--- a/security/manager/ssl/CertBlocklist.cpp
+++ b/security/manager/ssl/CertBlocklist.cpp
@@ -182,17 +182,17 @@ CertBlocklist::Init()
     mBackingFile = nullptr;
     return NS_OK;
   }
   rv = mBackingFile->Append(NS_LITERAL_STRING("revocations.txt"));
   if (NS_FAILED(rv)) {
     return rv;
   }
   nsAutoCString path;
-  rv = mBackingFile->GetNativePath(path);
+  rv = mBackingFile->GetPersistentDescriptor(path);
   if (NS_FAILED(rv)) {
     return rv;
   }
   MOZ_LOG(gCertBlockPRLog, LogLevel::Debug,
          ("CertBlocklist::Init certList path: %s", path.get()));
 
   return NS_OK;
 }

--- a/security/manager/ssl/nsNSSComponent.cpp
+++ b/security/manager/ssl/nsNSSComponent.cpp
@@ -28,16 +28,17 @@
 #include "mozilla/Vector.h"
 #include "nsAppDirectoryServiceDefs.h"
 #include "nsCRT.h"
 #include "nsClientAuthRemember.h"
 #include "nsComponentManagerUtils.h"
 #include "nsDirectoryServiceDefs.h"
 #include "nsICertOverrideService.h"
 #include "nsIFile.h"
+#include "nsILocalFileWin.h"
 #include "nsIObserverService.h"
 #include "nsIPrompt.h"
 #include "nsIProperties.h"
 #include "nsISiteSecurityService.h"
 #include "nsITokenPasswordDialogs.h"
 #include "nsIWindowWatcher.h"
 #include "nsIXULRuntime.h"
 #include "nsLiteralString.h"
@@ -1205,17 +1206,28 @@ GetNSS3Directory(nsCString& result)
     return rv;
   }
   nsCOMPtr<nsIFile> nss3Directory;
   rv = nss3File->GetParent(getter_AddRefs(nss3Directory));
   if (NS_FAILED(rv)) {
     MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("couldn't get parent directory?"));
     return rv;
   }
+#ifdef XP_WIN
+  // Native path will drop Unicode characters that cannot be mapped to system's
+  // codepage, using short (canonical) path as workaround.
+  nsCOMPtr<nsILocalFileWin> nss3DirectoryWin = do_QueryInterface(nss3Directory);
+  if (NS_FAILED(rv)) {
+    MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("couldn't get nsILocalFileWin"));
+    return rv;
+  }
+  return nss3DirectoryWin->GetNativeCanonicalPath(result);
+#else
   return nss3Directory->GetNativePath(result);
+#endif
 }
 
 // Returns by reference the path to the desired directory, based on the current
 // settings in the directory service.
 static nsresult
 GetDirectoryPath(const char* directoryKey, nsCString& result)
 {
   nsCOMPtr<nsIProperties> directoryService(
@@ -1227,17 +1239,28 @@ GetDirectoryPath(const char* directoryKe
   nsCOMPtr<nsIFile> directory;
   nsresult rv = directoryService->Get(directoryKey, NS_GET_IID(nsIFile),
                                       getter_AddRefs(directory));
   if (NS_FAILED(rv)) {
     MOZ_LOG(gPIPNSSLog, LogLevel::Debug,
             ("could not get '%s' from directory service", directoryKey));
     return rv;
   }
+#ifdef XP_WIN
+  // Native path will drop Unicode characters that cannot be mapped to system's
+  // codepage, using short (canonical) path as workaround.
+  nsCOMPtr<nsILocalFileWin> directoryWin = do_QueryInterface(directory);
+  if (NS_FAILED(rv)) {
+    MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("couldn't get nsILocalFileWin"));
+    return rv;
+  }
+  return directoryWin->GetNativeCanonicalPath(result);
+#else
   return directory->GetNativePath(result);
+#endif
 }
 
 
 nsresult
 LoadLoadableRootsTask::LoadLoadableRoots(
   const nsNSSShutDownPreventionLock& /*proofOfLock*/)
 {
   // Find the best Roots module for our purposes.