diff --git a/security/manager/boot/src/nsSecurityWarningDialogs.cpp b/security/manager/boot/src/nsSecurityWarningDialogs.cpp
index 4eec2dd38013..a3c559df6d67 100644
--- a/security/manager/boot/src/nsSecurityWarningDialogs.cpp
+++ b/security/manager/boot/src/nsSecurityWarningDialogs.cpp
@@ -46,10 +46,11 @@
 #include "nsIPrompt.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIInterfaceRequestorUtils.h"
+#include "nsIPrefService.h"
+#include "nsIPrefBranch.h"
 
 NS_IMPL_THREADSAFE_ISUPPORTS1(nsSecurityWarningDialogs, nsISecurityWarningDialogs)
 
-static NS_DEFINE_CID(kPrefCID, NS_PREF_CID);
 static NS_DEFINE_CID(kCStringBundleServiceCID,  NS_STRINGBUNDLESERVICE_CID);
 
 #define STRING_BUNDLE_URL    "chrome://communicator/locale/security.properties"
@@ -73,7 +74,7 @@ nsSecurityWarningDialogs::Init()
 {
   nsresult rv;
 
-  mPref = do_GetService(kPrefCID, &rv);
+  mPrefBranch = do_GetService(NS_PREFSERVICE_CONTRACTID, &rv);
   if (NS_FAILED(rv)) return rv;
 
   nsCOMPtr<nsIStringBundleService> service = do_GetService(kCStringBundleServiceCID, &rv);
@@ -147,7 +148,7 @@ nsSecurityWarningDialogs::AlertDialog(nsIInterfaceRequestor *ctx, const char *pr
 
   // Get user's preference for this alert
   PRBool prefValue;
-  rv = mPref->GetBoolPref(prefName, &prefValue);
+  rv = mPrefBranch->GetBoolPref(prefName, &prefValue);
   if (NS_FAILED(rv)) prefValue = PR_TRUE;
 
   // Stop if alert is not requested
@@ -162,7 +163,7 @@ nsSecurityWarningDialogs::AlertDialog(nsIInterfaceRequestor *ctx, const char *pr
   showOncePref += ".show_once";
 
   PRBool showOnce = PR_FALSE;
-  mPref->GetBoolPref(showOncePref.get(), &showOnce);
+  mPrefBranch->GetBoolPref(showOncePref.get(), &showOnce);
 
   if (showOnce)
     prefValue = PR_FALSE;
@@ -186,9 +187,9 @@ nsSecurityWarningDialogs::AlertDialog(nsIInterfaceRequestor *ctx, const char *pr
   if (NS_FAILED(rv)) return rv;
       
   if (!prefValue) {
-    mPref->SetBoolPref(prefName, PR_FALSE);
+    mPrefBranch->SetBoolPref(prefName, PR_FALSE);
   } else if (showOnce) {
-    mPref->SetBoolPref(showOncePref.get(), PR_FALSE);
+    mPrefBranch->SetBoolPref(showOncePref.get(), PR_FALSE);
   }
 
   return rv;
@@ -233,7 +234,7 @@ nsSecurityWarningDialogs::ConfirmDialog(nsIInterfaceRequestor *ctx, const char *
   PRBool prefValue = PR_TRUE;
   
   if (prefName != nsnull) {
-    rv = mPref->GetBoolPref(prefName, &prefValue);
+    rv = mPrefBranch->GetBoolPref(prefName, &prefValue);
     if (NS_FAILED(rv)) prefValue = PR_TRUE;
   }
   
@@ -248,7 +249,7 @@ nsSecurityWarningDialogs::ConfirmDialog(nsIInterfaceRequestor *ctx, const char *
   showOncePref += ".show_once";
 
