NSS-POLICY-CHECK(1)

📦 version 3.124.0, in centos-stream 10, centos-stream 9

💅 NSS-POLICY-CHECK 💅

bestie. okay. so this is nss-policy-check, one of the NSS Security Tools, and honestly? it's the vibe-checker of the crypto world.

✨ NAME ✨

nss-policy-check policy-file — literally just tell it which policy file to look at and it'll spill all the tea 🫖

✨ SYNOPSIS ✨

nss-policy-check

✨ DESCRIPTION ✨

okay so here's the deal: nss-policy-check goes in and verifies the crypto-policy configuration — the thing that controls which crypto algorithms are allowed or disallowed to be used inside the NSS library. like a bouncer at the club but for algorithms. 👑

and that crypto-policy configuration can live in one of two places, no cap:

  • a system-wide configuration file — the path is specified with the POLICY_PATH and POLICY_FILE build options
  • or in the pkcs11.txt inside the NSS database

🌸 USAGE AND EXAMPLES 🌸

say you wanna check the global crypto-policy configuration sitting at /etc/crypto-policies/back-ends/nss.config — iconic choice, just run this:

$ nss-policy-check /etc/crypto-policies/back-ends/nss.config
NSS-POLICY-INFO: LOADED-SUCCESSFULLY
NSS-POLICY-INFO: PRIME256V1 is enabled for KX
NSS-POLICY-INFO: PRIME256V1 is enabled for CERT-SIGNATURE
NSS-POLICY-INFO: SECP256R1 is enabled for KX
NSS-POLICY-INFO: SECP256R1 is enabled for CERT-SIGNATURE
NSS-POLICY-INFO: SECP384R1 is enabled for KX
NSS-POLICY-INFO: SECP384R1 is enabled for CERT-SIGNATURE
...
NSS-POLICY-INFO: NUMBER-OF-SSL-ALG-KX: 13
NSS-POLICY-INFO: NUMBER-OF-SSL-ALG: 9
NSS-POLICY-INFO: NUMBER-OF-CERT-SIG: 9
...
NSS-POLICY-INFO: ciphersuite TLS_AES_128_GCM_SHA256 is enabled
NSS-POLICY-INFO: ciphersuite TLS_CHACHA20_POLY1305_SHA256 is enabled
NSS-POLICY-INFO: ciphersuite TLS_AES_256_GCM_SHA384 is enabled
...
NSS-POLICY-INFO: NUMBER-OF-CIPHERSUITES: 24
NSS-POLICY-INFO: NUMBER-OF-TLS-VERSIONS: 3
NSS-POLICY-INFO: NUMBER-OF-DTLS-VERSIONS: 2

see how much it's giving? so much info. so organized. we love a thorough queen. 💖

now — if something goes wrong or there's a little warning moment, it gets prefixed with NSS-POLICY-FAIL or NSS-POLICY_WARN. so keep an eye out for those, fr fr. 🙈

and the exit status, listen up because this matters:

  • 2 — if any failure is found 😭
  • 1 — if any warning is found 💀
  • 0 — if no errors are found ⭐

🦋 ADDITIONAL RESOURCES 🦋

wanna know more about NSS and all the other tools related to NSS (like JSS)? go check out the NSS project wiki at http://www.mozilla.org/projects/security/pki/nss/. the NSS site relates directly to NSS code changes and releases, so it's genuinely the place to be. ✨

💜 AUTHORS 💜

the NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google. absolute legends, all of them. 👑

Authors: Elio Maldonado <emaldona@redhat.com>, Deon Lackey <dlackey@redhat.com>.

🎀 LICENSE 🎀

Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.

okay that's the whole page bestie, go forth and policy-check responsibly 🫶

mwah 💋 — this has been nss-tools, dated 22 June 2026, signing off ✨

📦 where this page comes from