NSS linkage and FIPS-140 compliance for Firefox

[I cannot participate in any legal discussions now. Please don't ask me questions about legal stuff.] We (Mozilla) are are exploring some approaches to statically link NSS into Firefox to reduce dynamic linkage overhead caused by the NSS shared libraries and to allow for whole-program optimiz

problem Importing certificates in NSS db using Cert_importcerts -

I am implementing functionality which needs to take trusted root certs from user and use it to do SSl handshake. I use CERT_ImportCert I read a DER file get the data and length , create SECItem and then pass it to the CERt_importCerts. I am keeping both the "keepcerts" and "isCA" flags true.