diff --git a/mozilla/security/nss/lib/ssl/ssl3con.c b/mozilla/security/nss/lib/ssl/ssl3con.c
index b0243815c63..f8b73afd3a4 100644
--- a/mozilla/security/nss/lib/ssl/ssl3con.c
+++ b/mozilla/security/nss/lib/ssl/ssl3con.c
@@ -39,7 +39,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: ssl3con.c,v 1.93 2006-07-17 22:08:03 alexei.volkov.bugs%sun.com Exp $ */
+/* $Id: ssl3con.c,v 1.94 2006-07-19 01:40:17 nelson%bolyard.com Exp $ */
 
 #include "nssrenam.h"
 #include "cert.h"
@@ -3507,6 +3507,11 @@ ssl3_SendClientHello(sslSocket *ss)
 	if (total_exten_len > 0)
 	    total_exten_len += 2;
     }
+#ifndef NSS_ECC_MORE_THAN_SUITE_B
+    else { /* SSL3 only */
+    	ssl3_DisableECCSuites(ss, NULL); /* disable all ECC suites */
+    }
+#endif
 
     /* how many suites are permitted by policy and user preference? */
     num_suites = count_cipher_suites(ss, ss->ssl3.policy, PR_TRUE);
diff --git a/mozilla/security/nss/lib/ssl/ssl3ecc.c b/mozilla/security/nss/lib/ssl/ssl3ecc.c
index 52209f44654..abaf572619d 100644
--- a/mozilla/security/nss/lib/ssl/ssl3ecc.c
+++ b/mozilla/security/nss/lib/ssl/ssl3ecc.c
@@ -40,7 +40,7 @@
  * ***** END LICENSE BLOCK ***** */
 
 /* ECC code moved here from ssl3con.c */
-/* $Id: ssl3ecc.c,v 1.14 2006-06-28 21:15:04 julien.pierre.bugs%sun.com Exp $ */
+/* $Id: ssl3ecc.c,v 1.15 2006-07-19 01:40:17 nelson%bolyard.com Exp $ */
 
 #include "nssrenam.h"
 #include "nss.h"
@@ -957,6 +957,8 @@ static const ssl3CipherSuite ecSuites[] = {
 SECStatus
 ssl3_DisableECCSuites(sslSocket * ss, const ssl3CipherSuite * suite)
 {
+    if (!suite)
+    	suite = ecSuites;
     for (; *suite; ++suite) {
 	SECStatus rv      = ssl3_CipherPrefSet(ss, *suite, PR_FALSE);
 
diff --git a/mozilla/security/nss/lib/ssl/sslcon.c b/mozilla/security/nss/lib/ssl/sslcon.c
index 8a2ed6354a1..603057a152a 100644
--- a/mozilla/security/nss/lib/ssl/sslcon.c
+++ b/mozilla/security/nss/lib/ssl/sslcon.c
@@ -37,7 +37,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: sslcon.c,v 1.31 2006-06-07 17:53:19 nelson%bolyard.com Exp $ */
+/* $Id: sslcon.c,v 1.32 2006-07-19 01:40:17 nelson%bolyard.com Exp $ */
 
 #include "nssrenam.h"
 #include "cert.h"
@@ -3120,7 +3120,11 @@ ssl2_BeginClientHandshake(sslSocket *ss)
 
 	return rv;
     }
-   
+#ifndef NSS_ECC_MORE_THAN_SUITE_B
+    /* ensure we don't neogtiate ECC cipher suites with SSL2 hello */
+    ssl3_DisableECCSuites(ss, NULL); /* disable all ECC suites */
+#endif
+
     if (!ss->cipherSpecs) {
         rv = ssl2_ConstructCipherSpecs(ss);
 	if (rv < 0) {
diff --git a/mozilla/security/nss/lib/ssl/sslimpl.h b/mozilla/security/nss/lib/ssl/sslimpl.h
index 01ebbfbf03e..e75bf490f76 100644
--- a/mozilla/security/nss/lib/ssl/sslimpl.h
+++ b/mozilla/security/nss/lib/ssl/sslimpl.h
@@ -39,7 +39,7 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: sslimpl.h,v 1.52 2006-06-23 17:01:38 rrelyea%redhat.com Exp $ */
+/* $Id: sslimpl.h,v 1.53 2006-07-19 01:40:17 nelson%bolyard.com Exp $ */
 
 #ifndef __sslimpl_h_
 #define __sslimpl_h_
@@ -1274,6 +1274,8 @@ extern SECStatus ssl3_CreateRSAStepDownKeys(sslSocket *ss);
 #ifdef NSS_ENABLE_ECC
 extern void      ssl3_FilterECCipherSuitesByServerCerts(sslSocket *ss);
 extern PRBool    ssl3_IsECCEnabled(sslSocket *ss);
+extern SECStatus ssl3_DisableECCSuites(sslSocket * ss, 
+                                       const ssl3CipherSuite * suite);
 #endif /* NSS_ENABLE_ECC */
 
 extern SECStatus ssl3_CipherPrefSetDefault(ssl3CipherSuite which, PRBool on);