For a quick check, I guess it's caused by the change in certutil: https://hg.mozilla.org/projects/nss/file/NSS_3_35_BRANCH/cmd/certutil/certutil.c#l3174 PK11_NeedLogin(slot) was added since 3.35 and it would request the password to the database. Adding '-f password' to 'certutil -A' probably could fix the error.