Don't use NSS unless the user insists. It's known to not work so well (and has been fully broken for a long time already anyway). Just use GnuTLS, it's on every machine these days.