diff -up nss/gtests/ssl_gtest/ssl_ecdh_unittest.cc.disable_pss nss/gtests/ssl_gtest/ssl_ecdh_unittest.cc

--- nss/gtests/ssl_gtest/ssl_ecdh_unittest.cc.disable_pss	2017-02-17 11:45:24.866780893 +0100

+++ nss/gtests/ssl_gtest/ssl_ecdh_unittest.cc	2017-02-17 11:47:16.774439092 +0100

@@ -58,7 +58,7 @@ TEST_P(TlsConnectGeneric, ConnectEcdheP3

   server_->ConfigNamedGroups(groups);

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

 }

 // This causes a HelloRetryRequest in TLS 1.3.  Earlier versions don't care.

@@ -71,7 +71,7 @@ TEST_P(TlsConnectGeneric, ConnectEcdheP3

   server_->ConfigNamedGroups(groups);

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   EXPECT_EQ(version_ == SSL_LIBRARY_VERSION_TLS_1_3,

             hrr_capture->buffer().len() != 0);

 }

@@ -101,7 +101,7 @@ TEST_P(TlsKeyExchangeTest, P384Priority)

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1};

   CheckKEXDetails(groups, shares);

@@ -118,7 +118,7 @@ TEST_P(TlsKeyExchangeTest, DuplicateGrou

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1};

   std::vector<SSLNamedGroup> expectedGroups = {ssl_grp_ec_secp384r1,

@@ -136,7 +136,7 @@ TEST_P(TlsKeyExchangeTest, P384PriorityD

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   if (version_ >= SSL_LIBRARY_VERSION_TLS_1_3) {

     std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1};

@@ -161,7 +161,7 @@ TEST_P(TlsConnectGenericPre13, P384Prior

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

 }

 TEST_P(TlsConnectGenericPre13, P384PriorityFromModelSocket) {

@@ -177,7 +177,7 @@ TEST_P(TlsConnectGenericPre13, P384Prior

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

 }

 class TlsKeyExchangeGroupCapture : public TlsHandshakeFilter {

@@ -265,7 +265,7 @@ TEST_P(TlsConnectStreamPre13, Configured

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   CheckConnected();

   // The renegotiation has to use the same preferences as the original session.

@@ -273,7 +273,7 @@ TEST_P(TlsConnectStreamPre13, Configured

   client_->StartRenegotiate();

   Handshake();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

 }

 TEST_P(TlsConnectGenericPre13, GroupPreferenceServerPriority) {

@@ -293,7 +293,7 @@ TEST_P(TlsConnectGenericPre13, GroupPref

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

 }

 #ifndef NSS_DISABLE_TLS_1_3

@@ -312,7 +312,7 @@ TEST_P(TlsKeyExchangeTest13, Curve25519P

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp256r1};

   CheckKEXDetails(client_groups, shares);

 }

@@ -332,7 +332,7 @@ TEST_P(TlsKeyExchangeTest13, Curve25519P

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};

   CheckKEXDetails(client_groups, shares);

 }

@@ -354,7 +354,7 @@ TEST_P(TlsKeyExchangeTest13, EqualPriori

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};

   CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);

 }

@@ -376,7 +376,7 @@ TEST_P(TlsKeyExchangeTest13, NotEqualPri

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};

   CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);

 }

@@ -398,7 +398,7 @@ TEST_P(TlsKeyExchangeTest13,

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};

   CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);

 }

@@ -420,7 +420,7 @@ TEST_P(TlsKeyExchangeTest13,

   Connect();

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};

   CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);

 }

@@ -482,7 +482,7 @@ TEST_P(TlsKeyExchangeTest13, MultipleCli

   // The server would accept 25519 but its preferred group (P256) has to win.

   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,

-            ssl_sig_rsa_pss_sha256);

+            ssl_sig_rsa_pkcs1_sha256);

   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519,

                                              ssl_grp_ec_secp256r1};

   CheckKEXDetails(client_groups, shares);