add libnss3-tools (for certutil) to install