Hey there, let's work through your certificate installation and NSS compilation hurdles step by step—you're already on the right track targeting NSS 3.35+, so let's get that sorted.

Core Context Recap #

Firefox 59 relies on the newer cert9.db certificate store format, but older CertUtil builds (from pre-3.35 NSS) only generate the outdated cert8.db. Compiling NSS 3.35+ is the correct path to get a compatible CertUtil, let's fix those build issues.

Problem 1: Lengthy Compilation Times #

Full NSS builds can drag on, but you can trim the time drastically by focusing only on what you need:

• Skip compiling the entire NSS suite and target just CertUtil with the command: make certutil. This builds only the tool and its critical dependencies, ignoring unrelated modules like network libraries.
• Use multi-threaded compilation to leverage your CPU cores. Add -j followed by your core count (e.g., make -j4 certutil for a 4-core CPU) to speed up the process significantly.
• Ensure you're using the latest Mozilla Build tools—they include optimizations that streamline the build pipeline.

Problem 2: "C Compiler cannot create executables" Error #

This error nearly always stems from a misconfigured build environment. Try these fixes in order:

• Validate Visual Studio Setup: NSS 3.35 requires Visual Studio 2015 Update 3 or later. Double-check that you've installed all necessary C/C++ development components, including the Windows SDK matching your system's architecture (32/64-bit).
• Load VS Environment Variables: Before launching the Mozilla Build shell, run the appropriate vcvars script from your VS installation. For 64-bit builds, this is typically vcvars64.bat (found in paths like C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\VC\Auxiliary\Build for VS 2017). This ensures the compiler can locate all required libraries and headers.
• Check Source Integrity: Redownload the NSS 3.35 and NSPR (required dependency) source archives, then extract them to a clean folder. Corrupted or incomplete source files often cause compiler failures.
• Clean Old Build Artifacts: Delete the obj directory in your NSS source folder before starting a new compile. Leftover build files can interfere with the fresh build process.

Bonus: Alternative to Compiling #

If compiling still feels like a slog, keep an eye on official Mozilla NSS release resources. Occasionally they offer pre-built standalone CertUtil binaries for Windows that support cert9.db—this could save you the hassle of building from scratch entirely.

内容的提问来源于stack exchange，提问作者Rommel Sudan