diff --git a/security/nss/Makefile b/security/nss/Makefile
index 01ebe16bb1a..47923827c49 100644
--- a/security/nss/Makefile
+++ b/security/nss/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.3 2007/01/10 19:26:28 kurt Exp $
+# $OpenBSD: Makefile,v 1.4 2007/02/13 17:11:05 naddy Exp $
 
 SHARED_ONLY=		Yes
 
@@ -6,7 +6,7 @@ COMMENT=		"libraries to support development of security-enabled apps"
 
 VERSION=		3.11.4
 DISTNAME=		nss-${VERSION}
-PKGNAME=		${DISTNAME}p1
+PKGNAME=		${DISTNAME}p2
 SO_VERSION=		19.0
 .for _lib in freebl3 nss3 nssckbi smime3 softokn3 ssl3
 SHARED_LIBS+=		${_lib} ${SO_VERSION}
@@ -32,7 +32,8 @@ LIB_DEPENDS=		nspr4.>=17,plc4.>=17,plds4.>=17:nspr->=4.6.4p1:devel/nspr
 MAKE_ENV=		BUILD_OPT=1 \
 			LOCALBASE="${LOCALBASE}" \
 			NSS_ENABLE_ECC=1 \
-			SO_VERSION="${SO_VERSION}"
+			SO_VERSION="${SO_VERSION}" \
+			XCFLAGS="${CFLAGS}"
 
 CFLAGS+=		-I${LOCALBASE}/include/nspr
 
@@ -44,6 +45,10 @@ NSSOBJ=			${NSSDIST}/OpenBSD`uname -r`_OPT.OBJ
 
 ALL_TARGET=		nss_build_all
 
+# Don't forget to sync these with http://wiki.mozilla.org/NSS:ToolsToShip
+MAIN_TOOLS=		certutil modutil pk12util signtool ssltap crlutil \
+			cmsutil signver
+
 do-install:
 	${INSTALL_DATA_DIR} ${PREFIX}/include/nss
 	${INSTALL_DATA_DIR} ${PREFIX}/lib/pkgconfig
@@ -53,7 +58,7 @@ do-install:
 		${TAR} -xf - -C ${PREFIX}/lib
 	@chmod 444 ${PREFIX}/lib/*.so.${SO_VERSION}
 	${INSTALL_DATA} ${NSSOBJ}/lib/{libcrmf.a,*.chk} ${PREFIX}/lib/
-	${INSTALL_PROGRAM} ${NSSOBJ}/bin/* ${PREFIX}/bin/
+	@cd ${NSSOBJ}/bin && ${INSTALL_PROGRAM} ${MAIN_TOOLS} ${PREFIX}/bin/
 	${INSTALL_SCRIPT} ${FILESDIR}/nss-config ${PREFIX}/bin/
 	${INSTALL_DATA} ${FILESDIR}/nss.pc ${PREFIX}/lib/pkgconfig/
 	@perl -pi -e 's|!!PREFIX!!|${TRUEPREFIX}|g; s|!!VERSION!!|${VERSION}|g' \
diff --git a/security/nss/distinfo b/security/nss/distinfo
index 635eea08e61..b63d8e3bd83 100644
--- a/security/nss/distinfo
+++ b/security/nss/distinfo
@@ -1,4 +1,5 @@
 MD5 (nss-3.11.4.tar.gz) = 74af8ebdf94307f47ff8931adbef9c39
 RMD160 (nss-3.11.4.tar.gz) = 5047c7f56444b22bc5f64dbaa02576e48ab5ef2a
 SHA1 (nss-3.11.4.tar.gz) = fc032211f38bd3b688b75f3bdf36a32a23e4abd2
+SHA256 (nss-3.11.4.tar.gz) = c50062df123d733f25d4903f42e8855adf51b7324c786c714f7dd1ab9e328f06
 SIZE (nss-3.11.4.tar.gz) = 3713920
diff --git a/security/nss/patches/patch-mozilla_security_coreconf_command_mk b/security/nss/patches/patch-mozilla_security_coreconf_command_mk
index 5b0cf2f8e55..e69de29bb2d 100644
--- a/security/nss/patches/patch-mozilla_security_coreconf_command_mk
+++ b/security/nss/patches/patch-mozilla_security_coreconf_command_mk
@@ -1,12 +0,0 @@
-$OpenBSD: patch-mozilla_security_coreconf_command_mk,v 1.1.1.1 2006/12/04 17:19:54 kurt Exp $
---- mozilla/security/coreconf/command.mk.orig	Tue Oct 11 02:46:12 2005
-+++ mozilla/security/coreconf/command.mk	Mon Nov 13 22:41:39 2006
-@@ -45,7 +45,7 @@ ASFLAGS      += $(CFLAGS)
- CCF           = $(CC) $(CFLAGS)
- LINK_DLL      = $(LINK) $(OS_DLLFLAGS) $(DLLFLAGS)
- LINK_EXE      = $(LINK) $(OS_LFLAGS) $(LFLAGS)
--CFLAGS        = $(OPTIMIZER) $(OS_CFLAGS) $(XP_DEFINE) $(DEFINES) $(INCLUDES) \
-+CFLAGS       += $(OPTIMIZER) $(OS_CFLAGS) $(XP_DEFINE) $(DEFINES) $(INCLUDES) \
- 		$(XCFLAGS)
- RANLIB        = echo
- TAR           = /bin/tar
diff --git a/security/nss/patches/patch-mozilla_security_nss_Makefile b/security/nss/patches/patch-mozilla_security_nss_Makefile
index 2f70fff291e..e9eaed8d6ac 100644
--- a/security/nss/patches/patch-mozilla_security_nss_Makefile
+++ b/security/nss/patches/patch-mozilla_security_nss_Makefile
@@ -1,15 +1,12 @@
-$OpenBSD: patch-mozilla_security_nss_Makefile,v 1.1.1.1 2006/12/04 17:19:54 kurt Exp $
+$OpenBSD: patch-mozilla_security_nss_Makefile,v 1.2 2007/02/13 17:11:05 naddy Exp $
 --- mozilla/security/nss/Makefile.orig	Sat Apr 15 01:48:17 2006
-+++ mozilla/security/nss/Makefile	Mon Nov 13 22:41:39 2006
-@@ -78,9 +78,9 @@ include $(CORE_DEPTH)/coreconf/rules.mk
++++ mozilla/security/nss/Makefile	Sun Feb 11 22:52:48 2007
+@@ -78,7 +78,7 @@ include $(CORE_DEPTH)/coreconf/rules.mk
  # (7) Execute "local" rules. (OPTIONAL).                              #
  #######################################################################
  
