diff --git a/apache2-mod_nss.changes b/apache2-mod_nss.changes
index d6980ac..9b06d92 100644
--- a/apache2-mod_nss.changes
+++ b/apache2-mod_nss.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Thu Dec  7 13:19:08 UTC 2017 - vcizek@suse.com
+
+- drop obsolete mod_nss-dont_disable_SSLV2.patch
+  * bump up minimal NSS version to 3.25, which we now have everywhere
+- Require iproute2 for ss, which is used by gencert to gather noise
+
 -------------------------------------------------------------------
 Mon Oct 23 12:53:12 UTC 2017 - vcizek@suse.com
 
@@ -24,6 +31,7 @@ Thu Sep 15 10:44:06 UTC 2016 - vcizek@suse.com
 - use correct configuration path in mod_nss.conf.in (bsc#996282)
 - remove %post migration code from the old alias directory
 - generate dummy certificates if there aren't any in mod_nss.d
+  (bsc#998183)
 
 -------------------------------------------------------------------
 Fri Jul 29 18:04:55 UTC 2016 - vcizek@suse.com
diff --git a/apache2-mod_nss.spec b/apache2-mod_nss.spec
index aa6cf77..b17936a 100644
--- a/apache2-mod_nss.spec
+++ b/apache2-mod_nss.spec
@@ -38,7 +38,6 @@ Source4:        README-SUSE.txt
 Source5:        vhost-nss.template
 Patch1:         mod_nss-migrate.patch
 Patch2:         mod_nss-gencert-correct-ownership.patch
-Patch3:         mod_nss-dont_disable_SSLV2.patch
 Patch4:         mod_nss-gencert_use_ss_instead_of_netstat.patch
 BuildRequires:  apache-rpm-macros
 BuildRequires:  apache2-devel >= 2.2.12
@@ -49,11 +48,12 @@ BuildRequires:  findutils
 BuildRequires:  flex
 BuildRequires:  gcc-c++
 BuildRequires:  iproute2
+BuildRequires:  iproute2
 BuildRequires:  libapr-util1-devel
 BuildRequires:  libapr1-devel
 BuildRequires:  libtool
 BuildRequires:  mozilla-nspr-devel >= 4.6.3
-BuildRequires:  mozilla-nss-devel >= 3.15.1
+BuildRequires:  mozilla-nss-devel >= 3.25
 BuildRequires:  mozilla-nss-tools
 BuildRequires:  pkgconfig
 Requires:       %{apache_mmn}
@@ -61,7 +61,8 @@ Requires:       %{apache_suse_maintenance_mmn}
 Requires:       apache2 >= 2.2.12
 Requires:       findutils
 Requires:       iproute2
-Requires:       mozilla-nss >= 3.15.1
+Requires:       iproute2
+Requires:       mozilla-nss >= 3.25
 Requires(post): mozilla-nss-tools
 Provides:       mod_nss
 
@@ -75,7 +76,6 @@ security library.
 %setup -q -n mod_nss-%{version}
 %patch1 -p1
 %patch2 -p1
-%patch3 -p1
 %patch4 -p1
 
 # Touch expression parser sources to prevent regenerating it
diff --git a/mod_nss-dont_disable_SSLV2.patch b/mod_nss-dont_disable_SSLV2.patch
deleted file mode 100644
index 9098ef1..0000000
--- a/mod_nss-dont_disable_SSLV2.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-Index: mod_nss-1.0.14/nss_engine_init.c
-===================================================================
---- mod_nss-1.0.14.orig/nss_engine_init.c	2016-04-15 20:27:59.000000000 +0200
-+++ mod_nss-1.0.14/nss_engine_init.c	2016-09-15 13:34:23.723723904 +0200
-@@ -796,7 +796,8 @@ static void nss_init_ctx_protocol(server
-         }
-     }
- 
--    stat = SSL_OptionSet(mctx->model, SSL_ENABLE_SSL2, PR_FALSE);
-+    //stat = SSL_OptionSet(mctx->model, SSL_ENABLE_SSL2, PR_FALSE);
-+    stat = SECSuccess;
- 
-     /* Set protocol version ranges:
-      *