   PRBool showOnce = PR_FALSE;
-  mPref->GetBoolPref(showOncePref.get(), &showOnce);
+  mPrefBranch->GetBoolPref(showOncePref.get(), &showOnce);
 
   if (showOnce)
     prefValue = PR_FALSE;
@@ -301,9 +302,9 @@ nsSecurityWarningDialogs::ConfirmDialog(nsIInterfaceRequestor *ctx, const char *
   *_result = (buttonPressed != 1);
 
   if (!prefValue && prefName != nsnull) {
-    mPref->SetBoolPref(prefName, PR_FALSE);
+    mPrefBranch->SetBoolPref(prefName, PR_FALSE);
   } else if (prefValue && showOnce) {
-    mPref->SetBoolPref(showOncePref.get(), PR_FALSE);
+    mPrefBranch->SetBoolPref(showOncePref.get(), PR_FALSE);
   }
 
   return rv;
diff --git a/security/manager/boot/src/nsSecurityWarningDialogs.h b/security/manager/boot/src/nsSecurityWarningDialogs.h
index e4de50510e8c..8c9456abbba6 100644
--- a/security/manager/boot/src/nsSecurityWarningDialogs.h
+++ b/security/manager/boot/src/nsSecurityWarningDialogs.h
@@ -41,7 +41,7 @@
 #define nsSecurityWarningDialogs_h
 
 #include "nsISecurityWarningDialogs.h"
-#include "nsIPref.h"
+#include "nsIPrefBranch.h"
 #include "nsIStringBundle.h"
 #include "nsCOMPtr.h"
 
@@ -64,7 +64,7 @@ protected:
                    const PRUnichar *messageName, 
                    const PRUnichar *showAgainName, PRBool* _result);
   nsCOMPtr<nsIStringBundle> mStringBundle;
-  nsCOMPtr<nsIPref> mPref;
+  nsCOMPtr<nsIPrefBranch> mPrefBranch;
 };
 
 #define NS_SECURITYWARNINGDIALOGS_CID \
diff --git a/security/manager/pki/src/nsNSSDialogs.h b/security/manager/pki/src/nsNSSDialogs.h
index 05f69f4cc84c..3ab50f658162 100644
--- a/security/manager/pki/src/nsNSSDialogs.h
+++ b/security/manager/pki/src/nsNSSDialogs.h
@@ -51,7 +51,6 @@
 
 #include "nsCOMPtr.h"
 #include "nsIStringBundle.h"
-#include "nsIPref.h"
 
 #define NS_NSSDIALOGS_CID \
   { 0x518e071f, 0x1dd2, 0x11b2, \
diff --git a/security/manager/ssl/src/nsCMSSecureMessage.cpp b/security/manager/ssl/src/nsCMSSecureMessage.cpp
index 62acc5482386..2e21d2397597 100644
--- a/security/manager/ssl/src/nsCMSSecureMessage.cpp
+++ b/security/manager/ssl/src/nsCMSSecureMessage.cpp
@@ -55,7 +55,8 @@
 #include "cms.h"
 
 #include "nsIServiceManager.h"
-#include "nsIPref.h"
+#include "nsIPrefService.h"
+#include "nsIPrefBranch.h"
 
 #include "prlog.h"
 #ifdef PR_LOGGING
@@ -96,8 +97,7 @@ GetCertByPrefID(const char *certID, char **_retval)
 
   *_retval = 0;
 
-  static NS_DEFINE_CID(kPrefCID, NS_PREF_CID);
-  nsCOMPtr<nsIPref> prefs = do_GetService(kPrefCID, &rv);
+  nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID, &rv);
   if (NS_FAILED(rv)) {
     goto done;
   }
diff --git a/security/manager/ssl/src/nsCRLManager.cpp b/security/manager/ssl/src/nsCRLManager.cpp
index f20a29bfd895..82e9a747899e 100644
--- a/security/manager/ssl/src/nsCRLManager.cpp
+++ b/security/manager/ssl/src/nsCRLManager.cpp
@@ -48,6 +48,8 @@
 #include "nsIPrompt.h"
 #include "nsICertificateDialogs.h"
 #include "nsArray.h"
+#include "nsIPrefService.h"
+#include "nsIPrefBranch.h"
 #include "nsNSSShutDown.h"
 
