I think the best way forward is as follows:
1.Figure out what version of NSS or what NSS tag or what NSS revision matches what's in microb-engine (we know what Gecko revision matches microb-engine but we need to match that back to the NSS repository)
2.Figure out of any of the local patches made to the microb-engine source code apply to NSS and whether those patches need to be handled going forward.
3.Grab the oldest release of NSS that has working TLS 1.2 support (actual official release by the NSS team, not just a repository revision)
4.Examine both sets of code and figure out what has changed that will affect microb-engine (e.g. has the public API changed in ways that matter)
and 5.Once we know what's changed, figure out whether its possible to port microb-engine to the newer NSS and then do it.

As far as I know, everything that talks to the NSS libraries is FOSS so the ABI doesn't matter, just the API.