diff --git a/security/Makefile b/security/Makefile
index 6f0a8e9e6564..197ce3b36cab 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -979,6 +979,7 @@
     SUBDIR += py-pyscard
     SUBDIR += py-pysha3
     SUBDIR += py-python-gnupg
+    SUBDIR += py-python-nss
     SUBDIR += py-python-openid
     SUBDIR += py-python-registry
     SUBDIR += py-python-social-auth
diff --git a/security/py-python-nss/Makefile b/security/py-python-nss/Makefile
new file mode 100644
index 000000000000..2e9adfe5bb24
--- /dev/null
+++ b/security/py-python-nss/Makefile
@@ -0,0 +1,41 @@
+# $FreeBSD$
+
+PORTNAME=	python-nss
+PORTVERSION=	1.0.1
+CATEGORIES=	security python
+MASTER_SITES=	CHEESESHOP
+PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
+
+MAINTAINER=	jhale@FreeBSD.org
+COMMENT=	Python bindings for NSS and NSPR
+
+LICENSE=	LGPL21+ GPLv2+ MPL20
+LICENSE_COMB=	dual
+LICENSE_FILE_LGPL21+ =	${WRKSRC}/LICENSE.lgpl
+LICENSE_FILE_GPLv2+ =	${WRKSRC}/LICENSE.gpl
+LICENSE_FILE_MPL20=	${WRKSRC}/LICENSE.mpl
+
+LIB_DEPENDS=	libnspr4.so:devel/nspr \
+		libnss3.so:security/nss
+
+USES=		python tar:bzip2
+USE_PYTHON=	autoplist distutils
+
+PYDISTUTILS_CONFIGUREARGS=	--include-root="${LOCALBASE}/include" \
+				--include-root="${LOCALBASE}/include/nss"
+PYDISTUTILS_BUILDARGS=		${PYDISTUTILS_CONFIGUREARGS}
+PYDISTUTILS_INSTALLARGS=	-c -O1 --prefix=${PREFIX} ${PYDISTUTILS_CONFIGUREARGS}
+
+LDFLAGS+=	-L${LOCALBASE}/lib/nss
+
+TEST_TARGET=	# empty
+TEST_WRKSRC=	${WRKSRC}/test
+DO_MAKE_TEST=	${SETENV} ${TEST_ENV} ${PYTHON_CMD} run_tests -t
+
+post-patch:
+	@(cd ${WRKSRC}/test && ${REINPLACE_CMD} -e 's|/usr/bin|${LOCALBASE}/bin|g' setup_certs.py test_pkcs12.py)
+
+post-install:
+	@${STRIP_CMD} ${STAGEDIR}${PYTHON_SITELIBDIR}/nss/*.so
+
+.include <bsd.port.mk>
diff --git a/security/py-python-nss/distinfo b/security/py-python-nss/distinfo
new file mode 100644
index 000000000000..5d7f991bf276
--- /dev/null
+++ b/security/py-python-nss/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1520339740
+SHA256 (python-nss-1.0.1.tar.bz2) = 7fbad8d4b0a379e62d1c11441e87782e3084547b7a83ac44bd5f308540aeeb1c
+SIZE (python-nss-1.0.1.tar.bz2) = 222059
diff --git a/security/py-python-nss/files/patch-test_test__digest.py b/security/py-python-nss/files/patch-test_test__digest.py
new file mode 100644
index 000000000000..e53d1eafa5e9
--- /dev/null
+++ b/security/py-python-nss/files/patch-test_test__digest.py
@@ -0,0 +1,34 @@
+Convert coreutils commands to FreeBSD equivalents
+
+--- test/test_digest.py.orig	2018-03-06 14:23:55 UTC
++++ test/test_digest.py
+@@ -45,7 +45,7 @@ class TestDigest(unittest.TestCase):
+         #
+         # We want to read the reference result from the subprocess as text
+         # not binary, thus universal_newlines must be True.
+-        proc = subprocess.Popen([ref_cmd, in_filename], stdout=subprocess.PIPE,
++        proc = subprocess.Popen([ref_cmd, '-r', in_filename], stdout=subprocess.PIPE,
+                                 universal_newlines=True)
+         stdout, stderr = proc.communicate()
+         reference_digest = stdout.split()[0]
+@@ -103,16 +103,16 @@ class TestDigest(unittest.TestCase):
+                              (hash_oid_name, reference_digest, test_digest))
+ 
+     def test_md5(self):
+-        self.do_test('md5', 'md5sum', nss.md5_digest, nss.SEC_OID_MD5)
++        self.do_test('md5', 'md5', nss.md5_digest, nss.SEC_OID_MD5)
+ 
+     def test_sha1(self):
+-        self.do_test('sha1', 'sha1sum', nss.sha1_digest, nss.SEC_OID_SHA1)
++        self.do_test('sha1', 'sha1', nss.sha1_digest, nss.SEC_OID_SHA1)
+ 
+     def test_sha256(self):
+-        self.do_test('sha256', 'sha256sum', nss.sha256_digest, nss.SEC_OID_SHA256)
++        self.do_test('sha256', 'sha256', nss.sha256_digest, nss.SEC_OID_SHA256)
+ 
+     def test_sha512(self):
+-        self.do_test('sha512', 'sha512sum', nss.sha512_digest, nss.SEC_OID_SHA512)
++        self.do_test('sha512', 'sha512', nss.sha512_digest, nss.SEC_OID_SHA512)
+ 
+ 
+ #-------------------------------------------------------------------------------
diff --git a/security/py-python-nss/pkg-descr b/security/py-python-nss/pkg-descr
new file mode 100644
index 000000000000..d59ae510656d
--- /dev/null
+++ b/security/py-python-nss/pkg-descr
@@ -0,0 +1,13 @@
+python-nss is a Python binding for NSS (Network Security Services)
+and NSPR (Netscape Portable Runtime). NSS provides cryptography
+services supporting SSL, TLS, PKI, PKIX, X509, PKCS*, etc. NSS is
+an alternative to OpenSSL and used extensively by major software
+projects. NSS is FIPS-140 certified.
+
+NSS is built upon NSPR because NSPR provides an abstraction of
+common operating system services, particularly in the areas of
+networking and process management. Python also provides an abstraction
+of common operating system services but because NSS and NSPR are
+tightly bound, python-nss exposes elements of NSPR.
+
+WWW: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Python_binding_for_NSS