 -nss_build_all: build_coreconf build_nspr build_dbm all
 +nss_build_all: build_coreconf build_dbm all
  
--nss_clean_all: clobber_coreconf clobber_nspr clobber_dbm clobber
-+nss_clean_all: clobber_coreconf clobber_dbm clobber
+ nss_clean_all: clobber_coreconf clobber_nspr clobber_dbm clobber
  
- build_coreconf:
- 	cd $(CORE_DEPTH)/coreconf ;  $(MAKE)
diff --git a/security/nss/patches/patch-mozilla_security_nss_tests_common_init_sh b/security/nss/patches/patch-mozilla_security_nss_tests_common_init_sh
index 3e13c4d56ba..c75a61f9007 100644
--- a/security/nss/patches/patch-mozilla_security_nss_tests_common_init_sh
+++ b/security/nss/patches/patch-mozilla_security_nss_tests_common_init_sh
@@ -1,15 +1,7 @@
-$OpenBSD: patch-mozilla_security_nss_tests_common_init_sh,v 1.1.1.1 2006/12/04 17:19:54 kurt Exp $
+$OpenBSD: patch-mozilla_security_nss_tests_common_init_sh,v 1.2 2007/02/13 17:11:05 naddy Exp $
 --- mozilla/security/nss/tests/common/init.sh.orig	Thu Jun 15 22:28:40 2006
-+++ mozilla/security/nss/tests/common/init.sh	Mon Nov 13 22:41:39 2006
-@@ -222,6 +222,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOU
- #HOST and DOMSUF are needed for the server cert 
-     case $HOST in
-         *\.*)
-+            DOMSUF=`echo $HOST | sed -e "s/^[^.]*\.//"`
-             HOST=`echo $HOST | sed -e "s/\..*//"`
-             ;;
-         ?*)
-@@ -230,6 +231,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOU
++++ mozilla/security/nss/tests/common/init.sh	Sun Feb 11 23:10:53 2007
+@@ -230,6 +230,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOU
              HOST=`uname -n`
              case $HOST in
                  *\.*)
diff --git a/security/nss/pkg/PLIST b/security/nss/pkg/PLIST
index b5b2af9e3f3..698ccbd0811 100644
--- a/security/nss/pkg/PLIST
+++ b/security/nss/pkg/PLIST
@@ -1,45 +1,14 @@
-@comment $OpenBSD: PLIST,v 1.2 2006/12/08 19:21:30 kili Exp $
+@comment $OpenBSD: PLIST,v 1.3 2007/02/13 17:11:05 naddy Exp $
 %%SHARED%%
-bin/addbuiltin
-@comment bin/atob
-bin/bltest
-@comment bin/btoa
-bin/certcgi
 bin/certutil
-bin/checkcert
-bin/client
 bin/cmsutil
 bin/crlutil
-bin/crmftest
-bin/dbtest
-bin/derdump
-bin/digest
-bin/fipstest
-bin/makepqg
-bin/mangle
 bin/modutil
 bin/nss-config
-bin/ocspclnt
-bin/oidcalc
-bin/p7content
-bin/p7env
-bin/p7sign
-bin/p7verify
 bin/pk12util
-bin/pp
-bin/rsaperf
-bin/sdrtest
-bin/selfserv
-bin/server
-bin/shlibsign
 bin/signtool
 bin/signver
 bin/ssltap
-bin/strsclnt
-bin/symkeyutil
-bin/tstclnt
-bin/vfychain
-bin/vfyserv
 include/nss/
 include/nss/base64.h
 include/nss/blapit.h
@@ -134,5 +103,4 @@ include/nss/watcomfx.h
 lib/libcrmf.a
 lib/libfreebl3.chk
 lib/libsoftokn3.chk
-lib/pkgconfig/
 lib/pkgconfig/nss.pc