diff --git a/config/external/nss/nss.def b/config/external/nss/nss.def
index f6551a8ea..4b12c91f0 100644
--- a/config/external/nss/nss.def
+++ b/config/external/nss/nss.def
@@ -103,6 +103,7 @@ CERT_FreeNicknames
 CERT_GenTime2FormattedAscii_Util
 CERT_GetCertChainFromCert
 CERT_GetCertEmailAddress
+CERT_GetCertificateDer
 CERT_GetCertificateRequestExtensions
 CERT_GetCertTimes
 CERT_GetCertTrust
@@ -134,7 +135,6 @@ CERT_NewCertList
 CERT_NewTempCertificate
 CERT_NicknameStringsFromCertList
 CERT_OCSPCacheSettings
-CERT_PKIXVerifyCert
 CERT_RemoveCertListNode
 CERT_RFC1485_EscapeAndQuote
 CERT_SaveSMimeProfile
@@ -170,6 +170,7 @@ HASH_Create
 HASH_Destroy
 HASH_End
 HASH_GetHashObject
+HASH_GetHashOidTagByHashType
 HASH_GetType
 HASH_HashBuf
 HASH_ResultLenByOidTag
@@ -210,7 +211,9 @@ NSS_CMSSignedData_Create
 NSS_CMSSignedData_CreateCertsOnly
 NSS_CMSSignedData_Destroy
 NSS_CMSSignedData_GetContentInfo
+NSS_CMSSignedData_GetDigestAlgs
 NSS_CMSSignedData_GetSignerInfo
+NSS_CMSSignedData_HasDigests
 NSS_CMSSignedData_ImportCerts
 NSS_CMSSignedData_SetDigestValue
 NSS_CMSSignedData_SignerInfoCount
@@ -261,6 +264,7 @@ NSS_Init
 NSS_Initialize
 NSS_InitWithMerge
 NSS_IsInitialized
+NSS_OptionSet
 NSS_NoDB_Init
 NSS_SecureMemcmp
 NSS_SetAlgorithmPolicy
@@ -325,11 +329,13 @@ PK11_ExportDERPrivateKeyInfo
 PK11_ExportEncryptedPrivKeyInfo
 PK11_ExtractKeyValue
 PK11_FindCertFromNickname
+PK11_FindCertInSlot
 PK11_FindCertsFromEmailAddress
 PK11_FindCertsFromNickname
 PK11_FindKeyByAnyCert
 PK11_FindKeyByDERCert
 PK11_FindKeyByKeyID
+PK11_FindRawCertsWithSubject
 PK11_FindSlotByName
 PK11_FindSlotsByNames
 PK11_FreeSlot
@@ -347,6 +353,7 @@ PK11_GetBestSlot
 PK11_GetBestSlotMultiple
 PK11_GetBlockSize
 PK11_GetCertFromPrivateKey
+PK11_GetCertsMatchingPrivateKey
 PK11_GetDefaultArray
 PK11_GetDefaultFlags
 PK11_GetDisabledReason
@@ -360,7 +367,9 @@ PK11_GetLowLevelKeyIDForPrivateKey
 PK11_GetMechanism
 PK11_GetMinimumPwdLength
 PK11_GetModInfo
+PK11_GetModuleURI
 PK11_GetNextSafe
+PK11_GetNextSymKey
 PK11_GetPadMechanism
 PK11_GetPrivateKeyNickname
 PK11_GetPrivateModulusLen
@@ -369,8 +378,11 @@ PK11_GetSlotInfo
 PK11_GetSlotName
 PK11_GetSlotPWValues
 PK11_GetSlotSeries
+PK11_GetSymKeyNickname
 PK11_GetTokenInfo
 PK11_GetTokenName
+PK11_GetTokenURI
+PK11_HasAttributeSet
 PK11_HashBuf
 PK11_HasRootCerts
 PK11_ImportCert
@@ -394,12 +406,14 @@ PK11_KeyGen
 PK11_KeyGenWithTemplate
 PK11_ListCerts
 PK11_ListCertsInSlot
+PK11_ListFixedKeysInSlot
 PK11_ListPrivateKeysInSlot
 PK11_ListPrivKeysInSlot
 PK11_LoadPrivKey
 PK11_Logout
 PK11_LogoutAll
 PK11_MakeIDFromPubKey
+PK11_MapSignKeyType
 PK11_MechanismToAlgtag
 PK11_MergeTokens
 PK11_NeedLogin
@@ -422,13 +436,17 @@ PK11SDR_Decrypt
 PK11SDR_Encrypt
 PK11_SetPasswordFunc
 PK11_SetSlotPWValues
+PK11_SetSymKeyNickname
 PK11_Sign
 PK11_SignatureLen
+PK11_SignWithMechanism
+PK11_TokenKeyGenWithFlags
 PK11_UnwrapPrivKey
 PK11_UnwrapSymKey
 PK11_UpdateSlotAttribute
 PK11_UserDisableSlot
 PK11_UserEnableSlot
+PK11_VerifyWithMechanism
 PK11_WrapPrivKey
 PK11_WrapSymKey
 PORT_Alloc
@@ -628,9 +646,11 @@ SEC_StringToOID
 SEC_UTF8StringTemplate DATA
 SEC_UTF8StringTemplate_Util DATA
 SGN_Begin
+SGN_CreateDigestInfo
 SGN_CreateDigestInfo_Util
 SGN_DecodeDigestInfo
 SGN_DestroyContext
+SGN_DestroyDigestInfo
 SGN_DestroyDigestInfo_Util
 SGN_End
 SGN_NewContext
@@ -652,7 +672,9 @@ SSL_GetClientAuthDataHook
 SSL_GetImplementedCiphers
 SSL_GetNextProto
 SSL_GetNumImplementedCiphers
+SSL_GetPreliminaryChannelInfo
 SSL_GetSRTPCipher
+SSL_GetStatistics
 SSL_HandshakeCallback
 SSL_HandshakeNegotiatedExtension
 SSL_ImplementedCiphers DATA
@@ -663,15 +685,21 @@ SSL_OptionSet
 SSL_OptionSetDefault
 SSL_PeerCertificate
 SSL_PeerCertificateChain
+SSL_PeerSignedCertTimestamps
 SSL_PeerStapledOCSPResponses
 SSL_ResetHandshake
+SSL_SendAdditionalKeyShares
 SSL_SetCanFalseStartCallback
+SSL_SetDowngradeCheckVersion
 SSL_SetNextProtoNego
 SSL_SetPKCS11PinArg
 SSL_SetSockPeerID
 SSL_SetSRTPCiphers
 SSL_SetStapledOCSPResponses
+SSL_SetTrustAnchors
 SSL_SetURL
+SSL_ShutdownServerSessionIDCache
+SSL_SignatureSchemePrefSet
 SSL_SNISocketConfigHook
 SSL_VersionRangeGet
 SSL_VersionRangeGetDefault
diff --git a/config/external/nss/nss.symbols b/config/external/nss/nss.symbols
index c46f86dea..10dcaa16f 100644
--- a/config/external/nss/nss.symbols
+++ b/config/external/nss/nss.symbols
@@ -166,6 +166,7 @@ DER_GeneralizedTimeToTime
 DER_GeneralizedTimeToTime_Util
 DER_GetInteger
 DER_GetInteger_Util
+DER_Lengths
 DER_SetUInteger
 DER_UTCTimeToTime_Util
 DSAU_DecodeDerSigToLen
@@ -683,6 +684,7 @@ SSL_GetClientAuthDataHook
 SSL_GetImplementedCiphers
 SSL_GetNextProto
 SSL_GetNumImplementedCiphers
+SSL_GetPreliminaryChannelInfo
 SSL_GetSRTPCipher
 SSL_GetStatistics
 SSL_HandshakeCallback