This was caused by trying to use NSS in FIPS mode, which requires a password on the NSS keys database. Taking NSS out of FIPS mode and removing the password fixed it.