diff -up nss/lib/ssl/config.mk.disableSSL2libssl nss/lib/ssl/config.mk
--- nss/lib/ssl/config.mk.disableSSL2libssl	2019-03-28 10:36:01.859196244 +0100
+++ nss/lib/ssl/config.mk	2019-03-28 10:36:53.250120885 +0100
@@ -61,6 +61,10 @@ ifdef NSS_DISABLE_TLS_1_3
 DEFINES += -DNSS_DISABLE_TLS_1_3
 endif
 
+ifdef NSS_NO_SSL2
+DEFINES += -DNSS_NO_SSL2
+endif
+
 ifeq (,$(filter-out DragonFly FreeBSD Linux NetBSD OpenBSD, $(OS_TARGET)))
 CFLAGS += -std=gnu99
 endif
diff -up nss/lib/ssl/sslsock.c.disableSSL2libssl nss/lib/ssl/sslsock.c
--- nss/lib/ssl/sslsock.c.disableSSL2libssl	2019-03-28 10:36:01.849196454 +0100
+++ nss/lib/ssl/sslsock.c	2019-03-28 10:36:01.860196223 +0100
@@ -1363,6 +1363,10 @@ SSLExp_SetMaxEarlyDataSize(PRFileDesc *f
 static PRBool
 ssl_IsRemovedCipherSuite(PRInt32 suite)
 {
+#ifdef NSS_NO_SSL2
+    if (SSL_IS_SSL2_CIPHER(suite))
+        return PR_TRUE;
+#endif /* NSS_NO_SSL2 */
     switch (suite) {
         case SSL_FORTEZZA_DMS_WITH_NULL_SHA:
         case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA: