The Java bindings for the Network Security Services (NSS) Library is called JSS. NSS provides a key management scheme that is different enough from both standard Java and OpenSSL that trying to do standard Java Socket operations using the Apache HttpClient requires a little bit of extra work.

The guide here   walks you through the general case.  The equivalent Socket Factor for JSS is :

package org.fedoraproject.pki.test;

import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;

import org.apache.commons.httpclient.ConnectTimeoutException;
import org.apache.commons.httpclient.params.HttpConnectionParams;
import org.apache.commons.httpclient.protocol.ProtocolSocketFactory;
import org.mozilla.jss.ssl.SSLSocket;

public class JSSProtocolSocketFactory implements ProtocolSocketFactory
{
    @Override
    public Socket createSocket(String host, int port, InetAddress localAddress,
            int localPort) throws IOException, UnknownHostException
    {
        return new SSLSocket(host, port, localAddress, localPort);
    }

    @Override
    public Socket createSocket(String host, int port, InetAddress localAddress,
            int localPort, HttpConnectionParams params) throws IOException,
            UnknownHostException, ConnectTimeoutException
    {
        return new SSLSocket(host, port, localAddress, localPort);
    }

    @Override
    public Socket createSocket(String host, int port) throws IOException,
            UnknownHostException
    {
        return new SSLSocket(host, port);
    }

}

The code to register and use the Socket Factory is:

Protocol.registerProtocol("https", 
                new Protocol("https", new JSSProtocolSocketFactory(), 8443));        
HttpClient client = new HttpClient();
HttpMethod method = new GetMethod("https://" + HOSTNAME + ":8443/ca/agent/ca/listCerts");
client.executeMethod(method);
byte[] responseBody = method.getResponseBody();
method.releaseConnection();
System.out.println(new String(responseBody));