 #include "nsNSSCertHeader.h"
@@ -224,7 +226,8 @@ done:
     if(crlKey == nsnull){
       return NS_ERROR_FAILURE;
     }
-    nsCOMPtr<nsIPref> pref = do_GetService(NS_PREF_CONTRACTID,&rv);
+    nsCOMPtr<nsIPrefService> prefSvc = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
+    nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
     if (NS_FAILED(rv)){
       return rv;
     }
@@ -282,7 +285,6 @@ done:
       pref->SetCharPref(updateUrlPrefStr.get(),updateURL.get());
       
       pref->SetIntPref(updateErrCntPrefStr.get(),0);
-      pref->SavePrefFile(nsnull);
       
       if(toBeRescheduled == PR_TRUE){
         nsAutoString hashKey(crlKey);
@@ -297,14 +299,13 @@ done:
       updateErrDetailPrefStr.AppendWithConversion(crlKey);
       errMsg.AssignWithConversion(errorMessage.get());
       rv = pref->GetIntPref(updateErrCntPrefStr.get(),&errCnt);
-      if( (NS_FAILED(rv)) || (errCnt ==0)){
-        pref->SetIntPref(updateErrCntPrefStr.get(),1);
-      }else{
-        pref->SetIntPref(updateErrCntPrefStr.get(),errCnt+1);
-      }
+      if(NS_FAILED(rv))
+        errCnt = 0;
+
+      pref->SetIntPref(updateErrCntPrefStr.get(),errCnt+1);
       pref->SetCharPref(updateErrDetailPrefStr.get(),errMsg.get());
-      pref->SavePrefFile(nsnull);
     }
+    prefSvc->SavePrefFile(nsnull);
   }
 
   return rv;
diff --git a/security/manager/ssl/src/nsNSSCertificateDB.cpp b/security/manager/ssl/src/nsNSSCertificateDB.cpp
index 014706b6c38a..bc3eb24732cd 100644
--- a/security/manager/ssl/src/nsNSSCertificateDB.cpp
+++ b/security/manager/ssl/src/nsNSSCertificateDB.cpp
@@ -53,6 +53,8 @@
 #include "nsReadableUtils.h"
 #include "nsArray.h"
 #include "nsNSSShutDown.h"
+#include "nsIPrefService.h"
+#include "nsIPrefBranch.h"
 
 #include "nspr.h"
 extern "C" {
@@ -1239,10 +1241,10 @@ finish:
 NS_IMETHODIMP 
 nsNSSCertificateDB::GetIsOcspOn(PRBool *aOcspOn)
 {
-  nsCOMPtr<nsIPref> prefService = do_GetService(NS_PREF_CONTRACTID);
+  nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID);
 
   PRInt32 ocspEnabled;
-  prefService->GetIntPref("security.OCSP.enabled", &ocspEnabled);
+  pref->GetIntPref("security.OCSP.enabled", &ocspEnabled);
   *aOcspOn = ( ocspEnabled == 0 ) ? PR_FALSE : PR_TRUE; 
   return NS_OK;
 }
diff --git a/security/manager/ssl/src/nsNSSComponent.cpp b/security/manager/ssl/src/nsNSSComponent.cpp
index ba43589be0ac..de95fc1f4263 100644
--- a/security/manager/ssl/src/nsNSSComponent.cpp
+++ b/security/manager/ssl/src/nsNSSComponent.cpp
@@ -60,7 +60,9 @@
 #include "nsNSSCertificate.h"
 #include "nsNSSHelper.h"
 #include "prlog.h"
-#include "nsIPref.h"
+#include "nsIPrefService.h"
+#include "nsIPrefBranch.h"
+#include "nsIPrefBranchInternal.h"
 #include "nsIDateTimeFormat.h"
 #include "nsDateTimeFormatCID.h"
 #include "nsAutoLock.h"
@@ -288,7 +290,7 @@ nsNSSComponent::~nsNSSComponent()
 #endif /*DEBUG*/ 
 #endif /*XP_MAC*/
 
-static void setOCSPOptions(nsIPref * pref);
+static void setOCSPOptions(nsIPrefBranch * pref);
 
 NS_IMETHODIMP
 nsNSSComponent::PIPBundleFormatStringFromName(const char *name,
@@ -344,7 +346,7 @@ nsNSSComponent::SkipOcsp()
 NS_IMETHODIMP
 nsNSSComponent::SkipOcspOff()
 {
-  setOCSPOptions(mPref);
+  setOCSPOptions(mPrefBranch);
   return NS_OK;
 }
 
@@ -606,7 +608,7 @@ nsresult nsNSSComponent::GetNSSCipherIDFromPrefString(const nsACString &aPrefStr
   return NS_ERROR_NOT_AVAILABLE;
 }
 
