Use the TLS 1.2 mechanisms for PKCS #11.

net/third_party/nss/ssl/sslsock.c

 /*
  * vtables (and methods that call through them) for the 4 types of 
  * SSLSockets supported.  Only one type is still supported.
  * Various other functions.
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "seccomon.h"
 #include "cert.h"
 #include "keyhi.h"
 #include "ssl.h"
 #include "sslimpl.h"
 #include "sslproto.h"
 #include "nspr.h"
 #include "private/pprio.h"
 #ifndef NO_PKCS11_BYPASS
 #include "blapi.h"
 #endif
 #include "pk11pub.h"
 #include "nss.h"
 
 /* This is a bodge to allow this code to be compiled against older NSS headers
  * that don't contain the TLS 1.2 changes. */
-#ifndef CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256
-#define CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 (CKM_NSS + 24)
+#ifndef CKM_TLS12_MASTER_KEY_DERIVE_DH
+#define CKM_TLS12_MASTER_KEY_DERIVE_DH      0x000003E2
 #endif
 
 #define SET_ERROR_CODE   /* reminder */
 
 struct cipherPolicyStr {
         int             cipher;
         unsigned char   export; /* policy value for export policy */
         unsigned char   france; /* policy value for france policy */
 };
 
@@ skipping 1874 matching lines @@
     return SECSuccess;
 }
 
 static PRCallOnceType checkTLS12TokenOnce;
 static PRBool tls12TokenExists;
 
 static PRStatus  
 ssl_CheckTLS12Token(void)
 {
     tls12TokenExists =
-        PK11_TokenExists(CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256);
+        PK11_TokenExists(CKM_TLS12_MASTER_KEY_DERIVE_DH);
     return PR_SUCCESS;
 }
 
 static PRBool
 ssl_TLS12TokenExists(void)
 {
     (void) PR_CallOnce(&checkTLS12TokenOnce, ssl_CheckTLS12Token);
     return tls12TokenExists;
 }
 
@@ skipping 1187 matching lines @@
 loser:
             ssl_DestroySocketContents(ss);
             ssl_DestroyLocks(ss);
             PORT_Free(ss);
             ss = NULL;
         }
     }
     return ss;
 }