Vitezslav Cizek sent this to the mod_nss mailing list:

I'm attaching a patch for the migrate.pl script.

The changes are:

• Use a whitelist instead of a blacklist for migrated directives, because more of them are specific to mod_ssl than common
• Don't translate SSLCipherSuite, we support OpenSSL strings now
• Add input (-r) and output options (-w) for the configuration files, instead of using ssl.conf and nss.conf
• Commented lines are now recognized even if they begin with whitespace
• The script keeps nestable apache configuration block directives
• Print more verbose disclaimer
• Set NSSProtocol unconditionally