title: How can I ensure that curl uses openssl, and not nss?
body: <p>Is it possible to ensure by a configuration <a href="http://curl.haxx.se/docs/manpage.html" rel="nofollow"><code>parameter</code></a>, that <code>curl</code> uses <a href="http://www.openssl.org/" rel="nofollow">OpenSSL</a>, and <em>not</em> <a href="http://www.mozilla.org/projects/security/pki/nss/" rel="nofollow">NSS</a> to retrieve https content?  I need to ensure this, in order to enforce compliance with <a href="http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm" rel="nofollow">FIPS140-2</a>, which RHEL6.2 has certified?</p>
  
  <p>I think that answer is "no".</p>
  
  <p>So I'll ask the follow-up here as well...  Can I recompile curl to ensure that it uses libssl and not libnss?  I've tried:</p>
  
  <pre><code>./configure --with-ssl --without-nss
  </code></pre>
  
  <p>and I still end up with a curl binary that dynamically links against <code>libnss3.so</code>.</p>
  
  <pre><code>[root@fips curl-7.19.7]# ldd /usr/bin/curl 
          linux-vdso.so.1 =&gt;  (0x00007fffacbe8000)
          libcurl.so.4 =&gt; /usr/lib64/libcurl.so.4 (0x00007f5d8fe03000)
          libidn.so.11 =&gt; /lib64/libidn.so.11 (0x00007f5d8fbd1000)
          libldap-2.4.so.2 =&gt; /lib64/libldap-2.4.so.2 (0x00007f5d8f983000)
          librt.so.1 =&gt; /lib64/librt.so.1 (0x00007f5d8f77b000)
          libgssapi_krb5.so.2 =&gt; /lib64/libgssapi_krb5.so.2 (0x00007f5d8f537000)
          libkrb5.so.3 =&gt; /lib64/libkrb5.so.3 (0x00007f5d8f250000)
          libk5crypto.so.3 =&gt; /lib64/libk5crypto.so.3 (0x00007f5d8f024000)
          libcom_err.so.2 =&gt; /lib64/libcom_err.so.2 (0x00007f5d8ee20000)
          libssl.so.10 =&gt; /usr/lib64/libssl.so.10 (0x00007f5d8ebc2000)
          libcrypto.so.10 =&gt; /usr/lib64/libcrypto.so.10 (0x00007f5d8e828000)
          libdl.so.2 =&gt; /lib64/libdl.so.2 (0x00007f5d8e624000)
          libssh2.so.1 =&gt; /usr/lib64/libssh2.so.1 (0x00007f5d8e3fb000)
          libz.so.1 =&gt; /lib64/libz.so.1 (0x00007f5d8e1e5000)
          libc.so.6 =&gt; /lib64/libc.so.6 (0x00007f5d8de52000)
          liblber-2.4.so.2 =&gt; /lib64/liblber-2.4.so.2 (0x00007f5d8dc42000)
          libresolv.so.2 =&gt; /lib64/libresolv.so.2 (0x00007f5d8da28000)
          libssl3.so =&gt; /usr/lib64/libssl3.so (0x00007f5d8d7f2000)
          libsmime3.so =&gt; /usr/lib64/libsmime3.so (0x00007f5d8d5c5000)
  ---&gt;    libnss3.so =&gt; /usr/lib64/libnss3.so (0x00007f5d8d28a000)
  ---&gt;    libnssutil3.so =&gt; /usr/lib64/libnssutil3.so (0x00007f5d8d05f000)
          libplds4.so =&gt; /lib64/libplds4.so (0x00007f5d8ce5a000)
          libplc4.so =&gt; /lib64/libplc4.so (0x00007f5d8cc55000)
          libnspr4.so =&gt; /lib64/libnspr4.so (0x00007f5d8ca18000)
          libsasl2.so.2 =&gt; /usr/lib64/libsasl2.so.2 (0x00007f5d8c7fd000)
          libpthread.so.0 =&gt; /lib64/libpthread.so.0 (0x00007f5d8c5e0000)
          /lib64/ld-linux-x86-64.so.2 (0x00007f5d90062000)
          libkrb5support.so.0 =&gt; /lib64/libkrb5support.so.0 (0x00007f5d8c3d5000)
          libkeyutils.so.1 =&gt; /lib64/libkeyutils.so.1 (0x00007f5d8c1d1000)
          libcrypt.so.1 =&gt; /lib64/libcrypt.so.1 (0x00007f5d8bf99000)
          libselinux.so.1 =&gt; /lib64/libselinux.so.1 (0x00007f5d8bd7a000)
          libfreebl3.so =&gt; /lib64/libfreebl3.so (0x00007f5d8bb18000)
  </code></pre>