.9.5a */
 #endif /* USE_WIN32 */
 
     /* Try the good-old default /dev/urandom, if available  */
diff -ur stunnel/src/sthreads.c stunnel-4.20/src/sthreads.c
--- stunnel/src/sthreads.c	2006-09-26 09:59:08.000000000 +0200
+++ stunnel-4.20/src/sthreads.c	2007-08-24 00:12:53.000000000 +0200
@@ -197,7 +197,7 @@
 }
 
 static void locking_callback(int mode, int type,
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL) || defined(WITH_NSS)
     const /* Callback definition has been changed in openssl 0.9.3 */
 #endif
     char *file, int line) {
diff -ur stunnel/src/verify.c stunnel-4.20/src/verify.c
--- stunnel/src/verify.c	2006-11-01 15:59:16.000000000 +0100
+++ stunnel-4.20/src/verify.c	2007-08-26 22:24:01.000000000 +0200
@@ -34,14 +34,20 @@
 /**************************************** prototypes */
 
 /* verify initialization */
+#ifndef WITH_NSS
 static void load_file_lookup(X509_STORE *, char *);
 static void add_dir_lookup(X509_STORE *, char *);
+#endif /* !WITH_NSS */
 
 /* verify callback */
 static int verify_callback(int, X509_STORE_CTX *);
 static int cert_check(CLI *c, X509_STORE_CTX *, char *, int);
+#ifndef WITH_NSS
 static int crl_check(CLI *c, X509_STORE_CTX *, char *);
+#endif
+#if !defined(WITH_NSS) && SSLEAY_VERSION_NUMBER >= 0x00907000L
 static int ocsp_check(CLI *c, X509_STORE_CTX *, char *);
+#endif /* !WITH_NSS && OpenSSL-0.9.7 */
 
 /**************************************** verify initialization */
 
@@ -55,11 +61,13 @@
         exit(1);
     }
 
+#ifndef WITH_NSS
     section->revocation_store=X509_STORE_new();
     if(!section->revocation_store) {
         sslerror("X509_STORE_new");
         exit(1);
     }
+#endif
 
     if(section->ca_file) {
         if(!SSL_CTX_load_verify_locations(section->ctx,
@@ -75,7 +83,9 @@
 #endif
         s_log(LOG_DEBUG, "Loaded verify certificates from %s",
             section->ca_file);
+#ifndef WITH_NSS
         load_file_lookup(section->revocation_store, section->ca_file);
+#endif
     }
 
     if(section->ca_dir) {
@@ -87,9 +97,12 @@
             exit(1);
         }
         s_log(LOG_DEBUG, "Verify directory set to %s", section->ca_dir);
+#ifndef WITH_NSS
         add_dir_lookup(section->revocation_store, section->ca_dir);
+#endif
     }
 
+#ifndef WITH_NSS
     if(section->crl_file)
         load_file_lookup(section->revocation_store, section->crl_file);
 
@@ -97,6 +110,7 @@
         section->revocation_store->cache=0; /* don't cache CRLs */
         add_dir_lookup(section->revocation_store, section->crl_dir);
     }
+#endif /* !WITH_NSS */
 
     SSL_CTX_set_verify(section->ctx, section->verify_level==SSL_VERIFY_NONE ?
         SSL_VERIFY_PEER : section->verify_level, verify_callback);
@@ -105,6 +119,7 @@
         s_log(LOG_NOTICE, "Peer certificate location %s", section->ca_dir);
 }
 
+#ifndef WITH_NSS
 static void load_file_lookup(X509_STORE *store, char *name) {
     X509_LOOKUP *lookup;
 
@@ -136,6 +151,7 @@
     }
     s_log(LOG_DEBUG, "Added %s revocation lookup directory", name);
 }
+#endif /* !WITH_NSS */
 
 /**************************************** verify callback */
 
@@ -157,16 +173,17 @@
 
     if(!cert_check(c, callback_ctx, subject_name, preverify_ok))
         return 0; /* reject connection */
+#ifndef WITH_NSS
     if(!crl_check(c, callback_ctx, subject_name))
         return 0; /* reject connection */
-#if SSLEAY_VERSION_NUMBER >= 0x00907000L
+#endif /* !WITH_NSS */
+#if !defined(WITH_NSS) && SSLEAY_VERSION_NUMBER >= 0x00907000L
     if(c->opt->option.ocsp && !ocsp_check(c, callback_ctx, subject_name))
         return 0; /* reject connection */
-#endif /* OpenSSL-0.9.7 */
+#endif /* !WITH_NSS && OpenSSL-0.9.7 */
 
     /* errnum=X509_STORE_CTX_get_error(ctx); */
-    s_log(LOG_NOTICE, "VERIFY OK: depth=%d, %s",
-        callback_ctx->error_depth, subject_name);
+    s_log(LOG_NOTICE, "VERIFY OK: %s", subject_name);
     return 1; /* accept connection */
 }
 
@@ -177,19 +194,21 @@
     X509_OBJECT ret;
 
     if(c->opt->verify_level==SSL_VERIFY_NONE) {
-        s_log(LOG_NOTICE, "VERIFY IGNORE: depth=%d, %s",
-            callback_ctx->error_depth, subject_name);
+        s_log(LOG_NOTICE, "VERIFY IGNORE: %s", subject_name);
         return 1; /* accept connection */
     }
     if(!preverify_ok) {
         /* remote site specified a certificate, but it's not correct */
-        s_log(LOG_WARNING, "VERIFY ERROR: depth=%d, error=%s: %s",
-            callback_ctx->error_depth,
+        s_log(LOG_WARNING, "VERIFY ERROR: error=%s: %s",
             X509_verify_cert_error_string (callback_ctx->error),
                 subject_name);
         return 0; /* reject connection */
     }
-    if(c->opt->verify_use_only_my && callback_ctx->error_depth==0 &&
+    /* FIXME: test this */
+    if(c->opt->verify_use_only_my &&
+#ifndef WITH_NSS
+       callback_ctx->error_depth==0 &&
+#endif
             X509_STORE_get_by_subject(callback_ctx, X509_LU_X509,
                 X509_get_subject_name(callback_ctx->current_cert), &ret)!=1) {
         s_log(LOG_WARNING, "VERIFY ERROR ONLY MY: no cert for %s",
@@ -201,6 +220,7 @@
 
 /**************************************** CRL checking */
 
+#ifndef WITH_NSS
 /* based on BSD-style licensed code of mod_ssl */
 static int crl_check(CLI *c, X509_STORE_CTX *callback_ctx,
         char *subject_name) {
@@ -318,10 +338,11 @@
     }
     return 1; /* accept connection */
 }
+#endif /* !WITH_NSS */
 
 /**************************************** OCSP checking */
 
-#if SSLEAY_VERSION_NUMBER >= 0x00907000L
+#if !defined(WITH_NSS) && SSLEAY_VERSION_NUMBER >= 0x00907000L
 static int ocsp_check(CLI *c, X509_STORE_CTX *callback_ctx,
         char *subject_name) {
     int error, retval=0;
@@ -442,6 +463,6 @@
     c->fd=-1; /* avoid double close on cleanup */
     return retval;
 }
-#endif /* OpenSSL-0.9.7 */
+#endif /* !WITH_NSS && OpenSSL-0.9.7 */
 
 /* End of verify.c */