/usr/bin/nss-config is in libnss3-dev 2:3.35-2ubuntu2.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 | #!/bin/sh
prefix=/usr
major_version=3
minor_version=35
patch_version=0
usage()
{
	cat <<EOF
Usage: nss-config [OPTIONS] [LIBRARIES]
Options:
	[--prefix[=DIR]]
	[--exec-prefix[=DIR]]
	[--includedir[=DIR]]
	[--libdir[=DIR]]
	[--version]
	[--libs]
	[--cflags]
Dynamic Libraries:
	nss
	nssutil
	ssl
	smime
EOF
	exit $1
}
if test $# -eq 0; then
	usage 1 1>&2
fi
lib_ssl=yes
lib_smime=yes
lib_nss=yes
lib_nssutil=yes
while test $# -gt 0; do
  case "$1" in
  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
  *) optarg= ;;
  esac
  case $1 in
    --prefix=*)
      prefix=$optarg
      ;;
    --prefix)
      echo_prefix=yes
      ;;
    --exec-prefix=*)
      exec_prefix=$optarg
      ;;
    --exec-prefix)
      echo_exec_prefix=yes
      ;;
    --includedir=*)
      includedir=$optarg
      ;;
    --includedir)
      echo_includedir=yes
      ;;
    --libdir=*)
      libdir=$optarg
      ;;
    --libdir)
      echo_libdir=yes
      ;;
    --version)
      echo ${major_version}.${minor_version}.${patch_version}
      ;;
    --cflags)
      echo_cflags=yes
      ;;
    --libs)
      echo_libs=yes
      ;;
    ssl)
      lib_ssl=yes
      ;;
    smime)
      lib_smime=yes
      ;;
    nss)
      lib_nss=yes
      ;;
    nssutil)
      lib_nssutil=yes
      ;;
    *)
      usage 1 1>&2
      ;;
  esac
  shift
done
# Set variables that may be dependent upon other variables
if test -z "$exec_prefix"; then
    exec_prefix=${prefix}
fi
if test -z "$includedir"; then
    includedir=${prefix}/include/nss
fi
if test -z "$libdir"; then
    libdir=${exec_prefix}/lib/x86_64-linux-gnu
fi
if test "$echo_prefix" = "yes"; then
    echo $prefix
fi
if test "$echo_exec_prefix" = "yes"; then
    echo $exec_prefix
fi
if test "$echo_includedir" = "yes"; then
    echo $includedir
fi
if test "$echo_libdir" = "yes"; then
    echo $libdir
fi
if test "$echo_cflags" = "yes"; then
    echo -I$includedir
fi
if test "$echo_libs" = "yes"; then
      libdirs="-L$libdir"
      if test -n "$lib_ssl"; then
	libdirs="$libdirs -lssl${major_version}"
      fi
      if test -n "$lib_smime"; then
	libdirs="$libdirs -lsmime${major_version}"
      fi
      if test -n "$lib_nss"; then
	libdirs="$libdirs -lnss${major_version}"
      fi
      if test -n "$lib_nssutil"; then
	libdirs="$libdirs -lnssutil${major_version}"
      fi
      echo $libdirs
fi      
 |