-static void setOCSPOptions(nsIPref * pref)
+static void setOCSPOptions(nsIPrefBranch * pref)
 {
   nsNSSShutDownPreventionLock locker;
   // Set up OCSP //
@@ -626,8 +628,8 @@ static void setOCSPOptions(nsIPref * pref)
       char *url = nsnull;
 
       // Get the signing CA and service url //
-      pref->CopyCharPref("security.OCSP.signingCA", &signingCA);
-      pref->CopyCharPref("security.OCSP.URL", &url);
+      pref->GetCharPref("security.OCSP.signingCA", &signingCA);
+      pref->GetCharPref("security.OCSP.URL", &url);
 
       // Set OCSP up
       CERT_EnableOCSPChecking(CERT_GetDefaultCertDB());
@@ -712,7 +714,7 @@ nsresult nsNSSComponent::getParamsForNextCrlToDownload(nsAutoString *url, PRTime
   char *tempUrl;
   nsresult rv;
   
-  nsCOMPtr<nsIPref> pref = do_GetService(NS_PREF_CONTRACTID,&rv);
+  nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
   if(NS_FAILED(rv)){
     return rv;
   }
@@ -1111,7 +1113,7 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox)
   #endif
 
     PRBool supress_warning_preference = PR_FALSE;
-    rv = mPref->GetBoolPref("security.suppress_nss_rw_impossible_warning", &supress_warning_preference);
+    rv = mPrefBranch->GetBoolPref("security.suppress_nss_rw_impossible_warning", &supress_warning_preference);
 
     if (NS_FAILED(rv)) {
       supress_warning_preference = PR_FALSE;
@@ -1164,16 +1166,16 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox)
 
       PK11_SetPasswordFunc(PK11PasswordPrompt);
 
-      // Register a callback so we can inform NSS when these prefs change
-      mPref->RegisterCallback("security.", nsNSSComponent::PrefChangedCallback,
-                              (void*) this);
+      // Register an observer so we can inform NSS when these prefs change
+      nsCOMPtr<nsIPrefBranchInternal> pbi = do_QueryInterface(mPrefBranch);
+      pbi->AddObserver("security.", this, PR_FALSE);
 
       PRBool enabled;
-      mPref->GetBoolPref("security.enable_ssl2", &enabled);
+      mPrefBranch->GetBoolPref("security.enable_ssl2", &enabled);
       SSL_OptionSetDefault(SSL_ENABLE_SSL2, enabled);
-      mPref->GetBoolPref("security.enable_ssl3", &enabled);
+      mPrefBranch->GetBoolPref("security.enable_ssl3", &enabled);
       SSL_OptionSetDefault(SSL_ENABLE_SSL3, enabled);
-      mPref->GetBoolPref("security.enable_tls", &enabled);
+      mPrefBranch->GetBoolPref("security.enable_tls", &enabled);
       SSL_OptionSetDefault(SSL_ENABLE_TLS, enabled);
 
       // Disable any ciphers that NSS might have enabled by default
@@ -1185,7 +1187,7 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox)
 
       // Now only set SSL/TLS ciphers we knew about at compile time
       for (CipherPref* cp = CipherPrefs; cp->pref; ++cp) {
-        mPref->GetBoolPref(cp->pref, &enabled);
+        mPrefBranch->GetBoolPref(cp->pref, &enabled);
 
         SSL_CipherPrefSetDefault(cp->id, enabled);
       }
@@ -1201,7 +1203,7 @@ nsNSSComponent::InitializeNSS(PRBool showWarningBox)
       PORT_SetUCS2_ASCIIConversionFunction(pip_ucs2_ascii_conversion_fn);
 
       // Set up OCSP //
-      setOCSPOptions(mPref);
+      setOCSPOptions(mPrefBranch);
 
       InstallLoadableRoots();
 
@@ -1246,9 +1248,9 @@ nsNSSComponent::ShutdownNSS()
 
     PK11_SetPasswordFunc((PK11PasswordFunc)nsnull);
 
-    if (mPref) {
-      mPref->UnregisterCallback("security.", nsNSSComponent::PrefChangedCallback,
-                                (void*) this);
+    if (mPrefBranch) {
+      nsCOMPtr<nsIPrefBranchInternal> pbi = do_QueryInterface(mPrefBranch);
+      pbi->RemoveObserver("security.", this);
     }
 
     SSL_ClearSessionCache();
@@ -1281,9 +1283,9 @@ nsNSSComponent::Init()
     return rv;
   }      
 
