Use the TLS 1.2 mechanisms for PKCS #11.

net/third_party/nss/ssl/sslsock.c

Index: net/third_party/nss/ssl/sslsock.c
===================================================================
--- net/third_party/nss/ssl/sslsock.c	(revision 219583)
+++ net/third_party/nss/ssl/sslsock.c	(working copy)
@@ -22,8 +22,8 @@
 
 /* This is a bodge to allow this code to be compiled against older NSS headers
  * that don't contain the TLS 1.2 changes. */
-#ifndef CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256
-#define CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 (CKM_NSS + 24)
+#ifndef CKM_TLS12_MASTER_KEY_DERIVE_DH
+#define CKM_TLS12_MASTER_KEY_DERIVE_DH      0x000003E2
 #endif
 
 #define SET_ERROR_CODE   /* reminder */
@@ -1918,7 +1918,7 @@
 ssl_CheckTLS12Token(void)
 {
     tls12TokenExists =
-	PK11_TokenExists(CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256);
+	PK11_TokenExists(CKM_TLS12_MASTER_KEY_DERIVE_DH);
     return PR_SUCCESS;
 }