This patch looks ok. I'm just curious where it is a problem. I perhaps incorrectly expected that users would generate their own NSS database when deploying mod_nss.

Sorry, I missed your comment.
I, too, hope users use proper certificates in the real world.

This issue was discovered by our automatic tests.
We have a simple openqa test which sets up apache with the mod_nss module. It uses gencert to generate a dummy certificate. The whole setup is then tested with curl.
So it's not a "production" use at all.

The test is run both on a normal system as well as in the fips mode, where it fails due to a weak password.

See https://github.com/nss-dev/nss/blob/master/lib/softoken/fipstokn.c#L184 for the NSS fips password check.