-  if (!mPref) {
-    mPref = do_GetService(NS_PREF_CONTRACTID);
-    NS_ASSERTION(mPref, "Unable to get pref service");
+  if (!mPrefBranch) {
+    mPrefBranch = do_GetService(NS_PREFSERVICE_CONTRACTID);
+    NS_ASSERTION(mPrefBranch, "Unable to get pref service");
   }
 
   // Do that before NSS init, to make sure we won't get unloaded.
@@ -1515,44 +1517,6 @@ nsNSSComponent::RandomUpdate(void *entropy, PRInt32 bufLen)
   return NS_OK;
 }
 
-int PR_CALLBACK
-nsNSSComponent::PrefChangedCallback(const char* aPrefName, void* data)
-{
-  nsNSSComponent* nss = NS_STATIC_CAST(nsNSSComponent*, data);
-  if (nss)
-    nss->PrefChanged(aPrefName);
-  return 0;
-}
-
-void
-nsNSSComponent::PrefChanged(const char* prefName)
-{
-  nsNSSShutDownPreventionLock locker;
-  PRBool enabled;
-
-  if (!nsCRT::strcmp(prefName, "security.enable_ssl2")) {
-    mPref->GetBoolPref("security.enable_ssl2", &enabled);
-    SSL_OptionSetDefault(SSL_ENABLE_SSL2, enabled);
-  } else if (!nsCRT::strcmp(prefName, "security.enable_ssl3")) {
-    mPref->GetBoolPref("security.enable_ssl3", &enabled);
-    SSL_OptionSetDefault(SSL_ENABLE_SSL3, enabled);
-  } else if (!nsCRT::strcmp(prefName, "security.enable_tls")) {
-    mPref->GetBoolPref("security.enable_tls", &enabled);
-    SSL_OptionSetDefault(SSL_ENABLE_TLS, enabled);
-  } else if (!nsCRT::strcmp(prefName, "security.OCSP.enabled")) {
-    setOCSPOptions(mPref);
-  } else {
-    /* Look through the cipher table and set according to pref setting */
-    for (CipherPref* cp = CipherPrefs; cp->pref; ++cp) {
-      if (!nsCRT::strcmp(prefName, cp->pref)) {
-        mPref->GetBoolPref(cp->pref, &enabled);
-        SSL_CipherPrefSetDefault(cp->id, enabled);
-        break;
-      }
-    }
-  }
-}
-
 #define DEBUG_PSM_PROFILE
 
 #ifdef DEBUG_PSM_PROFILE
@@ -1698,7 +1662,33 @@ nsNSSComponent::Observe(nsISupports *aSubject, const char *aTopic,
     PK11_LogoutAll();
     LogoutAuthenticatedPK11();
   }
+  else if (nsCRT::strcmp(aTopic, NS_PREFBRANCH_PREFCHANGE_TOPIC_ID) == 0) { 
+    nsNSSShutDownPreventionLock locker;
+    PRBool enabled;
+    NS_ConvertUCS2toUTF8  prefName(someData);
 
+    if (prefName.Equals("security.enable_ssl2")) {
+      mPrefBranch->GetBoolPref("security.enable_ssl2", &enabled);
+      SSL_OptionSetDefault(SSL_ENABLE_SSL2, enabled);
+    } else if (prefName.Equals("security.enable_ssl3")) {
+      mPrefBranch->GetBoolPref("security.enable_ssl3", &enabled);
+      SSL_OptionSetDefault(SSL_ENABLE_SSL3, enabled);
+    } else if (prefName.Equals("security.enable_tls")) {
+      mPrefBranch->GetBoolPref("security.enable_tls", &enabled);
+      SSL_OptionSetDefault(SSL_ENABLE_TLS, enabled);
+    } else if (prefName.Equals("security.OCSP.enabled")) {
+      setOCSPOptions(mPrefBranch);
+    } else {
+      /* Look through the cipher table and set according to pref setting */
+      for (CipherPref* cp = CipherPrefs; cp->pref; ++cp) {
+        if (prefName.Equals(cp->pref)) {
+          mPrefBranch->GetBoolPref(cp->pref, &enabled);
+          SSL_CipherPrefSetDefault(cp->id, enabled);
+          break;
+        }
+      }
+    }
+  }
 
