diff --git a/apparmor-abstractions-ssl_certs.diff b/apparmor-abstractions-ssl_certs.diff
new file mode 100644
index 0000000..69b3fd6
--- /dev/null
+++ b/apparmor-abstractions-ssl_certs.diff
@@ -0,0 +1,10 @@
+=== modified file 'profiles/apparmor.d/abstractions/ssl_certs'
+--- profiles/apparmor.d/abstractions/ssl_certs	2011-08-08 20:22:03 +0000
++++ profiles/apparmor.d/abstractions/ssl_certs	2013-11-25 23:40:53 +0000
+@@ -17,3 +17,5 @@
+   /usr/share/ssl/certs/ca-bundle.crt          r,
+   /usr/local/share/ca-certificates/ r,
+   /usr/local/share/ca-certificates/** r,
++  /var/lib/ca-certificates/ r,
++  /var/lib/ca-certificates/** r,
+
diff --git a/apparmor.changes b/apparmor.changes
index ae8054a..ce6e582 100644
--- a/apparmor.changes
+++ b/apparmor.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Nov 25 23:44:40 UTC 2013 - opensuse@cboltz.de
+
+- add apparmor-abstractions-ssl_certs.diff to allow access to 
+  certificates in /var/lib/ca-certificates/ (bnc#852018)
+
 -------------------------------------------------------------------
 Thu Nov 14 20:54:23 UTC 2013 - opensuse@cboltz.de
 
diff --git a/apparmor.spec b/apparmor.spec
index b751cc3..c1ac736 100644
--- a/apparmor.spec
+++ b/apparmor.spec
@@ -109,7 +109,7 @@ Patch9:         apparmor-fix-url-in-manpages-r2093.diff
 # fix aa-unconfined to work with all languages (commited upstream trunk r2190, 2.8 r2094)
 Patch10:        apparmor-unconfined-lang-r2094.diff
 
-# various permissions needed for Samba 4.1 - bnc#845867 bnc#846054 (not commited upstream yet)
+# various permissions needed for Samba 4.1 - bnc#845867 bnc#846054 - commited upstream trunk r2104, 2.8 branch r2254
 Patch11:        apparmor-profiles-samba4.diff
 
 # Add support for eDirectory calls in abstractions/nameservice. Not accepted upstream (yet) because of open questions
@@ -121,6 +121,9 @@ Patch13:        apparmor-profiles-dnsmasq.diff
 # ntpd - add missing permissions for drift file at yet another location - bnc#850374 - commited upstream trunk r2252, 2.8 branch r2103
 Patch14:        apparmor-profiles-ntpd-r2103.diff
 
+# abstractions/ssl_certs - add /var/lib/ca-certificates/ - bnc#852018 - commited upstream trunk r2255, 2.8 branch r2105
+Patch15:        apparmor-abstractions-ssl_certs.diff
+
 # create Immunix::SubDomain perl module - only included for openSUSE <= 12.1 - bnc#720617 #c7
 Patch21:        apparmor-utils-subdomain-compat
 
@@ -483,7 +486,7 @@ SubDomain.
 %{?gpg_verify:  %gpg_verify %{S:1}  }
 %setup -q
 %patch1 -p1
-%patch2 -p0
+%patch2
 %patch3
 %patch4
 %patch5 -p1
@@ -496,6 +499,7 @@ SubDomain.
 %patch12 -p1
 %patch13
 %patch14
+%patch15
 
 # only create Immunix::SubDomain perl module for openSUSE <= 12.1 
 %if 0%{?suse_version}