 #ifdef DEBUG
   else if (nsCRT::strcmp(aTopic, PROFILE_CHANGE_NET_TEARDOWN_TOPIC) == 0) {
@@ -2112,7 +2102,7 @@ PSMContentDownloader::handleContentDownloadError(nsresult errCode)
       nsCString errMsg;
       PRInt32 errCnt;
 
-      nsCOMPtr<nsIPref> pref = do_GetService(NS_PREF_CONTRACTID,&rv);
+      nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID,&rv);
       if(NS_FAILED(rv)){
         return rv;
       }
@@ -2129,7 +2119,8 @@ PSMContentDownloader::handleContentDownloadError(nsresult errCode)
         pref->SetIntPref(updateErrCntPrefStr.get(),errCnt+1);
       }
       pref->SetCharPref(updateErrDetailPrefStr.get(),errMsg.get());
-      pref->SavePrefFile(nsnull);
+      nsCOMPtr<nsIPrefService> prefSvc(do_QueryInterface(pref));
+      prefSvc->SavePrefFile(nsnull);
     }else{
       nsString message;
       nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
diff --git a/security/manager/ssl/src/nsNSSComponent.h b/security/manager/ssl/src/nsNSSComponent.h
index e614a6f19e4d..ad12dddc5afc 100644
--- a/security/manager/ssl/src/nsNSSComponent.h
+++ b/security/manager/ssl/src/nsNSSComponent.h
@@ -50,7 +50,7 @@
 #include "nsIEntropyCollector.h"
 #include "nsString.h"
 #include "nsIStringBundle.h"
-#include "nsIPref.h"
+#include "nsIPrefBranch.h"
 #include "nsIObserver.h"
 #include "nsIObserverService.h"
 #include "nsWeakReference.h"
@@ -208,8 +208,6 @@ private:
   nsresult ConfigureInternalPKCS11Token();
   nsresult RegisterPSMContentListener();
   nsresult RegisterObservers();
-  static int PR_CALLBACK PrefChangedCallback(const char* aPrefName, void* data);
-  void PrefChanged(const char* aPrefName);
   nsresult DownloadCrlSilently();
   nsresult PostCRLImportEvent(nsCAutoString *urlString, PSMContentDownloader *psmDownloader);
   nsresult getParamsForNextCrlToDownload(nsAutoString *url, PRTime *time, nsAutoString *key);
@@ -218,7 +216,7 @@ private:
   nsCOMPtr<nsIScriptSecurityManager> mScriptSecurityManager;
   nsCOMPtr<nsIStringBundle> mPIPNSSBundle;
   nsCOMPtr<nsIURIContentListener> mPSMContentListener;
-  nsCOMPtr<nsIPref> mPref;
+  nsCOMPtr<nsIPrefBranch> mPrefBranch;
   nsCOMPtr<nsITimer> mTimer;
   PRBool mNSSInitialized;
   PRBool mObserversRegistered;
diff --git a/security/manager/ssl/src/nsNSSIOLayer.cpp b/security/manager/ssl/src/nsNSSIOLayer.cpp
index 1455590ebd66..505f2bea44b0 100644
--- a/security/manager/ssl/src/nsNSSIOLayer.cpp
+++ b/security/manager/ssl/src/nsNSSIOLayer.cpp
@@ -45,7 +45,8 @@
 #include "prlog.h"
 #include "prnetdb.h"
 #include "nsIPrompt.h"
-#include "nsIPref.h"
+#include "nsIPrefService.h"
+#include "nsIPrefBranch.h"
 #include "nsIServiceManager.h"
 #include "nsIWebProgressListener.h"
 #include "nsIChannel.h"
@@ -1794,9 +1795,9 @@ nsresult nsGetUserCertChoice(SSM_UserCertChoice* certChoice)
 
 	NS_ENSURE_ARG_POINTER(certChoice);
 
-	nsCOMPtr<nsIPref> prefService = do_GetService(NS_PREF_CONTRACTID);
+	nsCOMPtr<nsIPrefBranch> pref = do_GetService(NS_PREFSERVICE_CONTRACTID);
 
-	ret = prefService->CopyCharPref("security.default_personal_cert", &mode);
+	ret = pref->GetCharPref("security.default_personal_cert", &mode);
 	if (NS_FAILED(ret)) {
 		goto loser;
 	}